DLP 11.4 - Incident Manager Filtering problem

[DavHio]

Hello all,

A short story of my problem:

A few days ago, I discovered that both our DLP policies was unreadable out of a sudden.

When I clicked the Policy Catalog > Data Loss Prevention 11.4 > DLP Policy > "Our Policy" I got a blank page. 

When I clicked the Policy Catalog > Data Loss Prevention 11.4 > Windows Client Configuration > "Our Policy" I got a "An unexpected error occurred."

This was indeed extremely frustrating since we didn’t do any changes to the system.

Note!! The rules where still intact and was functioning.

Anyway, I re-created the broken policies based on McAfee Default, because our "My Default" was broken as well, with new names and submitted a change request to our customer to change the policy on 20K computers.

I started to assign the new policy to a smaller batch of computers to begin with.

Now, I wanted to go in to the DLP Incident Manager and create a filter on incidents for computers with that new policy.

Now to the problem. When adding the Policy Name in Filter Criteria’s a list box with available policy names pops up. In that list I cant find the newly created policy, but I do find the previous, broken policy name.

When I select View and add the column Policy Name to the view, that column shows "None" for computers with the new policy, and the correct policy name for computers with the previous, but broken policy name.

When I go in to System Tree, select one of the computers I assigned the new policy’s, I can see that the new policies in the View Assigned Policies for that computer is assigned correct.

ePO 5.9.1

DLP Endpoint version: 11.4.0.452 

DLP Extension version: 11.4.0.17

Would appreciate any help!

[tucker84]

Have you rebooted the ePO server? 

What web browser are you using to access ePO? Try a different one. I've seen unknown errors just based on the browser. Since the policy appears fine it might the issue.

[DavHio]

Hello, Thanks for the reply!

I tried Chrome and IE and none worked... No I didnt reboot the ePO Server. I can try doing that.

[DavHio]

Reboot didnt resolve the problem

[jsubbura]

Hi @DavHio ,

Thank you for writing in here.

Question: 

Now, I wanted to go in to the DLP Incident Manager and create a filter on incidents for computers with that new policy.

Now to the problem. When adding the Policy Name in Filter Criteria’s a list box with available policy names pops up. In that list I cant find the newly created policy, but I do find the previous, broken policy name.

Suggestion: 

Are the Incidents generated from the client machine with the New Policy assigned? DLP Incident Manager will only have the Policy Names for which the Incidents were generated from the client machines.

Thank you.

[DavHio]

Are the Incidents generated from the client machine with the New Policy assigned?
A. Yes

DLP Incident Manager will only have the Policy Names for which the Incidents were generated from the client machines.
A. Yes it shoud but is not.

[DavHio]

Old Policy name FJ_DLP_Policy_590 and FJ_Windows_Client_Configuration_590

New Policy name FJ_DLP_Policy-2020 and FJ_Windows_Client_Configuration_2020

Policy Assignment for one of the systems that got the new policies

Active Rule Sets for that policy

Systems with new policy assigned display None in the Policy Name column

New policy name is not available in the filter available values

[jsubbura · Accepted solution]

Hi @DavHio ,

This is a bug in DLP 11.4 version and this is fixed in DLP 11.4.200 version.

You can get the DLP 11.4.200 RTS package to test in your test environment or you can wait for the General Availability of DLP 11.4.200 RTW package in the product download site.

In the Release notes of DLP 11.4.200 you can see the below,

"Fixed an issue with the McAfee DLP policy name reporting in the DLP Incident Manager."

to obtain the RTS package we advise you to raise a support case with McAfee Support so that the RTS package can be shared over the Service Portal to you.

Thank you.

[DavHio]

Thanks for the answer! Really appriciated!