Re-classify DLP incidents, stored in database

[Grigoriy]

Good day, dear community members.

We have a bunch of DLP incidents in DLP Incident Manager.

Is it possible to re-classify  or to filter this incidents in ePO, using new classification (i.e. using new dictionary with key-words)?

#Data Loss Prevention (DLP)

[Fademidun]

,

Are you referring to existing in Incident manager or new incidents? and to reclassify or filter by new classification, you'll need to probably create New dictionary entry/Classification/New rules sets/New rule

[Grigoriy]

Hello

I'm referring to existing events in Incident manager - is it possible to filter existing events by new classification or reclassify them?

[Fademidun · Accepted solution]

Hey, I don't think this is possible, existing incident in incident manager already had time stamp/evidence and rules locked down with the classification, doing this will invalidate the incident and messed up the reporting. Once an incident is generated and recorded in incident manager based on classification, it cannot be amended, to reclassify means you need to generate new incident based on new classifications, you can still use same rule/rule sets. e.g. if your classification is based on IBAN and changed it to PCI, old incident - IBAN cannot be reclassify as - PCI, not possible. Even if you run a report and try to manipulate it, it won't work. I am open to anyone done this before to explain how it's achievable

[Grigoriy]

Hello,

Thank you!