Data Loss Prevention

Hello,

 I would like (only in some specific case) to overwrite a custom attribute value normally set by an automatic response rule.

unfortunately, response rules are executed after custom plugins so i am not able to overwrite value.

Does anyone know a way to do this ?

Regards

Unfortunately, I cannot catch up with your question...

Stephane,

Can you provide more details on what you are trying to accomplish and when (you said in some specific cases, which ones).

You can write a custom script to run before a repsone rule (lookup) or you can also create a new manual response rule.

Hope this makes sense.

If this solves your questions please marked as solved.

Ronak

Hi,

 I have a custom attribute which is "normally" set to a specific value by an automated response rule (this working fine).

 In some particular case , i would like to change this value, so i have implemented that in my custom plugin and when i just rerun lookup plugins on an incident it works fine (using Lookup button in incident detail page)

My issue is that when i test an incident detection with response ruel and custom plugin execution, the custom plugin is executed before the response rule so final value for my custom attribute is not the one of the plugin but the one of the response rule (the default one).

 I thought (but it seems i was wrong) automated response rule were executed before plugins when a new incident is generated.

So i have found a workaround as now default value is also set by custom plugin.

 Regards.

Stephane,

I think you answered your question..

The DLP system will always run the Lookups FIRST and then the response rules. That is how the system was designed and no way to change it,

Hope this makes sense.

If this solves your questions please marked as solved.

Ronak

I agree this is DLP design but It is just that custom plugins script are stored on enforce server, so it means response rules are not executed by monitor servers but by enforce server when it receive an incident....thats why i was a little bit confused by that.

The "good point" is that it should be possible to use custom attributes in automated response rule conditions as some of them are computed before.