Data Loss Prevention

 

Hi,

After loading policies however agents work properly and block actions according to policies, in SDLP web console is not displayed any report.

SLDP web console displays the number of agents, status of events and server.

Please  guide me to see all reports about any changed polices and data.  

Best Regards

have you created a dashboard

check this article , it may help

https://www-secure.symantec.com/connect/articles/dlp-create-dashboard-and-send-report-email

 

I have created dashboard, unfortunatly there is not any schedual delivery parameter in my dashboard setting page.

And also in dashboard is shown this message" No Data availabal "

 

 

are you seeing incidents on agents?

are the agents communicating to the prevention server?

is prevention server communicating with the enforcer?

 

Please guide me to check these.

Agents could block according to policies. Is it  mean that agents commiunucate with prevention server?

Now I am trying in Test enviroment (Single Tier).

 

click on the server overview page to see if the detection server is registered and running.

 

 

it is ok  and both of them are running !

 

could you tell me why some features are not display ?

such as  schedual delivery parameter in my dashboard setting page.

I appreciated you , answer me soon  

goto the agents overview page and see if the agent is able to communicte with the server?

 

yes it is connect , i told you :Agents could block according to policies

 

then you might need to pull th eagent logs for review .

i do this but it dose not work !!!

Are there ANY incidents in the system or just not in the Dashboard?

Incidents > Endpoint

Also check the System Overview Page.. Does it show that the endpoint server is seeing ANY messages?

Hope this makes sense.

If this solves your questions please marked as solved.

Ronak

hi there are no incident in the system but in system overview page it does show the endpoint server message . also I test it with dlp version11 and it works currently but when install version 12 Or upgrade it to version 12 I have this problem . tanx Samar pour

hi there are no incident in the system but in system overview page it does show the endpoint server message . also I test it with dlp version11 and it works currently but when install version 12 Or upgrade it to version 12 I have this problem . tanx Samar pour

OK..

I am confused.. you are saying that you had a working environment when on Version 11.6?

Though when you upgraded the agents AND the server to 12.0, that it broke the Console, but the agents are still blocking?

If this is the case I would open a support ticket.. there is a lot more things happening on the back end of the server then.

Sounds like the upgrade went bad.

I do know that there is a wierd known issue where the UI has broke before after an upgrade. The resolution it to uninstall the Enforce Console and reinstall the 12.0 Version of the platform. Make sure to back up the crypto master key file before uninstalling (backup the config drive) and DO NOT reinitialize the DB when installing the Version 12 platform.

Overall I would open a support case and see what they say.

Hope this makes sense.

If this solves your questions please marked as solved.

Ronak

I install version 12.0 at first and I want this ,but when I have problem in incident, uninstall that and test with version 11 .please help me if I install version 12.0 and how to see incident ,

I install version 12.0 at first and I want this ,but when I have problem in incident, uninstall that and test with version 11 .please help me if I install version 12.0 and how to see incident ,

I install version 12.0 at first and I want this ,but when I have problem in incident, uninstall that and test with version 11 .please help me if I install version 12.0 and how to see incident ,

I install version 12.0 at first and I want this ,but when I have problem in incident, uninstall that and test with version 11 .please help me if I install version 12.0 and how to see incident ,

I install version 12.0 at first and I want this ,but when I have problem in incident, uninstall that and test with version 11 .please help me if I install version 12.0 and how to see incident ,

What version is the Enforce server and Endpoint server? 11.6, 11.1?????

What version is the Endpoint agent???

Be specific on the Version numbers... VERY important.

 

version 12.0 for server and version 12.0 for client and when I install version 11 , I install version 11.5 for server and client

Here is an answer to a couple of questions..

1. The "schedual delivery parameter in my dashboard setting page." option will NOT show up when you are logged in as Administrator. That option is ONLY available if you are another User that you need to create. The Administrator Account does NOT have an email address associated to it, hence there is no way to send an email notification. Create a NEW user and log in as that user, you will then be able to see the "schedual delivery parameter in my dashboard setting page." option.
2. Log in as a new user to the system and then go to Incidents > Endpoint make sure that you have set the status to 'ALL' (top dropdown).Also make sure the date range is all too. You should hopefully see more incidents
3. If this does not work, you will need to open a support ticket ASAP.

Hope this makes sense.

If this solves your questions please marked as solved.

Ronak

i do these step (1 & 2 ) but i did not see any schedual delivery parameter in my dashboard setting page .could u help me support ticket please ?

did you try with Administrator account?

to open a case you need to call up support or open a web case.

check this link

 

http://www.symantec.com/support/contact_techsupp_static.jsp?inid=us_sc_flyout_support_contacttech

 i do it with both administrator and admin users but it does not work at all , there is no incidet in data base when i connect to database table .

You will need to go to the System > general section and make sure you have enable the sending of reports.

 

Make sure you have set this uo... otherwise no email reports will be able to be sent out PERIOD.

 

Hope this makes sense.

If this solves your questions please marked as solved.

Ronak

why ?!!! i want to see incident in may dashboard ,i don't have any smtp server in my test invironment. is it related to dashboard incident ? 

i check my oracle database table and there is not any record in incident table ?

samar

Samar..

Couple things..

1. In the System > General Section have you set up the mail server settings so the DLP server can even send emails? Make sure to select the right setting so that you can send out emails.
2. When you upgrade to version 12 have you installed this on a new server or upgrading the same server from 11 to 12?
3. Are you connecting a new server to the existing DB, or are you upgrading the whole thing?

 

Hope this makes sense.

If this solves your questions please marked as solved.

Ronak