Data Loss Prevention

Hello,

 Since few days, when we export all incident list in XML format (used to do some full analysis report on all our incident), history informations are no more available in the XML file for most of event. It seems to happen since we did a massive deletion of incident in the system.

 What is even more strange, is that history information are available in enforce web interface.

Does anyone already have this type of issue (and have a solution) ?

What steps did you do to export the incident list into XML ones?

 With a specific profile who has access to all incidents (at least some part of them) i use "Export" menu then "Export ALL : XML". I do this only for network incident as for now we monitor only network.

According to your steps, you said you did a massive deletion of incident in the system.

When you deleting incident from DLP Enforce Console, there are two options:

If you choose 'Retain Incident, but Delete Original Message/Attachment(s)/File(s):', the history information will be retain in the database. Then after export as XML, the history information will be export to the XML file.

thx for your answer.

All incidents were fully deleted ("delete incident completely" were choosen when we did our massive deletion. So we didnt have anymore information about these incidents, and it is ok.)

But the issue is that we lost history informations of all event we kept in the enforce (info must still be in database cause it is accessible through enforce web UI in History sub menu).