Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.

How can i view Incidents on DLP ?

Created: 31 Oct 2013 | 6 comments
Mavericks SYS's picture

Hello All,

Please i need help, my problem is :

I create a policy and rule intervention for Endpoint, and i test it, it's OK

But i don't see anything on Incident Endpoint.

Please how can i put a configuration to view incident on Enforce Server.

Thank's.

Operating Systems:

Comments 6 CommentsJump to latest comment

yang_zhang's picture

Did you log into Enforce as Administrator or other user that have the rights to review incident?

You can review the incidents from DLP Enforce's Incidents tab.

If a forum post solves your problem, please flag it as a solution. If you like an article, blog post or download vote it up.
Steve Randall's picture

Hello Mavericks SYS

From a troubleshooting perspective i would check the following :

  • The endpoint is connected to the network hosting the Endpoint Server, it may be the endpoint could not send incident information over
  • The role you are logged into Enforce as has access to view Endpoint Incidents
  • You are looking at the "Endpoint" section of reports (not Network or Discover)
  • Ensure the incidents are not being filtered out by the report you are using. 

How do you know your testing is working on the endpoint - do you get a notification / block message?

Steve

Regards

Steve Randall

Senior Technical Education Consultant

pete_4u2002's picture

can yopu see incident tab on the enforcer console?

fivelakes's picture

In addition to the suggestions above, check endpoint - incidents all and see if you see the data there.  

Matheus Vasconcelos's picture

You Login on Enforce with Administrator account? 

Check the comunication between enforcer and the Endpoint client.

Jsneed's picture

When I have problems like this, it is typically because I am changing the status on the incidents and the default status is new...