The Incident history does not update right away when a smart response rule is triggered
Last Updated March 29, 2011
When a smart response rule is being trigger via the Enforce UI the Incident history does ot reflect this right away.
For example, if an e-mail notification response rule is triggered manuallyit takes some time to show within the incident that the email has been send.
The Symantec DLP UI does handle response rules by executing them in the background. Response rule actions will be added to a background queue and once the response rule has been executed the incident history will reflect this. However, since the UI goes back to allow you right away the further use of the UI the incident will be only updated once the response rule has been fully executed.
As a result, the observed behaviour is expected and can occur when you experience high CPU usage or a larger queuing. Another resource of delay can be if you have email notification performed via an MTA that has high latency.
Imported Document ID: TECH219197
Subscribing will provide email updates when this Article is updated. Login is required to Subscribe