DLP incident "assign to" field value gets cleared when incident moves to close state

[Venkatesh4]

Hi All,

Facing an issue with DLP incidents. When we close the DLP incidents the "assign to" field value gets cleared automatically. Also, sometimes the end user field value gets cleared when the incident moves to close state.

Can anyone let me know the reason behind this?

Thanks in advance

[andy_ojha]

Hey there,

The baseline behavior today, is that the "Assigned to" value gets cleared out when the DLP Incident is closed.   You should still see that the "Last assigned by analyst" field gets updated to the value that was in "Assigned to".

In theory, there is no action pending for that person after the DLP Incident is Closed.

The "End User" Field should be getting cleared out though - that should remain static once it is set on the DLP Incident, even during Closure. 

-> By chance do we have any custom Business Rules that we introduced, that could be triggering this?
-> If not, would suggest opening a NOW Support Case to review this further - especially if this is not a consistent behavior you see for each DLP Incident being closed out

The Script Include -> "DLPCloseIncidentsDataBroker" has relevant logic here:

[Venkatesh4]

Hi @andy_ojha ,

Thanks for the quick response.

But after the incident closed I still see the "Last assigned to"  or "Last assigned by analyst" field is still blank.

Any idea on this?

Thanks

Venkatesh S

[andy_ojha · Accepted solution]

Hey there,

This will depend on the process we have in place (and also how we are testing).

If we are using the "Close" button as an Admin or DLP Analyst - the downstream behavior functions much differently than if we assign a DLP Incident to an End User, and the End User "Responds" with a Response Option that is mapped to a Closed State..

Do you have a bit more detail on how you are testing this - i.e. going through as an End User and providing a Response, or clicking Close as a DLP Analyst/Admin user?

In the scenario of assigning the DLP Incident to the "End User"

-> If the End User goes to the DLP Incident, and selects a "Response" that is mapped to the "Closed" State (e.g. Encrypted File)
-> The DLP Incident would then get Closed 
-> The "Last Assigned to" -> Would have the value of the End User (that provided the Response, which was mapped to a Closed State)

-> The "Last Assigned by Analyst" -> Depending on the process used, if the DLP Analyst was first to review and assign the DLP Incident to themselves (before re-assigning to the End User) - would be set here 

In the scenario of a DLP Analyst or Admin clicking "Close" - it will clear out that "Assigned to" value, but set the Last Assigned by Analyst (to the user that closed it).