Troubleshoot the DLP service

Introduction

This page gathers answers to the questions that come up most often when using the DLP console. Items are ordered from the most common to the rarest.

My rule does not do anything

Work through this in order — the cause is almost always one of the first three.

1. Is it published? A rule with the Draft badge has no effect on traffic. Open Publish and check whether it is listed under Draft Rules. If it is, it is not live yet.
2. Is it in a policy? A published rule that no policy references is never evaluated. Open Policies, find the policy for that platform type, and check the rule is in its list.
3. Is the policy published? The policy itself has a Draft / Published badge. Both the rule and the policy need to be published.
4. Is another rule deciding first? Evaluation stops at the first pass or block. If a rule above yours in the policy's list already produced a decision, yours never runs. Reorder the policy so the more specific rule comes first.
5. Does the condition actually match? Open the rule and use Test with a sample you are certain should match. If the test passes but real traffic does not, the field you chose is probably not the one carrying the content — check the decision logs for a real request and see which fields it has.

A legitimate request was blocked

1. Open Decision Logs, set Decision to Block, and find the request — by Request ID if the user gave you one, or by platform and time.
2. Open the row and read Triggered By. It names the field, the operator and the detector.
3. Open Detectors, find that detector, and use Test patterns on text like the user's.

If the detector matches text that is not really sensitive, the pattern is too broad for your traffic. Either write a tighter custom detector and switch the rule to it, or add a pass rule for the legitimate case and place it above the blocking rule in the policy.

If the detector matched something genuinely sensitive, the block was correct.

I cannot see a menu entry

Menu entries are hidden when your roles do not grant access to them. Your roles are shown as badges at the bottom of the sidebar. Compare them with the table on the Manage users page and ask an administrator for what you need.

Two entries catch people out:

• Publish requires Rule Publisher or Admin — Rule Editor is not enough, by design.
• Users and API Tokens require Admin.

A button is greyed out

• Save as Draft on a rule: something required is missing — a name, a condition, a block message for a block rule, or a complete modification for a modify rule.
• Save as Draft on a policy: the policy needs a name and a platform type.
• Test Rule in a test dialog: the sample box must contain a JSON object with at least one key. The default {} is not enough.
• Publish: there are no draft changes to publish, or the page could not load your rules and policies — look for the explanatory message under the page title.
• Delete on a user: that user is the last remaining Admin.

I cannot change a rule's platform type

By design. The platform type determines which fields a condition can reference, so it is fixed once the rule is saved. Create a new rule for the other platform type and delete the old one.

Renaming a custom detector broke my rules

Rules reference custom detectors by name. Renaming one leaves every rule pointing at a name that no longer exists.

Rename it back if you can. Otherwise: create the detector under the new name, edit each affected rule to reference it, publish, then delete the old detector.

To avoid this, treat custom detector names as permanent from the moment you first reference them.

I cannot delete a detector

Deletion is refused while any rule still references the detector. Find the rules using it — search the rules list, or check each rule's condition — remove the reference, then delete the detector.

The dashboard shows no data

• If all three lines are flat at zero, the service is receiving no traffic. That is a platform-side question, not a rules question.
• If only block and modify are at zero while pass is healthy, no rule is matching. Either your traffic really is clean, or a condition is wrong — test a rule against a sample you know should match.
• Also check the time range: the default is 24h, and a change you made an hour ago will be a very small part of that picture. Try 1h.

What does the "dropped logs" warning mean?

Some evaluation records could not be processed by the log pipeline. Requests were still evaluated and enforced correctly — protection is not affected — but the dashboard figures and decision logs are under-counting by that number. Report it to your service provider.

The console shows "Service Unavailable"

The backend became unreachable. The console re-checks every 10 seconds and clears the panel by itself once the service is back. There is nothing to click, and no work is lost that you had already saved. If it lasts more than a few minutes, contact your service provider.

I am locked out after failed sign-ins

Five failed attempts lock an account for five minutes. Wait, then try again. If you have genuinely forgotten the password, ask an administrator to reset it — they can do it without knowing your current one.

My script or pipeline gets rejected by the API

Open API Tokens and look at the Status of the token it uses:

• Revoked or Expired — the token is dead and cannot be reinstated. Create a replacement and deploy it.
• Active — then the value being sent is wrong. It must be the whole string, starting with num_dlp_, in an Authorization: Bearer header, with no truncation or trailing newline from however it was copied. Check Last used: if it never advances, the calls are not reaching the token at all.

If the call succeeds but is refused for one particular thing, the token is valid and simply lacks the role — its roles are listed on the same page, and a token cannot be edited, only replaced. See Authenticate with an API token.

I lost an API token value

There is no way to recover it: the console stores only a fingerprint. Revoke the old token and create a new one.

How do I undo a publish?

You cannot un-publish, because published versions are immutable — that is what makes the record of what was enforced trustworthy. To go back:

1. Open the Publish History and note the content of the version you want.
2. Use each affected rule's or policy's History panel to Restore the earlier version, which creates a draft.
3. Publish those drafts as a new version.

The result matches the older state, and the history of what ran when stays accurate.

Still stuck?

Collect the Request ID from the decision log, the rule name, and the ruleset version shown on the Publish page, then contact your service provider. Those three identify the situation precisely.