DLP Endpoint Incidents Missing Risk Level with Neo Endpoint Installed

DLP Endpoint Incidents Missing Risk Level with Neo Endpoint Installed

Summary
Upgrade the Endpoint Classifier to the latest version to resolve the issue.
Problem
On a DUP-enabled DLP environment with the Neo and DLP Endpoint installed on a machine, generated Risk Ranking incidents are not showing the Risk Level when viewed in the Forcepoint Manager.

The environment is using NEO version 20.09.0.34 and the Endpoint Classifier version 8.8.0.347.

A debug of MessageBusClient shows the following:
2020-11-01 14:16:07,808 [0x000014a8] DEBUG MessageBusClient - MessageBusConsumerThread - Mutex HybridDLPMutex is not yet created by client id [FPDLP] , sleep for 10s to wait for creation. error The system cannot find the file specified.
Solution

In order to resolve the issue, upgrade the Endpoint Classifier to the latest version (8.8.0.355 or later). This pertains to a known issue regarding the mutex file location.

That is, build another DLP Endpoint package using an Endpoint Classifier version (EPA.msi/EPA64.msi) of 8.8.0.355 or later and install the new package on the environment prior to installing the DUP Neo Endpoint. For more information, please refer to Combining the Neo DUP Endpoint with the Forcepoint One DLP Endpoint.

    • Related Articles

    • Obtaining the Hybrid Neo Endpoint

      Summary Describes how to download the Hybrid Neo Endpoint from the Cloud Portal. Information As of 20th October 2021, the Neo Endpoint for Web Hybrid can be downloaded from the Cloud Portal. Customers should have already received an email with ...

    • Linux F1E DLP Endpoint Support

      Summary Support for the Linux environment has ceased for the time being. Problem The Linux Endpoint appears to be missing from modern F1E releases and is not present within the F1E and Forcepoint DLP Endpoint Operating System and Browser Support ...

    • F1E DLP Inline Proxy

      Introduction to the F1E Inline Proxy The Forcepoint DLP Inline Proxy, which runs locally on the F1E Endpoint Client machine, is the preferred way to enforce web policies and is intended to replace the use of F1E browser extensions. As described in ...

    • Differences Between Stealth and Interactive DLP Endpoint Modes

      Summary This article goes through the differences between stealth and interactive DLP Endpoint modes Problem What is the difference between the Stealth mode and Interactive mode when building a DLP Endpoint installation package? Solution The ...

    • Obtaining Removable Media Serial Numbers for DLP Endpoint Policies

      Problem Starting from Forcepoint DLP (formerly Websense Triton AP-DATA) version 8.2, Endpoint Devices can be configured to include device serial numbers to limit the scope of inclusion compared to the use of wildcards. In lieu of generating a sample ...