DLP incident page user ID based search using domain\username does not work.
233
Created On 03/11/25 00:41 AM - Last Modified 10/28/25 13:34 PM
Symptom
- The DLP incident page search functionality in Strata Cloud manager did not work when using domain\username filters.
- The search function works normally using the username.
- For example, the DLP incident page shows incidents which shows the usernames listed as domain\username.
- When searching with the same name (domain\username), the response is either empty or an error.
- When searching for user id username, the search function works as expected.
Environment
- Prisma Access with DLP license
- Strata NGFW with DLP license.
Cause
- \ is not supported with the search function for user-id search on the DLP incident page.
- For example, even if the users listed on the incident page are in the format "company\user1.lastname", Search can only be done with "user1.lastname"
Resolution
- Search functions in DLP incident page in Strata Cloud manager does not support \ function.
- The only special character supported are underscore (_) and Percent (%)
- Do not us the \ in the search function.
Additional Information
N/A