Traffic log shows audited events, but no incident is created

If there are any off-box components in the Forcepoint DLP installation and the Forcepoint DLP servers are not on the domain, then all passwords and user names must match for the service accounts being used for Forcepoint DLP.

For example, if the account Forcepoint with a password of “Pa55word123” is being used as the service account on the Forcepoint Security Manager, then the service account in use for any off-box Forcepoint DLP-installed components must also be Forcepoint with the password of “Pa55word123” as well.

If the user names and passwords do not match, then the off-box components will be unable to communicate with the shared directories of the management server, which will prevent incidents from being recorded to the archive folder on the management server.