The Comprehensive Risk report shows items with "Unknown" risk severity

Products

• Endpoint Protection

Issue/Introduction

In Symantec Endpoint Protection Manager (SEPM) > Quick Reports > Risk Reports, you select log type as Risk and report as Comprehensive Risk report. In the report, the risk severity is Unknown for a number of items.

Environment

Symantec Endpoint Protection Manager 12.1

Cause

Risk severity is set based on the following categories:

1 - Very Low 
2 - Low 
3 - Moderate  
4 - Severe  
5 - Very Severe  

If there is no category value in the LiveUpdate virus content, however, the Risk severity is set to a default value of -1. If the category in the VIRUS table is updated from Security Response, but the virus name is not present in savlisting.xml, then the category will not be updated and keep the default value. Similarly, Security Response may return a category value of 0. As both values are unknown to the reporting component, it is presented as such.

Resolution

With SEPM 14, the default category and maxcategory were changed from -1 to 1 in a fresh installation. During a SEPM upgrade, default category and maxcategory are set to 1 and values are updated to 1 if they are -1 or 0. Security Reponse also ensured their default 0 category defaults to 1 for the purpose of savlisting.xml file generation.