This often a DLP issue where DLP has incidents marked as "UNKNOWN". ICA then pulls this data as is and it will need to be resolved on DLP.
Pull incident reports on Symantec DLP that correspond with the ICA report and find that the there are users "UNKOWN" in DLP. Then resolve that issue. ICA will sort itself out on next pull of good data.