search cancel

DLP Incident reports summarized by week display incorrect week boundaries


Article ID: 174195


Updated On:


Data Loss Prevention Enforce


Symantec Data Loss Prevention (DLP) Enforce

DLP Incident reports summarized by week display incorrect week boundaries around the end of year or beginning of new year

While you generate a report summarized by week with incidents produced around the end of year / beginning of the next year the result returns incorrectly defined 'week boundaries' in the Enforce UI such as: 'Jan 14, 2019 - Jan 7, 2019' (dates in reversed order) or 'Dec 12, 2018 - Jan 7, 2018' (incorrect dates range spanning multiple weeks, incorrect upper bound year). The incidents produced in a particular week of 2019 are incorrectly put into the following week bucket. 

For example you encounter the issue when summarising incidents by week beginning 31/12/2018 and ending 06/01/2019, the incidents for the current week are shown as January 2018:

You select the row displaying 01-Jan-2018 - 07-Jan-2018 and no results are found (correctly, as there are no incidents with those dates):

When using 'Current Week to Date' the alerts are correctly identified (the count had increased by 6 between screen shots):


A hot fix is available for existing DLP versions 15.x please contact Symantec Technical Support for details. 

A final fix for this issue has been targeted for DLP v16.0 release (*subject to change).

Alternatively consider using a summarization by month or quarter instead, which are not affected by this defect.
When generating an incident report by clicking on a 'faulty week' link, the report can be adjusted (correct the date range manually) and re-run the report to display the desired correct data.