Symantec Data Loss Prevention (DLP) Enforce
DLP Incident reports summarized by week display incorrect week boundaries around the end of year or beginning of new year
While you generate a report summarized by week with incidents produced around the end of year / beginning of the next year the result returns incorrectly defined 'week boundaries' in the Enforce UI such as: 'Jan 14, 2019 - Jan 7, 2019' (dates in reversed order) or 'Dec 12, 2018 - Jan 7, 2018' (incorrect dates range spanning multiple weeks, incorrect upper bound year). The incidents produced in a particular week of 2019 are incorrectly put into the following week bucket.
For example you encounter the issue when summarising incidents by week beginning 31/12/2018 and ending 06/01/2019, the incidents for the current week are shown as January 2018:
You select the row displaying 01-Jan-2018 - 07-Jan-2018 and no results are found (correctly, as there are no incidents with those dates):
When using 'Current Week to Date' the alerts are correctly identified (the count had increased by 6 between screen shots):
A hot fix is available for existing DLP versions 15.x please contact Symantec Technical Support for details.
A final fix for this issue has been targeted for DLP v16.0 release (*subject to change).
Alternatively consider using a summarization by month or quarter instead, which are not affected by this defect.
When generating an incident report by clicking on a 'faulty week' link, the report can be adjusted (correct the date range manually) and re-run the report to display the desired correct data.