Associating DIM incidents with domains
search cancel

Associating DIM incidents with domains

book

Article ID: 184928

calendar_today

Updated On:

Products

Information Centric Analytics Data Loss Prevention Core Package

Issue/Introduction

In the Information Centric Analytics (ICA) database RiskFabric, the table LDW_DIMIncidentsToIPDestinations contains fewer Data In Motion (DIM) incident-to-IP address associations than expected. Is there an alternative way to map DIM incidents to parent or top level domains (TLDs)?

Environment

Version : 6.x

Component : Symantec DLP Integration Pack

Resolution

The T-SQL query provided in the following procedure will associate TLDs with DIM incidents and return a count of incidents-to-TLDs:

  1. Open SQL Server Management Studio (SSMS)
  2. Connect to the Database Engine hosting the RiskFabric database
  3. From the menu bar, select File > New > Query with Current Connection
    A new query editor window will open
  4. Copy the following query and paste it in the new query editor window:
    USE RiskFabric;
    GO
    SELECT e.StatusName,
    d.TopLevelDomain,
    COUNT(*) AS INCIDENT_COUNT
    FROM dbo.LDW_DIMIncidents AS di WITH (NOLOCK)
    INNER JOIN dbo.LDW_DIMIncidentStatuses AS e
    ON di.StatusID = e.StatusID
    LEFT JOIN dbo.LDW_DIMIncidentsToNetworkEndpointDestinations AS i2ned WITH (NOLOCK)
    ON di.DIMIncidentID = i2ned.DIMIncidentID
    LEFT JOIN dbo.LDW_NetworkEndpoints AS ne
    ON i2ned.NetworkEndpointID = ne.NetworkEndpointID
    LEFT JOIN dbo.LDW_Domains AS d
    ON ne.DomainID = d.DomainID
    GROUP BY e.StatusName,
    d.TopLevelDomain
    ORDER BY 1,2;
  5. Execute the query by pressing the F5 key, clicking the Execute button in the SQL Editor toolbar, or selecting Query > Execute from the menu bar