When remediating incidents, Risk Model instances are not displayed as partially or fully mitigated within the workflow view, nor within the model view.
This behavior was found during the course of troubleshooting to have multiple causes in the underlying code.
See the Additional Information section for more details.
Release : 6.5.3
Component : Risk Model
This defect has been fixed in ICA version 6.5.4.
The mitigation status of a Risk Model instance is a calculated value stored in the column MitigationDescription in the table LDW_RiskModelInstances and is based on the logic demonstrated in the following truth table:
|= 0||= 0||= 0||n/a|
|= 0||= 0||> 0||not mitigated|
|= 0||> 0||= 0||not mitigated|
|= 0||> 0||> 0||not mitigated|
|> 0||= 0||= 0||mitigated|
|> 0||= 0||> 0||partially mitigated|
|> 0||> 0||= 0||partially mitigated|
|> 0||> 0||> 0||partially mitigated|
Where m is the MitigatedCount value, u is the UnMitigatedCount value, v is the MeasureValue value, and x is the MitigationDescription value of the risk model instance.
A MeasureValue of '1' is inserted into entity collections that are not defined based on an event count. For Risk Model instances based on such entity collections (e.g., those collections defined based on entity counts), because the calculated column used to define mitigation status includes the MeasureValue field, and because a status of 'Mitigated' is contingent on this field being '0', the Risk Model instance would never return a mitigation status of 'Mitigated'.