Incorrect mitigation status displayed for mitigated and partially mitigated Risk Model instances

book

Article ID: 191930

calendar_today

Updated On:

Products

Information Centric Analytics

Issue/Introduction

When remediating incidents, Risk Model instances are not displayed as partially or fully mitigated within the workflow view, nor within the model view.

Cause

This behavior was found during the course of troubleshooting to have multiple causes in the underlying code.

See the Additional Information section for more details.

Environment

Release : 6.5.3

Component : Risk Model

Resolution

This defect has been fixed in ICA version 6.5.4.

Additional Information

The mitigation status of a Risk Model instance is a calculated value stored in the column MitigationDescription in the table LDW_RiskModelInstances and is based on the logic demonstrated in the following truth table:

m u v x
= 0 = 0 = 0 n/a
= 0 = 0 > 0 not mitigated
= 0 > 0 = 0 not mitigated
= 0 > 0 > 0 not mitigated
> 0 = 0 = 0 mitigated
> 0 = 0 > 0 partially mitigated
> 0 > 0 = 0 partially mitigated
> 0 > 0 > 0 partially mitigated

 

 

 

 

 

 

 
 
 
 
 
 
 
 

Where m is the MitigatedCount value, u is the UnMitigatedCount value, v is the MeasureValue value, and x is the MitigationDescription value of the risk model instance.

A MeasureValue of '1' is inserted into entity collections that are not defined based on an event count. For Risk Model instances based on such entity collections (e.g., those collections defined based on entity counts), because the calculated column used to define mitigation status includes the MeasureValue field, and because a status of 'Mitigated' is contingent on this field being '0', the Risk Model instance would never return a mitigation status of 'Mitigated'.