Analyzer drillthrough performance is slow for entity collections

Products

• Information Centric Analytics
• Data Loss Prevention Core Package

Issue/Introduction

When viewing an Entity Collection definition in Analyzer, incident counts are returned quickly but drillthrough to view all incidents comprising the incident count is quite slow; reports of 30 minutes or more are common, depending upon the number of records returned.

Environment

Release : 6.5.2.2

Component :

Cause

This is caused by the structure of the query in the view vLDW_EntityCollectionToEventFact. Multiple entity type tables are joined by the query in this view, with an attendant execution cost.

Resolution

The view vLDW_EntityCollectionToEventFact has been optimized in ICA version 6.5.4 to query entity types discretely.