Incident action misattribution in ICA

Products

• Information Centric Analytics
• Data Loss Prevention Core Package

Issue/Introduction

Actions taken on an incident in Symantec Data Loss Prevention (DLP) that change the status and severity of an incident that had been previously ingested into and acted upon in Information Centric Analytics (ICA) are misattributed in the incident's Changed By field in ICA to reflect the user who last acted on the event in ICA prior to the change made in DLP.

Environment

Release : 6.5.3

Component : Symantec DLP Integration Pack

Cause

Product limitation.

Resolution

This behavior is fixed in version 6.5.4.