During nightly RiskFabric processing, ICA updates the EventMitigatedDate and EventMitigatedPortalUserID on previously ingested DIM incidents when the statuses of these incidents have changed in DLP and these statuses' corresponding custom remediation actions in ICA for mitigation and classification are NULL. Once classification or mitigation is set manually in ICA, these values should be effectively locked and not updated by changes to the status in the source system.
Release : 6.5.4
This behavior is caused by a defect in the way a function evaluates NULL mitigation and classification values for custom remediation actions.
This defect is fixed in 6.5.4 MP1.