Mitigation status unexpectedly changed automatically by incident status changes in DLP

Products

• Information Centric Analytics
• Data Loss Prevention Core Package

Issue/Introduction

During nightly RiskFabric processing, ICA updates the EventMitigatedDate and EventMitigatedPortalUserID on previously ingested DIM incidents when the statuses of these incidents have changed in DLP and these statuses' corresponding custom remediation actions in ICA for mitigation and classification are NULL. Once classification or mitigation is set manually in ICA, these values should be effectively locked and not updated by changes to the status in the source system.

Environment

Release : 6.5.4

Component :

Cause

This behavior is caused by a defect in the way a function evaluates NULL mitigation and classification values for custom remediation actions.

Resolution

This defect is fixed in 6.5.4 MP1.