Divide by Zero error encountered on Normality Score job step

Products

• Information Centric Analytics
• Data Loss Prevention Core Package

Issue/Introduction

RiskFabric nightly and intraday jobs, as well as custom jobs processing normality scores, fail with a message indicating a divide by zero error was encountered.

Environment

Release : 6.5.x

Component : IW

Cause

This is caused when the EventCount column of the table LDW_EventDetail contains the value 0 on one or more records. This value should always be a minimum of 1; the normality formula divides by EventCount.

EventCount values of 0 are caused by data source queries that return a hit value of 0 for Unified Events (UE), which include Endpoint, Web Activity, and Authentication Events.

Resolution

Use a formula for UE data source queries to set the value of fields mapped to EventCount to 1 when they would otherwise return a 0.