ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

DLP Incident Status and DLP Incident Status History cubes display different statuses for the same incident


Article ID: 212909


Updated On:


IT Analytics


When comparing the status history of a Symantec DLP incident between the DLP Incident History and the DLP Incident Status History cubes, the status history values are not the same. For example:
DLP Incident History
  1. New
  2. Escalated to Audit
  3. Resolved
DLP Incident Status History
  1. New
  2. Dismissed
  3. Resolved


The underlying SQL view used to populate the DLP Incident Status History cube relies upon an ordering function that returns an incorrectly ordered list under some circumstances.


Release : 2.9.x

Component : Cubes


This is a known issue that will be fixed in an upcoming release of IT Analytics.

If needed, please contact Broadcom support for assistance.