search cancel

DLP Incident Status and DLP Incident Status History cubes display different statuses for the same incident


Article ID: 212909


Updated On:


IT Analytics


When comparing the status history of a Symantec DLP incident between the DLP Incident History and the DLP Incident Status History cubes, the status history values are not the same. For example:
DLP Incident History
  1. New
  2. Escalated to Audit
  3. Resolved
DLP Incident Status History
  1. New
  2. Dismissed
  3. Resolved


Release : 2.9.x

Component : Cubes


The underlying SQL view used to populate the DLP Incident Status History cube relies upon an ordering function that returns an incorrectly ordered list under some circumstances.


This is a known issue that will be fixed in an upcoming release of IT Analytics.

If needed, please contact Broadcom support for assistance.