DLP Incident Status and DLP Incident Status History cubes display different statuses for the same incident

Products

• IT Analytics

Issue/Introduction

When comparing the status history of a Symantec DLP incident between the DLP Incident History and the DLP Incident Status History cubes, the status history values are not the same. For example:

 

DLP Incident History

1. New
2. Escalated to Audit
3. Resolved

DLP Incident Status History

1. New
2. Dismissed
3. Resolved

Environment

Release : 2.9.x

Component : Cubes

Cause

The underlying SQL view used to populate the DLP Incident Status History cube relies upon an ordering function that returns an incorrectly ordered list under some circumstances.

Resolution

This is a known issue that will be fixed in an upcoming release of IT Analytics.

If needed, please contact Broadcom support for assistance.