search cancel

DLP Incident Status and DLP Incident Status History cubes display different statuses for the same incident

book

Article ID: 212909

calendar_today

Updated On:

Products

IT Analytics

Issue/Introduction

When comparing the status history of a Symantec DLP incident between the DLP Incident History and the DLP Incident Status History cubes, the status history values are not the same. For example:
 
DLP Incident History
  1. New
  2. Escalated to Audit
  3. Resolved
DLP Incident Status History
  1. New
  2. Dismissed
  3. Resolved

Environment

Release : 2.9.x

Component : Cubes

Cause

The underlying SQL view used to populate the DLP Incident Status History cube relies upon an ordering function that returns an incorrectly ordered list under some circumstances.

Resolution

This is a known issue that will be fixed in an upcoming release of IT Analytics.

If needed, please contact Broadcom support for assistance.