When checking user scores and ratings on an Identities > User Details page in the Information Centric Analytics (ICA) console, you find that despite having an overall non-zero Percentile ranking and Risk Score, the Weighted and Normalized scores across all Risk Vectors for the user are 0.00; all Percentiles are 0%; and the Change Since Yesterday column shows positive and/or negative changes on one or more Risk Vectors.
The Calculate Risk Scores step of the RiskFabric Processing job started before midnight and completed at or after midnight.
If risk scores are calculated before midnight and the Risk Scoring watermark is set at or after midnight, the scores will be treated as though they were the previous day's values rather than today's values. This is why you will still see a comparison between yesterday's scores and today's; what should be today's scores are treated as yesterday's.
Release : 6.5.x
Component : Risk Scores
Schedule the RiskFabric Processing job to run at a time that avoids the Calculate Risk Scores job step traversing or ending at midnight.
An improvement to implement a check against this scenario is under development and will be included in a future release of ICA.
The same behavior can be seen on the details pages of other entity types (e.g., Person, Computer Endpoint, etc.).
The Risk Scoring Watermark value can be viewed by navigating to Admin > Settings > General > Risk Scoring - Overall or by running the following query in SQL Server Management Studio:
WHERE DisplayName = 'Risk Scoring Watermark'
The following query will return the time at which scoring began during the last Risk Fabric Processing job:
SELECT TOP 1 run_date AS [Date],
STUFF(STUFF(RIGHT(REPLICATE('0', 6) + CAST(h.run_time AS varchar(6)), 6), 3, 0, ':'), 6, 0, ':') AS [Time]
FROM sysjobhistory AS h
JOIN sysjobs AS j
ON h.job_id = j.job_id
WHERE j.[name] = 'RiskFabric Processing'
AND h.step_name = 'Calculate Risk Scores'
AND run_status NOT IN (0, 3)
ORDER BY run_date DESC