Adaptive Protection policy with prevalence records doesn't pull some of the events

Products

• Endpoint Security Complete

Issue/Introduction

You notice in the Adaptive protection heat map prevalence with events but when you want to check further those events the log area doesn't  pull any thing, you can't click on the event as any other prevalence events.

Example below the Low prevalence has 7 events, however when you want to see those events when did occur or on which device, you click on the Event but doesn't pull any data.

 

Cause

Heat map data is collected from all devices that use a particular Adaptive Protection policy. The data in the heat map is based on telemetry that is collected from devices in the past 90 days.

Resolution

By Design, Heat map keep records of 90 days however logs in ICDM are kept for 30 days, If the data is 30+ it's normal that you can't see the data under investigate tab nor when you click on the event from the heat map.

 

Additional Information

CRE-10793