When viewing the Risk Rating section of the Details page for any entity type (Applications, Computer Endpoints, IP Addresses, Users, or Persons) in Information Centric Analytics (ICA), the entity's aggregate risk score is displayed above the list of Risk Vectors, but scores for individual risk vectors are 0.00, with the Change Since Yesterday value set to 0.
Release : 6.5.4
The general portal setting Risk Scoring Watermark was not updated at the end of the Calculate Risk Scores step (19) of ICA's nightly RiskFabric Processing job because of a failure processing one or more risk vectors.
As a workaround, navigate in the ICA console to Admin > Settings > General > Risk Scoring - Overall and set the Risk Scoring Watermark value to today's date, in the following format:
yyyy-mm-ddE.g., 2022-12-31
To identify the risk vector(s) that are causing the risk score calculation error(s), follow this procedure:
USE RiskFabric;
GO
DECLARE @LogGroupName nvarchar(50),
@LogGroupDate datetime
;
SET @LogGroupName = 'Calculate Risk Scores in Parallel'
SET @LogGroupDate =
(
SELECT MAX(CAST(StartDate AS date)) AS StartDate
FROM Log_DataTransformationGroup WITH (NOLOCK)
WHERE LogGroupName = @LogGroupName
)
;
WITH cte AS
(
SELECT LogGroupID
FROM Log_DataTransformationGroup WITH (NOLOCK)
WHERE LogGroupName = @LogGroupName
AND CAST(StartDate AS date) = @LogGroupDate
)
SELECT DISTINCT ldt.LogName, ldt.ErrorDesc
FROM Log_DataTransformation AS ldt WITH (NOLOCK)
INNER JOIN cte
ON ldt.LogGroupID = cte.LogGroupID
WHERE LogName LIKE 'Processing risk vector%' AND
ldt.StatusFlag = 'F'
ORDER BY 1;