Risk scores aren't set or updated on entity detail pages

Products

• Information Centric Analytics

Issue/Introduction

When viewing the Risk Rating section of the Details page for any entity type (Applications, Computer Endpoints, IP Addresses, Users, or Persons) in Information Centric Analytics (ICA), the entity's aggregate risk score is displayed above the list of Risk Vectors, but scores for individual risk vectors are 0.00, with the Change Since Yesterday value set to 0.

Environment

Release : 6.5.4

Cause

The general portal setting Risk Scoring Watermark was not updated at the end of the Calculate Risk Scores step (19) of ICA's nightly RiskFabric Processing job because of a failure processing one or more risk vectors.

Resolution

As a workaround, navigate in the ICA console to Admin > Settings > General > Risk Scoring - Overall and set the Risk Scoring Watermark value to today's date, in the following format:

yyyy-mm-dd

E.g., 2022-12-31

To identify the risk vector(s) that are causing the risk score calculation error(s), follow this procedure:

1. Open SQL Server Management Studio (SSMS)
2. Connect to the Database Engine hosting the RiskFabric database
3. From the File menu, select New > Query with Current Connection
4. Copy the following query and paste it into the new query editor window:
   

   USE RiskFabric;
   GO
   
   DECLARE @LogGroupName nvarchar(50),
           @LogGroupDate datetime
   ;
   
   SET     @LogGroupName = 'Calculate Risk Scores in Parallel'
   SET     @LogGroupDate =
           (
               SELECT  MAX(CAST(StartDate AS date)) AS StartDate
               FROM    Log_DataTransformationGroup WITH (NOLOCK)
               WHERE   LogGroupName = @LogGroupName
           )
   ;
   
   WITH    cte AS
           (
               SELECT  LogGroupID
               FROM    Log_DataTransformationGroup WITH (NOLOCK)
               WHERE   LogGroupName = @LogGroupName
               AND     CAST(StartDate AS date) = @LogGroupDate
           )
   
   SELECT  DISTINCT ldt.LogName, ldt.ErrorDesc
   FROM    Log_DataTransformation AS ldt WITH (NOLOCK)
   INNER JOIN cte
   ON      ldt.LogGroupID = cte.LogGroupID
   WHERE   LogName LIKE 'Processing risk vector%' AND
           ldt.StatusFlag = 'F'
   ORDER BY 1;

5. Execute the query by pressing the F5 key, clicking the Execute button in the SQL Editor toolbar, or selecting Execute from the Query menu
6. Save the query output to a CSV or XLSX file, open a support case at support.broadcom.com, and upload the file to the case