Retention setting for Symantec DLP incidents in ICA

Products

• Information Centric Analytics

Issue/Introduction

Is there a retention setting in Information Centric Analytics (ICA) for Data In Motion (DIM) incidents imported from Symantec Data Loss Prevention (DLP)? Does the portal setting 'Number of days of data in LDW_EventDetail' apply to DIM events?

Environment

Release : 6.x

Component : Symantec Data Loss Prevention Integration Pack

Resolution

The portal settings 'Number of days of data in LDW_EventDetail' and 'Number of days of data in LDW_EventDetailArchive' only apply to Unified Event (UE) types:

• Authentication (AE)
• Endpoint (EP)
• Web Activity (WA)

By design, DIM incidents imported from DLP are archived in ICA once they are deleted in the source system. When an incident is deleted in DLP, it is marked as archived in the RiskFabric relational database and is no longer included in the following:

• DIM incident measures in the cube
• Normality scoring
• Risk scoring
• Event scenario instances
• Risk model instances

Archived incidents are also no longer visible in the Risk Fabric console.

If DIM incidents and their related information need to be purged from ICA, manual purging is available via the Risk Fabric console. Navigate to Admin > Settings > Data In Motion and locate the Policies heading. To the right of each policy is a sprocket wheel icon. Click on this icon to purge or reingest incidents by policy. You will then be presented with the option to specify a Purge Before Date.

Alternatively, you can purge incidents by data source by navigating in the console to Admin > Integration > Data Sources > Choose Data Source | Symantec Data Loss Prevention. Once there, click on the sprocket wheel icon to the right of the data source for which you wish to purge incidents. You will then be presented with the option to specify a Purge Before Date.