Risk Model instances do not include all incidents as expected

Products

• Information Centric Analytics

Issue/Introduction

The nightly RiskFabric Processing job is not generating risk model instances for events that match the criteria of one or more of the risk model's underlying event scenario sets. Events that match the criteria of other event scenarios do generate risk model instances, however. The event scenario in question is enabled and its data set is returning recent results in the Analyzer but no instances have been generated recently and there haven't been any processing failures during that time.

Environment

Release : 6.x

Cause

The analyzer view for the event scenario is configured to use the DIM Incident Date Range dimension. This causes the saved search to only look at incident dates between fixed dates. Once those dates pass, new instances will not be generated.

Resolution

To correct the event scenario's configuration, update the analyzer view to use the DIM Incident Relative Date Range instead of the DIM Incident Date Range dimension.