User risk score records imported from ICA are incomplete
Article ID: 272964
Updated On:
Products
Issue/Introduction
After integrating Information Centric Analytics (ICA) as a data source in DLP and importing user records, all records are displayed as expected in the Enforce console under Incidents > Users > User List; however, not all user risk scores appears under Incidents > Users > User Risk Summary (with all filters disabled) despite users having generated incidents.
Environment
Release : 16.0
Cause
Unknown at this time.
Resolution
If you encounter this issue, please contact Broadcom Support for assistance.
Additional Information
When DLP makes a call to ICA's API for user records, ICA executes the stored procedure dbo.spApiUserEntitySearch, which returns a list of users and their attributes. These attributes include Email, NetBIOSDomain, and AccountName, and RiskScore. During import, DLP matches these user records against either of account name and e-mail address.
Feedback
