User risk score records imported from ICA are incomplete
search cancel

User risk score records imported from ICA are incomplete

book

Article ID: 272964

calendar_today

Updated On:

Products

Data Loss Prevention Information Centric Analytics

Issue/Introduction

After integrating Information Centric Analytics (ICA) as a data source in DLP and importing user records, all records are displayed as expected in the Enforce console under Incidents > Users > User List; however, not all user risk scores appears under Incidents > Users > User Risk Summary (with all filters disabled) despite users having generated incidents.

Environment

Release : 16.0

Cause

Unknown at this time.

Resolution

If you encounter this issue, please contact Broadcom Support for assistance.

Additional Information

When DLP makes a call to ICA's API for user records, ICA executes the stored procedure dbo.spApiUserEntitySearch, which returns a list of users and their attributes. These attributes include Email, NetBIOSDomain, and AccountName, and RiskScore. During import, DLP matches these user records against either of account name and e-mail address.