User risk score records imported from ICA are incomplete
search cancel

User risk score records imported from ICA are incomplete


Article ID: 272964


Updated On:


Data Loss Prevention Information Centric Analytics


After integrating Information Centric Analytics (ICA) as a data source in DLP and importing user records, all records are displayed as expected in the Enforce console under Incidents > Users > User List; however, not all user risk scores appears under Incidents > Users > User Risk Summary (with all filters disabled) despite users having generated incidents.


Release : 16.0


Unknown at this time.


If you encounter this issue, please contact Broadcom Support for assistance.

Additional Information

When DLP makes a call to ICA's API for user records, ICA executes the stored procedure dbo.spApiUserEntitySearch, which returns a list of users and their attributes. These attributes include Email, NetBIOSDomain, and AccountName, and RiskScore. During import, DLP matches these user records against either of account name and e-mail address.