Understanding incident timestamps in ICA

Products

• Information Centric Analytics

Issue/Introduction

You want to understand the distinction between the columns RFCreatedDate, IncidentDate, IncidentTime, OccurredDate, and OccurredTime in the RiskFabric relational database table dbo.LDW_DIMIncidents.

Environment

Release : 6.x

Component : Symantec Data Loss Prevention Integration Pack

Resolution

RFCreatedDate is the date on which a Data In Motion (DIM) incident's metadata were imported into Information Centric Analytics (ICA) and a record created in the RiskFabric relational database table dbo.LDW_DIMIncidents.

IncidentDate is an alias for the date segment of the timestamp value recorded in the DetectionDate field in the Symantec Data Loss Prevention (DLP) database's Incident table, which represents the date on which a DLP agent sent an incident to the aggregator service on an Endpoint Detection server. IncidentTime is an alias for the time segment of the timestamp value recorded in the DetectionDate field.

OccurredDate is the date segment stored in an e-mail header for Network Prevent incidents, or the date when a violation was detected within a message that generated an incident. OccurredTime is the time segment of these timestamps. These timestamps are stored in the DLP database in the columns Incident.MessageDate and Incident.MessageTime, respectively.

Additional Information

Understanding incident dates in Data Loss Prevention