One-Click Buttons Bulk Auditing Fails

Products

• CA Security Command Center
• CA Data Protection (DataMinder)
• CA User Activity Reporting

Issue/Introduction

One-Click Buttons Bulk Auditing Fails.  When clicking on the one-click button at the 'Search-Result' level, the audit fails with a message that says that one or more matching issues already exist on the event.  When clicking on the same one-click button on the 'Event-Level' the reviewer is prompted to select from a list of existing issues.  The expectation is that while bulk auditing, the buttons should behave the same way and fully close out the event/s. We believe this should be accomplished via a NEW issue if required, regardless of whether and issue already exists on the event or whether the issue names match.  Furthermore, when bulk auditing, the audit operation fails and "skips" the message (doesn't audit it)... but then still removes the event from the search result set. This is not intuitive to the unsuspecting reviewer who might think that the event was successfully audited, but finds it again in his/her review queue the next time they re-run the search

Environment

Release:
Component: DLPSRV

Resolution

The product is working as designed. The bulk review feature was added at the time of 14.5, to address the problems of reviewing each event even in the case of false positives. The solution provided was for fully unreviewed events and not for partially reviewed events. If bulk audit is required for partially reviewed events, it is an entire new enhancement, Product Management has advised "With the product in stabilized state, no major changes/enhancement is possible to incorporate in the product at this stage."