It is noticed that there is a user in the reports with "NONE" accross all fields. This appears to be skewing the chart and data.
When looking into the user in Top Risky Users it may also see something similiar to the following:
It is noticed that no more information can be given about the user:
This often a DLP issue where DLP has incidents marked as "UNKNOWN". ICA then pulls this data as is and it will need to be resolved on DLP.
Pull incident reports on Symantec DLP that correspond with the ICA report and find that the there are users "UNKOWN" in DLP. Then resolve that issue. ICA will sort itself out on next pull of good data.
Subscribing will provide email updates when this Article is updated. Login is required.