I am working with a DLP tool (McAfee ePO DLP 9.4). I'm configuring the Dashboard, but it keeps giving me the wrong data. It should be giving me a daily update of the incidents that have been generated for that day, but it seems to be pulling all the incidents that were generated throughout history.
Example: It should show incidents created on Monday 08/28/2017. Instead, I thinks it's giving me every incident that happened on a Monday.
Here's the XML:
<name>DLP: Number of Incidents per day (data in-use/in-motion)</name>
<description>This report summarizes number of incidents (data in-use/in-motion) per day</description>
%3AUDLP_Incidents.ActualAction&orion.table.order=az&orion.table.order.by=UDLP_In cidents.IncidentId%3AUDLP_Incidents.IncidentType%3AUDLP_Incidents.ViolationLocal Time
orion.sum.query=true&orion.query.type=line.line&orion.sum.group.by=UDLP_Incident s.LastUpdateTimestamp&orion.sum.time.cols=true&orion.sum.time.unit=day&orion.sum .order=oldest&orion.sum.aggregation=count&orion.sum.aggregation.showTotal=false< /summary-
I'm hoping someone can look at the XML and give me some insight as to what is going on?