Hi Folks,
We have a discover scan running atm that uses a policy that looks for SSNs and DOBs. The scan appears to be creating incidents when expected, but a warning message was received about 4 hours into the scanning regarding the policy, stating:
"Policy (name) has one or more rules with unsatisfactory detection accuracy against exact data profile (edm name) version 344. Rule (rule name) will have false positive rate of 1.63E-07 per message."
The rule is basically: if the same component contains an SSN from the EDM and a value matching the DOB regex, create an incident. The policy has several rules, separated by OR logic with the only difference being different EDMs are used.
Any ideas on why we would be getting this message? We are not receiving the message for the other rules. The scan has been running for a day now and the error message has only be sent out once.