Custom Tabs in Risk Analysis and Remediation

In the configuration Tab of the RAR, one has the ability to add 3 custom tabs. These custom tabs appear to the right of the Configuration Tab. The name which brings up the tab is appended at the end of the url as mentioned in the configuration guide. For example if you append "CCdebugger" the Debugger tab is appended.
Does anyone know what other tabs can be added and how does go about finding the names of the tabs that can be appended like the one example shown above? The configuration guide does not provide any list of tabs that can be attached in this way. (Granted the maximum at a time is 3).
Would appreciate your help and input on this.
Thanks

Hello Arun,
You can add in custom tabs any webservice (webservices urls can be found in UME Web Services Navigator) or any other link even external (as a webmail or a google search bar!).
You are free to configure your custom tabs according to your needs, but do keep in mind that custom tabs are common to all users!
For information here are 3 tabs we have chosen to configure:
debug mode : .../webdynpro/dispatcher/sap.com/grc~ccappcomp/BgJobStart?debug=1
CC Background deamon : .../sap/CCBgStatus.jsp
Thread follow up : .../sap/CCADStatus.jsp
Hope this helps,
Kind regards,
Sophie Planchais
Edited by: Sophie Planchais on Sep 3, 2008 1:52 PM

Similar Messages

  • Convert from Compliance Calibrator 4.0 to Risk Analysis and Remediation 5.2

    Hello Forum,
    I'm looking for other opinions on converting Compliance Calibrator (CC) 4.0 to Risk Analysis and Remediation (RAR) 5.2 (formerly CC)
    I have inherited responsibility for RAR and need to upgrade it to the 5.2 level; our current ECC level prevents us from going to 5.3
    I found a process that will unload the data from CC 4.0 and be imported into RAR 5.2
    I want to understand the definitions that comprise the RAR and was thinking about recreating the definitions in 5.2 based on what is already defined in the CC 4.0 system; I have time to do this since there is no definitive deadline that would make it impossible to meet
    Currently, I have the following definitions:
    Business Process 6 entries
    Functions 47 entries
    Risks 147 entries
    Mitigating Controls 40 entries
    Would others find this approach acceptable and reasonable even though I would be entering all the information? Basically, it would be like defining the data for the very first time if this was NEW software
    I would expect to come away with a good understanding of how everything ties together; at this point, I am only looking to create the necessary data that would allow for producing SOD reports that show all users with "risks" have been mitigated with acceptable controls
    Thanks for your responses in advance
    Jerry
    Ryerson, Inc
    630-758-2021

    Thanks for the reply
    I have the migration guide and have reviewed it; I have actually played around a bit with obtaining the file from CC 4.0; I found that the data records may need some adjustments to be compatible with RAR 5.2; one of the reasons that may be leading me to do everything from scratch
    The definitions currently defined were completed by an outside source and the mitigated controls were defined by the Internal Audit area
    I'm not sure if they were mixed with the defaults
    I'm not sure at this point what impact or changes I would experience if I use the "default" supplied rules set but I expect to find out
    Thanks again for your reply
    Jerry

  • Need to exclude certain risks in Risk Analysis and Remediation (5.2)

    Hello Experts,
    My requirement is I need to exclude certain unwanted risks whenever I execute the simulation for a user or an SAP role. We had this provision in the ABAP version of compliance calibrator 4.0. But we are not able to do the same in the upgraded 5.2 risk analysis and remediation.
    Can anyone please provide a solution to this problem or some workaround. Thanks in advance.
    Best Regds,
    Suyog Chakot...

    Hi,
    there are several options:
    - you can disable single risks in rule architect.
    - you can create a seond rule set that only checks the roles you want to check on
    - you can mitigate certain roles or users to exclude them from analysis
    The options are all there - depends on what exactly you want to do.
    Frank.

  • Cannot find CCRTAWS at Access Control Risk Analysis and Remediation?

    I am looking for the Web service CCRTAWS  in Access Control Risk Analysis and Remediation.
    But I cannot find it.
    Could you help? Thanks a lot!

    Ashley,
       Go to main page of WAS (Web application server) where AC 5.3 is installed. It would be
    http://(servername):(port)/index.html [Replace servername and port with the actual servername and port number]
    Click on Web service navigator (First link on right side). This link will show you all the web services installed. Search for CCRTAWS. I can see it in my AC installation.
    Regards,
    Alpesh

  • Stopping Background job in Risk Analysis and Remediation

    Hi,
    We have scheduled background job for Batch Risk Analysis in CC 5.3. Later we have terminated that job for some reasons. But that terminated job status is showing as Stopping from past 3 days. How we can cancel that job?
    We have restated the J2E server but the job is still running. Please suggest me how we can stop that job immediately.
    Regards,
    KKRao.
    Edited by: KKRao_2020 on May 12, 2009 9:14 AM

    Hi,
    If you have access to oracle backend then I can tell an work arround for this issue,
    when the job is in stoping status then you can delete an entry from VIRSA_CC_JOBHST table.
    The command is
    SQL> delete from  VIRSA_CC_JOBHST where jobid=your jobid and status=3;
    After running this command the job in the RAR will show aborted status then the delete button will be enabled and if you want then you can delete that job from RAR screen.
    Regards,
    Sudip.

  • Risk Analysis and Remediation Mitigating Control Monitoring Alerts

    Hello,
    We have configured an alert for a Mitigating Control.  The Monitor must execute the report every day (report frequency = 1) or an alert email is sent to the Risk Owner.
    The Risk Owner recieves the Alert email and the Alert is logged on the Alerts tab only for the first two days after the report is not executed by the Monitor.  Is there a setting somewhere that controls why the alert is not generated after two days?
    thanks
    Tammi

    Correction.
    The email is only sent for 2 days.  The alert is logged on the Alert Monitor tab every day.

  • SAP GRC AC: Organizational rules at Batch risks analysis and Dashboards

    Dear All.
    I would like to know GRC AC is able to consider the organizational rules defined (for example: risk only affected to Company, BUKRS 0001) at the Batch risks analysis and at the Dashboard. I already know that for the ad-hoc reporting you can filter by the Org.rules created but i would like to know if this filter is also able for the Batch risks analysis.
    Thanks and regards.

    Dear all.
    As per my knowledge this parameter only sets the flag of Consider Org.Rules at the filters. This is what the guide indicates:
    "Setting the value to YES automatically selects the Consider Org Rule checkbox on the Risk Violations tab of the Access Request and
    Role Maintenance screens."
    So how are you so sure about that indicating this flag to YES will take into consideration the org rules at the Dashboards?
    Regards

  • AC10 - Auto risk analysis and auto mitigation

    Hi,
    I was wondering if it is possible to
    - run an automatic risk analysis at the end of an approval stage of the workflow, the same way it is possible to configure at the time of request sending?
    - automatically put a mitigating control in the request for the risks found?
      In our case, there is only one mitigating control for each risk and the assignment of the control is an unnecessary manual task to perform. The mitigation assignment will be approved in a seperate WF by the mitigation owner.
    It seems there is no out of the box solution to this, so any alternative suggestions are welcome.
    Thanks,
    Daniela

    Hi Daniela,
    If I may give my opinion, I would probably break your question down into 2 parts.
    1) Auto Risk analysis at the end of a stage - Making "Risk Analysis Mandatory" at that stage is probably the method. Unfortunately this does mean clicking one or two buttons (so not fully automated). Think AC uses this method to ensure the reviewer is aware of the conflicts caused etc.
    2) Auto Mitigation - For a business access workflow in a 'Live' situation, this is probably not a good idea,  as analysing and making the decision on whether to proceed with the request should really be performed by an actual person responsible for that stage in the work flow e.g. Role Owner or Security Lead etc. You would not want to mitigate all risks automatically (if I have understood correctly that you have a mitigation per risk ID). In theory, an automated mitigation process would mitigate all risks without discrimination.
    On a side note, there is a configuration setting under SPRO for Access controls as follows
    "Risk Analysis- Access Request : Param ID 1072 - Mitigation of critical risk required before approving the request". By enabling this configuration, you could force a mitigating control to be applied to any user requesting Critical Access.
    Hope this helps.

  • CUP-RAR Risk Analysis error

    Hello experts,
    When an approver does risk analysis for adding a role to a user in CUP before approval, the system shows 0 risk(0 risks found), However when the role is added to the user in RAR simulation, there are Risks.
    Similarly,
    When an approver does risk analysis for a role in CUP before approval, the system shows 0 risk(0 risks found), However when the role is analysed in RAR, there are Risks.
    I have checked the Org Rules parameter in RAR (It was set to No as we are not using Org Rules).
    When I set the org rule parameter to Yes, I got exception " Risk analysis failed: EXCEPTION_FROM_THE_SERVICEInconsistency Org Rule Analysis Flag Parameter". I reset the parameter to NO.
    Many thanks,

    Hello Raghu
    Here is the note number: Note 1168120 - Risk Analysis and Remediation 5.3 Support Package (VIRCC).
    Also I would suggest going to:
    1. CUP - configuration -Risk analysis - And see if the web service link for Risk analysis is correct.
    Better would be to go to Netweaver Administration -Webdynpro console -and get the correct link.
    2. CUP -configuration - Mitigation and here also put the correct link for all four options there i.e. (Risk analysis, Mitigation etc),
    Hopefully this should solve the problem .I donu2019t think it is related to org level.
    If problem still persist, kindly paste the log.
    Best Regards
    Asheesh

  • Error Creating Request - Risk Analysis in CUP

    Initially, we had the issue of not being able to create requests in CUP. I read around and found out that I needed to go to Configuration > Risk analysis and change the "Perform Risk Analysis on Request" to No. I tested and I was able to create a request. This tells me that SOMETHING is wrong with the Risk Analysis in CUP. So since its a Risk Analysis error, I when into a requested and selected Run Risk Analysis and go the following error.
    "Risk analysis failed: Exception in getting the results from the web service : Service call exception; nested exception is: java.lang.Exception: Incorrect content-type found 'text/html' "
    But before anything. I just want to verify if its an authorization error with our webserivces id. Any input?
    Thank you,

    1. In the CUP Configuration-> Risk Analysis.
    Under the section "Select Risk Analysis and Remediation Version"( or "Select Compliance Calibrator Version" for version below CUP 5.3) make sure that the following web service is given in the URI, if the "Version" selected is above 4.0.
    "http://<servername>:<portnumber>/VirsaCCRiskAnalysisService/Config1?wsdl&style=document"
                                                                In the server name and port number, enter the corresponding entries of the Compliance Calibrator (CC) or (Risk Analysis and Remediation (RAR)) server entries on which it is installed.
    The User given under this section should have the administrator access for the CUP and RAR.
    CUP is 5.3 and we have the correct URL. The user is given the following roles:
    AEADMIN
    CC_Administrator
    VIRSA_CC_ADMINISTRATOR
    Please review the attachment for the list of actions in these roles. Please let me know if there is an action that the webservice id should have. In the link below, be careful of all the download buttons. Choose the "Save file to your PC: click here" link and open the file. (not save)
    http://www.2shared.com/document/8dOC7v6E/actions.html
    2. Make sure that the user provided in the CUP connector has the access for connecting to RAR and it should also have the administrator rights of the RAR.
    Should the access be provided from the roles/actions from above?
    3. Make sure that the password of both the users given in the above points is not expired i.e. they have been reset in UME.
    You can check the same by once logging into the UME through that users. In case it asks for the password change, then the password is expired and you need to change the password and give the new password in the CUP.
    Should the password ever expire for this ID? I will double check on the password.
    4. The logon language of both the above users should be maintained in UME.
    I am not sure how to check this, please advise.
    5. Also check that the connector in the RAR is working and is able to connect to the backend SAP system.
    I tested the connection in CUP and connection was successful. How can I test the connection for RAR?
    Thank you in advance,
    Edited by: Eric Lau on May 17, 2010 6:41 PM

  • No result /report when weu00B4re running a risk analysis in background

    Dear forum,
    We are running several risk analysis in background (from configuration tab) and we cannot see any result
    in the column called "result". However, when we run a offline analysis (from informer tab) we can see that the column "result" is containing a file.
    Hope you can help us.
    Thanks in advance.

    Running risk analysis in background from the configuration tab does not produce a report by design.  This background job is really just performing a system maintenence activity and is not intended for report generation.  This background job preps data for performing offline analysis as well as the underlying data that supports the management reports in the informer tab (among other things).  Generally, anything in the configuration tab is system maintenance related.
    It sounds like you're attempting to perform typical analysis of end user access, not system maintenance activities.  The informer tab is what you need to be using to perform the analysis.
    Within the informer tab, whether you choose to perform online analysis or offline analysis, a report result is always generated.  In my experience, there has not been a compelling reason to use offline analysis capabilities within the informer tab.  Online analysis (real-time analysis of the SAP system rather than the offline data from the last configuration tab background risk analysis) is naturally always current, which is a plus.

  • GRC 5.3: CUP risk analysis VS. RAR risk analysis

    I've installed and configured RAR and CUP.  When I do a risk analysis simulation in RAR on a user for adding a role, it comes back with no conflicts.  When I go into CUP and make a new request for adding the same role to the same user, it comes back with risk violations, but it looks like they are critical actions that are being flagged.  Why is there a discrepancy, and how do I go about getting the same risks in CUP as I do in RAR?

    >
    Frank Koehntopp wrote:
    > I guess the behaviour is on purpose.
    >
    > In RAR, you can do a selective analysis on only one kind of risk. You usually only need to do that in the remediation process, where this kind of selection is helpful to track down the root cause (although I'd like to have an ALL option in RAR as well...)
    >
    > In CUP, you do want to see any kind of risk that might arise from a role assignement to a user.
    >
    > I have to say, I can not really understand why you'd want to switch off critical action or permission risks here. The user analysis in RAR and CUP serve two different purposes, hence I cannot see a bug here. If you have defined critical risks, why would you not want to see them???
    Hi Frank,
    I understand your point, but we are in the same situation as the others. We do not want to see Critical Action Risks in CUP because this is a separate process (for us) than Permission Level Risks Analysis piece. With our current structure, our Security Admins use RAR to run Permission Level Risk Analysis and mitigates appropriately. A separate compliance group uses the Critical Action reports to see who has what Critical tcodes, etc. We do not mitigate these "risks," we more or less use it as a report.
    I do not understand what you mean when you say "The user analysis in RAR and CUP serve two different purposes" - I feel it should be the same purpose, to ultimatley simulate if adding security to a user will cause SOD violations. If I have CUP configured to do Permission Level Analysis, that's all I want to be seeing in CUP.
    Let me know if I need to clarify further.

  • Did CUP risk analysis change with SP7?

    Dear GRC experts,
    I am pretty sure when we tested CUP 5.3 SP4 when doing risk analysis it would only show new risks caused by new roles selected in request (like Risks from Simulation Only YES in RAR). Exisitng risks for that user would not be shown.
    Now with CUP 5.3 SP7 fix1 we get the existing risks shown as well not in any way related to the role(s) selected, which will be confusing to the role approvers. E.g. role request is display role, approver needs to run risk analysis and gets existing risks shown. He/she can not deselect roles to remove risks as only display role is in request. There might be no mitigating controls for those risks (creation of new mitigating controls is blocked). This would end up in requests with risks even though the requested role is not risk relevant, or even request gets stuck because no mitigatign control exists and config is set to do not allow approval of requests with risks.
    Please confirm if indeed only new risks where shown in CUP risk analysis in previous support pack levels or rel. 5.2, or that I am mistaken and all risks where always shown at risk analysis in CUP.
    Principally I think existing risks should be focus of GET CLEAN effort. Risk analysis in CUP should focus on preventing new risks at part of STAY CLEAN phase.

    Hi,
    When we run Risk Analysis for the user, it will show the existing violations as well as the violation which are there with new roles also.
    When we click on Risk Analysis under Simulation tab we can find Risk Violation details.
    Here I have a doubt, how to deselect violation role while approving request. I m unable to find that option. Please advice.
    Thanks & regards,
    KKRao.
    Edited by: KKRao_2020 on Oct 9, 2009 9:22 AM
    Edited by: KKRao_2020 on Oct 9, 2009 9:27 AM

  • Error during Full Synch Batch Risk Analysis - RAR

    Hi All,
    We are implementation SAP GRC AC 5.3 - SP 9 - RAR
    Currently we have uploaded the text objects and permission objects and performed full sych for User, Roles & Profile with the backend system and it was successful
    Then we have uploaded all the RAR Standard text files for SoD Rules and scheduled a Full Sych for Batch Risk Analysis as a post installation activity. But we got an error as below after 85% of completion and the background job failed.
    WARNING: Error: while executing BatchRiskAnalysis for JobId=12 and object(s):T-RD470878: Skipping error to continue with next object: Batch rolled back. Caused by java.sql.BatchUpdateException: ORA-01653: unable to extend table SAPSR3DB.VIRSA_CC_PRMVL by 8192 in tablespace PSAPSR3DB
    Can somebody please help us in resolving the above error message. Is it something to do with the table space availablity ?
    What are the consequences if we have not scheduled the Full Synch Batch Risk Analysis and start using the tool.We have to add some custom t-codes to the Standard rule set thereby tailoring it to the business requirement.
    Thanks and Best Regards,
    Srihari.K

    Sri,
       As Gangadhar mentioned this is a tablespace issue. You need to make sure to have enough space while running full sync risk analysis job. Please extend your database space and run the risk analysis job again.
    Regards,
    Alpesh

  • Mitigation not showing in Risk Analysis

    I have migitated a role and can see the mitigation on the Mitigation tab under Mitigated Roles. I wanted to run a Risk Analysis on the role to make sure the mitigation is in my reports and they not showing.
    I have checked my settings on the configuration tab under "Risk Analysis" on "Exclued Mitigated Risk" and it's set to "No". I run my reports in the Infomer Tab > Risk Analysis > Role Analysis and the Report Type is at the permission level and under "More Options" the "Ignore Migitation" is set to "No".
    I have reran my "sync" jobs and management reports in the order they should be ran and they are still not showing up. The migitation is not showing up in my management reports either. I am on SP9.
    Is there anything else I'm missing?

    I answered my own question on this.

Maybe you are looking for