Risk Analysis and Remediation Mitigating Control Monitoring Alerts

Hello,
We have configured an alert for a Mitigating Control. The Monitor must execute the report every day (report frequency = 1) or an alert email is sent to the Risk Owner.
The Risk Owner recieves the Alert email and the Alert is logged on the Alerts tab only for the first two days after the report is not executed by the Monitor. Is there a setting somewhere that controls why the alert is not generated after two days?
thanks
Tammi

Correction.
The email is only sent for 2 days. The alert is logged on the Alert Monitor tab every day.

Similar Messages

Cannot find CCRTAWS at Access Control Risk Analysis and Remediation?

I am looking for the Web service CCRTAWS in Access Control Risk Analysis and Remediation.
But I cannot find it.
Could you help? Thanks a lot!

Ashley,
Go to main page of WAS (Web application server) where AC 5.3 is installed. It would be
http://(servername):(port)/index.html [Replace servername and port with the actual servername and port number]
Click on Web service navigator (First link on right side). This link will show you all the web services installed. Search for CCRTAWS. I can see it in my AC installation.
Regards,
Alpesh

Convert from Compliance Calibrator 4.0 to Risk Analysis and Remediation 5.2

Hello Forum,
I'm looking for other opinions on converting Compliance Calibrator (CC) 4.0 to Risk Analysis and Remediation (RAR) 5.2 (formerly CC)
I have inherited responsibility for RAR and need to upgrade it to the 5.2 level; our current ECC level prevents us from going to 5.3
I found a process that will unload the data from CC 4.0 and be imported into RAR 5.2
I want to understand the definitions that comprise the RAR and was thinking about recreating the definitions in 5.2 based on what is already defined in the CC 4.0 system; I have time to do this since there is no definitive deadline that would make it impossible to meet
Currently, I have the following definitions:
Business Process 6 entries
Functions 47 entries
Risks 147 entries
Mitigating Controls 40 entries
Would others find this approach acceptable and reasonable even though I would be entering all the information? Basically, it would be like defining the data for the very first time if this was NEW software
I would expect to come away with a good understanding of how everything ties together; at this point, I am only looking to create the necessary data that would allow for producing SOD reports that show all users with "risks" have been mitigated with acceptable controls
Thanks for your responses in advance
Jerry
Ryerson, Inc
630-758-2021

Thanks for the reply
I have the migration guide and have reviewed it; I have actually played around a bit with obtaining the file from CC 4.0; I found that the data records may need some adjustments to be compatible with RAR 5.2; one of the reasons that may be leading me to do everything from scratch
The definitions currently defined were completed by an outside source and the mitigated controls were defined by the Internal Audit area
I'm not sure if they were mixed with the defaults
I'm not sure at this point what impact or changes I would experience if I use the "default" supplied rules set but I expect to find out
Thanks again for your reply
Jerry

Need to exclude certain risks in Risk Analysis and Remediation (5.2)

Hello Experts,
My requirement is I need to exclude certain unwanted risks whenever I execute the simulation for a user or an SAP role. We had this provision in the ABAP version of compliance calibrator 4.0. But we are not able to do the same in the upgraded 5.2 risk analysis and remediation.
Can anyone please provide a solution to this problem or some workaround. Thanks in advance.
Best Regds,
Suyog Chakot...

Hi,
there are several options:
- you can disable single risks in rule architect.
- you can create a seond rule set that only checks the roles you want to check on
- you can mitigate certain roles or users to exclude them from analysis
The options are all there - depends on what exactly you want to do.
Frank.

AC10 - Auto risk analysis and auto mitigation

Hi,
I was wondering if it is possible to
- run an automatic risk analysis at the end of an approval stage of the workflow, the same way it is possible to configure at the time of request sending?
- automatically put a mitigating control in the request for the risks found?
In our case, there is only one mitigating control for each risk and the assignment of the control is an unnecessary manual task to perform. The mitigation assignment will be approved in a seperate WF by the mitigation owner.
It seems there is no out of the box solution to this, so any alternative suggestions are welcome.
Thanks,
Daniela

Hi Daniela,
If I may give my opinion, I would probably break your question down into 2 parts.
1) Auto Risk analysis at the end of a stage - Making "Risk Analysis Mandatory" at that stage is probably the method. Unfortunately this does mean clicking one or two buttons (so not fully automated). Think AC uses this method to ensure the reviewer is aware of the conflicts caused etc.
2) Auto Mitigation - For a business access workflow in a 'Live' situation, this is probably not a good idea, as analysing and making the decision on whether to proceed with the request should really be performed by an actual person responsible for that stage in the work flow e.g. Role Owner or Security Lead etc. You would not want to mitigate all risks automatically (if I have understood correctly that you have a mitigation per risk ID). In theory, an automated mitigation process would mitigate all risks without discrimination.
On a side note, there is a configuration setting under SPRO for Access controls as follows
"Risk Analysis- Access Request : Param ID 1072 - Mitigation of critical risk required before approving the request". By enabling this configuration, you could force a mitigating control to be applied to any user requesting Critical Access.
Hope this helps.

Stopping Background job in Risk Analysis and Remediation

Hi,
We have scheduled background job for Batch Risk Analysis in CC 5.3. Later we have terminated that job for some reasons. But that terminated job status is showing as Stopping from past 3 days. How we can cancel that job?
We have restated the J2E server but the job is still running. Please suggest me how we can stop that job immediately.
Regards,
KKRao.
Edited by: KKRao_2020 on May 12, 2009 9:14 AM

Hi,
If you have access to oracle backend then I can tell an work arround for this issue,
when the job is in stoping status then you can delete an entry from VIRSA_CC_JOBHST table.
The command is
SQL> delete from VIRSA_CC_JOBHST where jobid=your jobid and status=3;
After running this command the job in the RAR will show aborted status then the delete button will be enabled and if you want then you can delete that job from RAR screen.
Regards,
Sudip.

Custom Tabs in Risk Analysis and Remediation

In the configuration Tab of the RAR, one has the ability to add 3 custom tabs. These custom tabs appear to the right of the Configuration Tab. The name which brings up the tab is appended at the end of the url as mentioned in the configuration guide. For example if you append "CCdebugger" the Debugger tab is appended.
Does anyone know what other tabs can be added and how does go about finding the names of the tabs that can be appended like the one example shown above? The configuration guide does not provide any list of tabs that can be attached in this way. (Granted the maximum at a time is 3).
Would appreciate your help and input on this.
Thanks

Hello Arun,
You can add in custom tabs any webservice (webservices urls can be found in UME Web Services Navigator) or any other link even external (as a webmail or a google search bar!).
You are free to configure your custom tabs according to your needs, but do keep in mind that custom tabs are common to all users!
For information here are 3 tabs we have chosen to configure:
debug mode : .../webdynpro/dispatcher/sap.com/grc~ccappcomp/BgJobStart?debug=1
CC Background deamon : .../sap/CCBgStatus.jsp
Thread follow up : .../sap/CCADStatus.jsp
Hope this helps,
Kind regards,
Sophie Planchais
Edited by: Sophie Planchais on Sep 3, 2008 1:52 PM

Control monitoring alerts- RAR 5.3

I've few mitigating controls in palce with frequency in reports tab as 1. I'm sure that the action given in the reports tab was not executed in the backend system by the monitor but still I do not get alterts for control monitoring in Alert monitor tab. Please advise

Plz. note the correction:
It is not 9 character or 5 character risk id that makes the difference. I was not getting control monitoring alert because the 9 character riskid I specified in the mitigating control was a permission level rule id and SAP says that from 5.3 onwards permission rules are not considered for any analysis. So we have to mention the riskid with * or we can specify the action level rule id to receive the control monitoring alerts.

RAR: Mitigation Control Monitoring

Hi,
I have configured and executed alert generation job but we are not able to obtain the alerts for mitigation control monitoring.
What we have done:
1) Define mitigation control including transaction XXXX to be executed daily
2) Monitor has executed thansaction XXXX on day 1
3) Alert generation job has been executed on day 1 (after step 2)
3) Monitor has not executed transaction XXXX on day 2
4) Alert generation job has been executed on day 2 BUT alert for control monitoring are not obtained.
Does anyone know why we are not getting the alerts for control monitoring?
Thanks in advance. Kind regards,
Imanol

What is value of number of days for this Monitoring in Mit Control?
Is email id of Monitor maintained in Alert tab?

SAP GRC AC: Organizational rules at Batch risks analysis and Dashboards

Dear All.
I would like to know GRC AC is able to consider the organizational rules defined (for example: risk only affected to Company, BUKRS 0001) at the Batch risks analysis and at the Dashboard. I already know that for the ad-hoc reporting you can filter by the Org.rules created but i would like to know if this filter is also able for the Batch risks analysis.
Thanks and regards.

Dear all.
As per my knowledge this parameter only sets the flag of Consider Org.Rules at the filters. This is what the guide indicates:
"Setting the value to YES automatically selects the Consider Org Rule checkbox on the Risk Violations tab of the Access Request and
Role Maintenance screens."
So how are you so sure about that indicating this flag to YES will take into consideration the org rules at the Dashboards?
Regards

Risk analysis after approval in CUP

Hi,
Can it be possible? CUP to do automatic risk analysis after the request is approved by the role approvers. If there are no risks, roles will get provisioned. If risks exist based on the risk ID to have the request forwarded to the risk owner where the mitigation control, monitor details are entered.
Please provide your inputs.
Thanks
R R

Not a good idea, generally.
What you can do is have the risk analysis performed automatically on request submission. The approvers would see the risks, but you can allow them to ignore them and have a detour on the last approval step.
This has a few quirks:
- if your last approval is a role approver, i.e. there may be a split approval to several people, the detour is tricky.
- if one of the approvers changes something in the request, the risk analysis is invalid.
I would also question the general idea - usually in case of risks, one of the approvers should also take action. If all they do is approve, get them out of the way.
Unfortunately there is no step that says "automatic risk analysis, no manual approval required". That's an enhancement I would also welcome.
Frank.

CUP-RAR Risk Analysis error

Hello experts,
When an approver does risk analysis for adding a role to a user in CUP before approval, the system shows 0 risk(0 risks found), However when the role is added to the user in RAR simulation, there are Risks.
Similarly,
When an approver does risk analysis for a role in CUP before approval, the system shows 0 risk(0 risks found), However when the role is analysed in RAR, there are Risks.
I have checked the Org Rules parameter in RAR (It was set to No as we are not using Org Rules).
When I set the org rule parameter to Yes, I got exception " Risk analysis failed: EXCEPTION_FROM_THE_SERVICEInconsistency Org Rule Analysis Flag Parameter". I reset the parameter to NO.
Many thanks,

Hello Raghu
Here is the note number: Note 1168120 - Risk Analysis and Remediation 5.3 Support Package (VIRCC).
Also I would suggest going to:
1. CUP - configuration -Risk analysis - And see if the web service link for Risk analysis is correct.
Better would be to go to Netweaver Administration -Webdynpro console -and get the correct link.
2. CUP -configuration - Mitigation and here also put the correct link for all four options there i.e. (Risk analysis, Mitigation etc),
Hopefully this should solve the problem .I donu2019t think it is related to org level.
If problem still persist, kindly paste the log.
Best Regards
Asheesh

Error Creating Request - Risk Analysis in CUP

Initially, we had the issue of not being able to create requests in CUP. I read around and found out that I needed to go to Configuration > Risk analysis and change the "Perform Risk Analysis on Request" to No. I tested and I was able to create a request. This tells me that SOMETHING is wrong with the Risk Analysis in CUP. So since its a Risk Analysis error, I when into a requested and selected Run Risk Analysis and go the following error.
"Risk analysis failed: Exception in getting the results from the web service : Service call exception; nested exception is: java.lang.Exception: Incorrect content-type found 'text/html' "
But before anything. I just want to verify if its an authorization error with our webserivces id. Any input?
Thank you,

1. In the CUP Configuration-> Risk Analysis.
Under the section "Select Risk Analysis and Remediation Version"( or "Select Compliance Calibrator Version" for version below CUP 5.3) make sure that the following web service is given in the URI, if the "Version" selected is above 4.0.
"http://<servername>:<portnumber>/VirsaCCRiskAnalysisService/Config1?wsdl&style=document"
In the server name and port number, enter the corresponding entries of the Compliance Calibrator (CC) or (Risk Analysis and Remediation (RAR)) server entries on which it is installed.
The User given under this section should have the administrator access for the CUP and RAR.
CUP is 5.3 and we have the correct URL. The user is given the following roles:
AEADMIN
CC_Administrator
VIRSA_CC_ADMINISTRATOR
Please review the attachment for the list of actions in these roles. Please let me know if there is an action that the webservice id should have. In the link below, be careful of all the download buttons. Choose the "Save file to your PC: click here" link and open the file. (not save)
http://www.2shared.com/document/8dOC7v6E/actions.html
2. Make sure that the user provided in the CUP connector has the access for connecting to RAR and it should also have the administrator rights of the RAR.
Should the access be provided from the roles/actions from above?
3. Make sure that the password of both the users given in the above points is not expired i.e. they have been reset in UME.
You can check the same by once logging into the UME through that users. In case it asks for the password change, then the password is expired and you need to change the password and give the new password in the CUP.
Should the password ever expire for this ID? I will double check on the password.
4. The logon language of both the above users should be maintained in UME.
I am not sure how to check this, please advise.
5. Also check that the connector in the RAR is working and is able to connect to the backend SAP system.
I tested the connection in CUP and connection was successful. How can I test the connection for RAR?
Thank you in advance,
Edited by: Eric Lau on May 17, 2010 6:41 PM

Alert Generation, Control Monitoring

Hi,
I am trying to understand how the Alert Monitoring background jobs work. I understand that Alert monitoring for Confliction Actions and Critical Actions will generate allerts when conflicting actions or critical actions actually are performed, but how is this for the Control Monitoring? Will it create allerts when users/roles with conflicts are actually assigned a mitigating control, or will alerts also be created when mitigating controls are created but not assigned to a specific users/roles risk violation?
Thank you!
Ingar Steinsvik

Did you check the documenation on this ("Scheduling Alert Generation" section in GRC 5.3 config guide):
Control Monitoring:
This alert type is a mitigation level analysis, which generates mitigation alerts.
During the generation of alerts, the user and transaction information is passed to the risk
analysis. If you select the Consider Mitigated Users option, alerts are generated on user who
are associated with a mitigated risk. The generation of these alert types are useful for
transaction usage in Segregation of Duties (SoD) Review and User Access Review (UAR).
You can also set up a background job for sending alert notification via email based on the
alert type. By selecting Conflicting Actions and/or Critical Actions alert types, notifications are
sent to Risk Owners. Selecting Control Monitoring alert type sends notification to the
Management Approver of the Mitigating Control.
Thanks
Himadama

Changing Monitor on Mitigating Controls

HI all:
Just wondering, is there a way to change the Monitor on an existing mitigating control once it is assigned to either a role or user?? When we try to do it, the error message says "Role is already mitigated to Control xxxx: Monitor xxxx cannot delete".
The only workaround is to delete the exisintg entries and re-enter them with the new monitor...however this is not an efficient approach when we have many entries for one mitigating control.
The monitors are defined properly....we just can't change the mitigating control monitor once there are assignments to roles or users.
Any help would be appreciated.
Margaret

I think one of the option may be to keep the monitor ID same but change the name of the monitor for that monitor ID in the administrator tab of mitigation.
Hope this helps
Regards,
Nitin

Risk Analysis and Remediation Mitigating Control Monitoring Alerts

Similar Messages

Maybe you are looking for