Is there any chance that GRC was installed prior to the Istanbul Version? There were major architectural changes that were made in that require a migration. There is even docs on how to migrate - here is a link to those:
I think I agree with you on the filter that was built - that looks like an infinite loop. I do not understand why it would have been built that way.
What I would do is to first inactivate those four Profile Types. Do that by deleting the Profile Filter on each of those Profile Types. If you don't do that, then when you do what I am going to tell you next - I think it will just start regenerating the profiles.
Next you want to go to the All Profiles modules and delete (yes, hard delete all the profiles). I would do this in small batches - because there is a lot of processing that is going to happen when you do this. I just deleted 3 profiles from my test system from the list view - and I got this pop-up message:
So, what it is going to do is go and retire these 7 risks and 12 controls. That is what will happen on your system.
Best Practice for Profile Types is a long conversation. It varies by customer and what you are trying to do. Maybe of the holidays I will write an article on how to select what you will use for Profile Types and why. In general, the Profile Type should represent the groups/people that will be managing/owning the controls and risks. That could be based on departments, or locations or servers or applications, etc. Lots of choices.
Okay - I can tell you are new to GRC. There are some things that don't work like you are thinking they work. But we can get around to those later.
On the 4 Profile Types - look at the Related Lists on each. There is a tab called Profile Filter. See if a filter has been built. This is traditionally how profiles are generated. However, a profile can be manually related to a Profile Type. Here is an example of a Profile Type filter that we use in the GRC Fundamentals class. The Profiles are built from the company table with the filter conditions defined on this screen shot. If there is a filter built, provide a screen shot.
This was very helpful in understanding where the profiles are built from. I can see the benefit of building a profile from the company table.
During testing or initial configuration of the GRC Profile Types, I believe my predecessors had built out the Profiles from the Profile table [sn_grc_profile]. It appears that we may be in some sort of infinite loop that is re-created thousands of Profiles. Is that a correct analysis?
What is the best practice for Profile Type filters? Should these be built from Company, Groups or any other tables?
How would you recommend I remove/eliminate the thousands of records? Perhaps starting from scratch with a new Profile Type.
Please see attached screenshot for the Profile Filter conditions.
Thanks again for your help.
JB
