Creating new entity class rules

[alexrozov]

Hi,

I want to allow roll up of risks associated with specific locations to the company level

here is what I have done:

1. create a new entity class called location

2. created a new entity class rule conecting cmn_locations to the location class

3. create a new type called locations with an entity filter on the locations table

This has created entities for all my locations under the entity type and all of these are now linked to the location class.

I have a few questions here:

1. wen I look at the entity class rules - the rules that are coming OOTB are no the GRc:profiles application, but in order to create my new rule I had to go to global since GRC:profiles does not allow me to select the location table. it also will not allow me to select any CMDB tables althoguh the existing records are for cmdb tables and are under the grc profiles application. 

I'm not very familiar with scoped apps so I'm not sure if I'm doing anything wrong and if the way I'm doing it is of any problem?

2. I would like to ask if a new class and class rule are created, will existing entities that have no class and should be linked to the class based on the new rule would be automatically updated by the system? or will this only work for new entities and I need to update the class on my own for the existing entities?

3. Once I create the class, and have entities created under this class. If I add it to the dependency model in the GRC workbench, will this automatically related upstream/down stream risks based on the relationships in the ServiceNow database and the entities I have? or do I still need to relate risks manually and this relationship is just helping me to filter the entities based no the relevant classes?

Thanks

[Eric Le Martre4 · Accepted solution]

1. This happened to me too. When creating Entity Class rules we clearly do not have the same flexibility that the Product team has. For what I have seen, we can only create them from the Scope of the table we are targeting.
2. Unfortunately no, if you create your rule AFTER having already generated your Entities from related Entity Types, then the rule does not apply. So ALWAYS create your rules first and your Entity Types second. If you missed it, then you will have to either delete/recreate your Entity Type or to modify your Entity Type Filter so that no entity is found, hence all existing ones will be deleted and the reset your filter back to normal and re-generate your Entities, this time automatically associated with the correct Class.
3. When you add the dependencies in the GRC Workbench, you create a meta-model for the relationships, for instance Business Services are related upstream to Business Units and Business Units to Company, etc... Then you need to manually associate each entity of the given Class to the correct upstream/downstream. Those are not generated, except if you use the IRM/GRC Synchronisator from Belasis (http://belasis.com - Eric@belasis.com). This solution synchronise automatically existing CMDB and Organisation relationships between records and maintains automatically the correspondants in the Entity Structure.

I hope this helps

Regards

Eric

[alexrozov]

Just a follow up on point 2

I have tried to change the entity type rule so the entities will be removed.

This did remove the entities from the entity types but even when the entities were not related to any entity types the system did not delete them.

So I had to manually delete the entities, and then recreate them to get the class populated correctly.

[Eric Feron]

Just to be sure, this might be useful:

Entity Types, Classes and Tiers for GRC: What they are and how to use them (15 minutes).