entity relationships in GRC are very confusing

[alexrozov]

Hi All,

I'm trying to properly understand how everything is working with regards to entity relationships.

I'm trying many different scenarios and I cannot understand the logic.

reading through the documentation and going through the videos on entity scoping has also not provided me with the understanding I'm looking for.

Here is what I have:

We have a set of entity classes and entities defined

all our entities are members of an entity class

We have a dependency class model build through the GRC workbench

Here are a few things I did figure out (hopefully I'm right)

- linking classes in the dependency model does not create any relationships between entities. these should be created either through the workbench or by updating upstream entities/down stream entities on the entity form related lists.

If I try to add upstream entities or downstream entities the OOTB filter filters entities based on the classes defined in the dependency model. I can change the filter and I can create any relationship to any entity

I wanted for example to link a business service entity which is in a business tier to a data center entity which is an IT tier so I changes the filter and created the relationship

- Once I define downstream entities for an entity the system automatically updates the downstream risks and downstream controls related list on the entity.

I think it brings all risks and controls that are linked to the entity that was added as a downstream entity

Once the relationships are defined I think I should be able to relater risks to downstream risks and to related risks to controls and vice versa.

when I'm on the control form looking at the risks related list and vice versa I'm expecting to see an add button.

It looks as if this button only appears if there are downstream risks/controls defined for the entity. But I have not been able to see this working consistently

I can't understand exactly when the add button appears and when it is hidden

and if I can see the button and I click it I can't really understand what risks/controls are shown. In this window the filter is not available and I can't change it

I'm also trying to understand if all of this is somehow dependent on CMDB relationships, but I could not see this

If there is some detailed explanation of how all of this is working. what is dependent on what and what affects what

thanks

[SanjivMeher]

Yes...correct Entity type. My bad.

[Eric Le Martre4 · Accepted solution]

Hello Alex,

I wanted to respond to your question about possible link between the relationships built in the CMDB and those in the Risk Workbench. I can confirm that there are NO relations between these 2 out of the box.

But Belasis has built an App that exactly does that: automatically importing existing CMDB relationships as Entity Relationships, for those Assets that exist as GRC Entities. And it actually does the same with Organisation entities relationships with existing relationships between Companies, Business Units, Departments, etc...

Please contact me at Eric@Belasis.com if you want a demo.

The App just got certified and should be published on the Store early next week.

Best REgards

Eric

[alexrozov]

thanks eric

this sounds interesting. let me check if the customer has interest and if so maybe we could do a demo.

I would appreciate if you can acknowledge that I do understand the other points I have written correctly