Rule Upload Errors

[Former Member]

Hello,

We installed SAP Netweaver 7.0 system EHP1 and the GRC AC 5.3 System CME successfully and completed all the post-install activities and all the RAR configuration activities.

We upload all the GRC text files, rules and executed the user/role/profile full sync, batch risk analysis jobs and management report jobs successfully and completed all the post-install activities.

Now we would like to upload rules and mitigations from other Netweaver 7.0 system, which has GRC 5.2 installed. Since that system contains mitigations of 4 different systems i.e. QR2, DR2, PR2. we want only the customized mitigations of PR2 system. We do not want the mitigations of DR2, QR2 systems, since the mitigations of DR2 and QR2 are not required by us.

When we tried to export mitigations from PR2 GRC 5.2 source system and upload it to our new CME GRC AC 5.3 target system, the old GRC 5.2 system does not allow us to select only 1 system i.e. PR2 and so we were forced to select all the 4 systems from GRC AC 5.2 and export all the mitigations into txt file.

Then we manually edited the exported file, to contain mitigations of PR2 only and then through GRC AC 5.3 -> RAR - configuration -> Rule upload -> Tried to upload the mitigations and we got an error "Cannot assign a java.lang.String object or length 6 to host variable 1 which has JDBC type VARCHAR(2)". Rule set upload is not complete due to this error.

Please note that CME is the target GRC AC 5.3 System and PR2 is the source GRC AC 5.2 system, from where the mitigations are to be uploaded into CME 5.3 system.

Kindly let us know, how to resolve this error.

Thanks,

Imran

[Former Member · Accepted solution]

Hello Imran,

First try to change the format of the file to UTF-8 and save it. After that try to upload this file into the system and check how it goes. In addition to this, after changing the format, please review the file to check that there are tabs and spaces at correct places only. What i suspect from the error is that somewhere a space or tab is either missing, or is available where it is not required. Please check and make sure that there are no spaces at the begening and end of the file. You can use editors such as text pad or edit plus to look out for spaces and tabs.

I hope it helps.

Regards, Varun

[Former Member · Accepted solution]

Thanks Varun.

Our requirement is just to export mitigations from PR2 and import it into CME.

Since the mitigation controls were created with the naming convention, which convey the nature of risk, module of user etc, hence I assume that the risks, ruleset also have to imported along with mitigations. Please let me know, if my assumption is right?

Also I do not want to overwrite the existing rules, mitigations etc, I would like to just append. So to accomplish the same, can I do the following.

1- Export mitigations from PR2.

2- Upload mitigations to CME via RAR -> Mitiigations -> Utilities -> Import

Thanks,

Imran

[Former Member · Accepted solution]

Hello Imran,

Once you export the mitigation data using the utility system will export data from all relevant tabels into the text file which you can import without modification. Of course you are right, that mitigation data will be valid only if you have uploaded relevant risks into the system as well. Otherwise the data will be inconsistent.

Whenever you will use the import/export utility to move the data, it will always be in Overwrite mode. It does not support Append option. So please take a note of the same. Be it for rules or mitigation, the data will be overwritten. You can simply export the data from mitigation tab and then can import the same using import utility.

Regards, Varun

[Former Member · Accepted solution]

Thanks Varun for your help.

 Once you export the mitigation data using the utility system will export data from all relevant tabels into the text file which you can import without modification.

The PE2 system contains mitigation data of 3 systems i.e. PE2, QE2, DE2. I only need mitigation data of PE2. I do not need QE2 and DE2. Is it possible to export mitigation data of PE2 only?

 Of course you are right, that mitigation data will be valid only if you have uploaded relevant risks into the system as well. Otherwise the data will be inconsistent.

1a- So should upload relevant risks before uploading mitigation data, to make it consistent.

1b- In this case, will I only upload relevant risks, or I will have to upload ruleset also?

2- I know the navigation for uploading ruleset, which is RAR - Configuration - Rule Upload. But, what is the navigation for uploading risks?

 Whenever you will use the import/export utility to move the data, it will always be in Overwrite mode. It does not support Append option. So please take a note of the same. Be it for rules or mitigation, the data will be overwritten. You can simply export the data from mitigation tab and then can import the same using import utility. 

So what I understand is the append option is available for ruleset only, since when I do

RAR -> Configuration -> Rule Upload -> Rule Set (It will append rules).

RAR -> Rule architect -> Utilities -> Export Rules (It will overwrite rules).

And the append option of mitigation upload is not available just like append option of rule upload. Am I right?

Thanks & Regards,

Imran

[Former Member · Accepted solution]

Hello Imran,

If you are not able to select individual systems for export of mitigation data then the system will export data for all the systems in single file. What you have to do is modify the file manually to remove the data for unwanted systems and keep the data for wanted one only.

1a- So should upload relevant risks before uploading mitigation data, to make it consistent.

-> Yes, what you have to do is to export the rules from the source system and then import the same set of rules in target system as well. You will do import/export via Rule Architect only.

1b- In this case, will I only upload relevant risks, or I will have to upload ruleset also?

-> you will have to import entire set of rules. You would have to export your rules via Rule Architect from Your source system and then import them via Rule Architect into the target system.

2- I know the navigation for uploading ruleset, which is RAR - Configuration - Rule Upload. But, what is the navigation for uploading risks?

-> Basically once you do the export of rules via Rule Architect -> Utility -> Export rules, then you export all the rules, risks, functions, rule set details etc (all the data related to rules) frm a source system(in your case a 5.2 system) in a single file which you can import into the target system (5.3 system in your case). You import all the rules related data from single location (import rules) only. Since you are moving your rules from one system to another, you need to use the option to rule upload via Rule Architect and not the configuration one.

So what I understand is the append option is available for ruleset only, since when I do

RAR -> Configuration -> Rule Upload -> Rule Set (It will append rules). - This will append if you have unique entry of ruleset (but it is not relevant in your scenario as you are exporting rules from one system to another.

RAR -> Rule architect -> Utilities -> Export Rules (It will overwrite rules). Yes. This will overwrite rules.

And the append option of mitigation upload is not available just like append option of rule upload. Am I right? Yes, it will only overwrite.

Regards, Varun