Functions and Permission in GRC AC10.0

[former_member601584]

Hi All,

We are creating the custom functions as a part of custom rule set creation in GRC AC10.0. We have defined the custom function as shown in the below example table(first table) . We uploaded the custome rule set with mass upload transaction and generated it. We noticed that the system is interpreting the values in the condition column differently than we mentioned in the upload files.

Does any one has idea on this?  How the system evaluates the condition column?

Below is the one example and we have number of cases like this.

Uploaded with values

Fun ction	Transaction	Auth object	Field	value From	Value To	Condition
ZXXXX	SU10	S_USER_GRP	ACTVT	1	2	OR
ZXXXX	SU10	S_USER_GRP	ACTVT	5	6	OR
ZXXXX	SU10	S_USER_GRP	ACTVT	22		OR
ZXXXX	SU10	S_USER_GRP	ACTVT	50		OR
ZXXXX	SU10	S_USER_GRP	ACTVT	78		OR
ZXXXX	SU10	S_USER_GRP	ACTVT	PP		AND

Values in the system after upload

Fun ction	Transaction	Auth object	Field	value From	Value To	Condition
ZXXXX	SU10	S_USER_GRP	ACTVT	1	2	OR
ZXXXX	SU10	S_USER_GRP	ACTVT	5	6	OR
ZXXXX	SU10	S_USER_GRP	ACTVT	22		OR
ZXXXX	SU10	S_USER_GRP	ACTVT	50		OR
ZXXXX	SU10	S_USER_GRP	ACTVT	78		OR
ZXXXX	SU10	S_USER_GRP	ACTVT	PP		OR

Thanks in advance for your help

Hari

[Colleen · Accepted solution]

Hi Hari

am I missing something but what is your difference - is it just the last value having an OR instead of AND? Is it just the ACTVT field that does this (it may be this field is always OR as you only need one activity for the function)?

Also, did you include the other fields that make up the auth object definitions and include the preceding zeros for Activity (e.g. 1 should be 01)?

Regards

Colleen

[former_member601584 · Accepted solution]

Hi Colleen,

Thanks for the reply.

my doubts got clarified after referring the below notes, but they are related GRC 5.3.

I hope the same logic will apply to GRC 10.0 also. Please let me know if you have any additional information.

1330165 - Instructions on how to use Operators AND OR NOT

1358952 - Rule Architect - logic of the NOT operator

Cheers

Hari

[alessandr0 · Accepted solution]

Dear Hari,

the logic is still the same in 10.0. As you have only one field within your authorization object group the last AND becomes an OR after upload. That system behaviour is correct.

Regards,

Alessandro

[former_member601584 · Accepted solution]

Thanks Alessandro

[alessandr0 · Accepted solution]

Hari,

if the question is answered please mark and close the thread. Otherwise let us know.

Best regards,

Alessandro