GRC Monitoring Alert for mitigating control not working

[former_member291268]

Hi,

We are facing difficulties when trying to configure Monitoring Alert for a mitigating control.  We have completed the following Steps:

1. For the Mitigating Control, we defined both Monitor & Mitigation Approver.  Also configured a report "X" to be executed as part of the control under "Reports" tab.

When veryfing the job for the alert generation, it seems it worked, but user defined as "Approver" does not get any notification.  This approver was defined in "Owners".

   2.  Scheduled GRAC_ACT_USAGE_SYNC to run in a daily basis.

    3. Scheduled program GRAC_ALERT_GENERATION to run in a daily basis with variant including the Control

Our understanding is that Approver should receive a notification if Monitor does not execute the report "X".

Job log:

Thanks in advance.

[former_member193066]

kindly look in the said note as well if all config and all are perfect.

look this note 2168589.

regards,

Prasant

[former_member291268]

Hi Prasant,

Applied note 2168589, runned the job and verified SOST.  Notification not sent.

Best regards.

[former_member193066]

WF-Batch has mail id maintained?

monitor and approver has mail id?

if yes, once you run the job is there any alert generated at all?

regards,

Prasant

[former_member291268]

WF-Batch has mail id maintained? - Yes

monitor and approver has mail id? - Yes

if yes, once you run the job is there any alert generated at all? - No.  I can only see that the alert was generated.

[former_member193066]

try for a control for which mitigation report is not generated,

alert wont be send if the report is already generated by monitor.

REgards,

Prasant

[former_member193066]

what is your GRC version and SP Level?

Regards,

Prasant

[former_member291268]

For this control, the report has not been generated.

[former_member291268]

Version: 10.0

SP: 0016

[former_member193066]

Hello,

control has to be defined under mitigation control in SETUP workcentre.

please refer the doc.

the try alert generation

regards,

Prasant

[former_member291268]

Hi Prasant,

Control was already defined under Mitigation Control. This control is the one used for the Alert Generation.

Regards.

[former_member193066]

ok, can u create 1 more control and execute the risk analysis

then try alert

Regards,

Prasant

[former_member291268]

Hi Prasant,

Executed the steps for a new control, defined the frequency for the monitoring to 1 day.  Executed the job to run the alert, no notification.  Should this "1" day be finished after configuring the alert?  Can I see the alert somewhere although there is no e-mail notification?

Best regards.

Lynette

[former_member193066]

is mitigation control assigned to any user?

Regards,

prasant

[former_member291268]

This control was not assigned to any user, first control was.

I've just made the assignment and configured the job to run daily instead of instanstaneously.  Will let you know the output.

Best regards.

Lynette

[Former Member]

Hi Lynette,

did you receive an entry in SOST/G, for the Alert generated. FYI, alert will only get generated, when the monitor will not run the report.

regards

plaban

[Former Member]

Hi Lynette,

Did you find Alerts generated in NWBC-> Access Mgmt.>Alerts> Mitigating Control. If yes, then issue is with your support pack level.

Regards

plaban

[former_member291268]

Hi Plaban,

I did find the alerts generated:

Control ID ending with -C25 was the first control configured for this notification.  Control ending with C-11 was the 2nd control configured.  Both of them generate the alert but no e-mail notification is received.

Both monitor and approver (the one that should receive the notification) have e-mail id in SU01

Verified again in SOST and there is no e-mail in error about this alert:

Should this e-mail notification be configured or verified somewhere else?

Best regards,

Lynette

[Former Member]

Hi Lynette,

is this happening for all Monitors or for only 1. if not, could you check if mail id is maintained for the monitor. Also, could you check SOST, for any email triggered, at the data and time, shiwn in your screnshot

Also , check the below note

1728869 - GRC 10.0: Critical Action Alert email not being sent

Regards

Plaban

[former_member291268]

Hi Plaban,

We're testing for only one monitor and one approver both with maintained e-mails.  I understand the approver is the one that should receive the notification.

I verified SOST and none of these requests corresponds to the testing.  Will verify the note and let you know.  Thanks.

[former_member291268]

Verified and Note 1728869 was already implemented.