okay good evening welcome to phil goes deep i'm really sorry um i'm five minutes late starting and you can see my green screen is not playing uh ball for some reason trying to sort the lighting out on there um i haven't i think it's the clips i haven't tightened the screen so it's got um yeah it's not very good so hopefully the audio is working everything else is going wrong shout out to tr1 lux try lux don't know how you say that um hopefully the the audio is good can you just uh let me know on that front um what have we got going on tonight so it's uh phil goes deep um we're back with grc community service so it's been around a year since i started doing the channel and one of the first things i did there was a grc community service so i went on to the grc community the servicenow community under the grc forums and just started trying to help people with uh with the questions and answer them live and i i also i've got my kids to actually help me with a few props so i've got uh t-shirt sizes um on lollipop sticks can hear me clearly excellent thank you um yeah you can't see that very well in the light so it's all let's just check maybe that's why let's just move this light i've actually borrowed my wife's um nail light for doing nails so um everything's opening in the uk on monday um so her new beauty salon is going to be claiming this light back uh and i'll be getting my hair cut so um it's still a bit bright isn't it let's have a look there we go that's a large t-shirt thanks euler we've got here medium yeah medium and there's a small one kicking around somewhere yeah these were made these were made about a year ago i can't find a small one but what i said was i would rate the issues and the questions that are getting raised on the community and i'll give them a score so medium small anyway that didn't work because what i found was when i set a timer and tried to kind of restrict uh and gamify the stream it just meant that i wasn't really putting the quality into uh into the answers that i wanted to give so i stopped doing that and then i got kind of uh yeah a few other things have come up and i've been focusing a lot on quebec recently and i realized that it's been at least a month since i really posted to the grc community so um just wanted to see where um where things are coming from so i've got i've got a um mentee meter um linked in the description on this video let me just see how i can get to the video from here if i open that hopefully it doesn't play it's really posted to yeah it starts playing community so there we go a little bit of a delay yeah so that mentee uh you can from there oh here we go got it over here and i've also got it set up on my obs where we are with the word cloud so just try and hide that you'll see on this next cut that my green screens are pooling and i really don't know what to do about it it's just seems to be the lighting see if i can direct that yeah apologies for the technical issues tonight i've tried to do a few things and none of them have really worked so let's just uh switch it over so i'm down here you can see the uh the mentee meter word cloud maybe maybe i should increase the opacity on that i'm not sure but we've got setting up a ram so that's a risk assessment methodology we've got a tree picker on entities risk statement hierarchy creating a heat map risk and compliance so if you go to the link in the description and you can submit to that menti meter for example let me let me try it if you go to mente.com in fact i can do it i can do it from here no that's the heat map if i go to mentee.com and i need the code oh yeah what's the code there is a code you can enter let me try it in the other window we'll get going in a minute i'm just trying to trying to set these things up so um we'll hit we'll hit a bit of speed in a moment i'll get the code and you can actually use mentimeter we've used it in the company uh in rangoo for quizzes um and you get a leaderboard i've used it in um customer workshops as well for you know sometimes you get up in a workshop and you get up on the whiteboard and you're trying to drag it out of people you can actually use this um oh there's more there's more that's coming in excellent so the code that we want to enter in here is seven four three one three seven and when you do that it takes you to here now i could put in here that i know for example uh jimmy uh jimmy garcia hopefully watches this back um when you submit that you should see that that changes ah tell you what that's not refreshing that's the problem uh one moment let me just figure this out why does that not refresh properties refresh browser when scene becomes active okay well you can see that coming in now so when we click into the heat map here you can see priorities consensus processes i just put ucf in there for jimmy kiss um i guess that's um keep it simple stupid um how do you keep it simple in grc i mean that might be a good question so it looks like embedding it on on there doesn't really work so what we'll do we can just keep coming back to this but yeah using menti meter to kind of get a little bit of um engagement from your audience having a bit of fun having quizzes checking checking understanding so you could you know ask the question to the the audience that you're working with um in the form of a kind of quiz you know and rather than trying to teach people things from the very beginning of you know they might already know the stuff or you might be a mile ahead so you can use mentee meter to kind of just judge where the audience is at um ask some tough questions ask some easy questions and and based on the kind of results of the quiz pitch the workshop accordingly so it's a really great tool um and we can use it for uh for today so what i've also got is i've selected from the community uh the stories that i'm saying stories so the the answers the questions that were posted and i'm going to try and answer these so i haven't added them to a sprint yet i was trying to set up i was trying to set up a rest api that i could then tick along down the bottom of the stream and show you know the number of different issues in in a different uh state these are all kind of sitting in draft state and so on so um i was trying to do that ahead of time just trying to do a bit too much i think so you know that's we could spend a bit of time trying to set up the rest api but today is about grc community service um and trying to just work through some of these issues so in in no particular order um and i've not really used agile uh development too much but i thought i would make use of the platform i was going to add all of these to my sprint i've estimated them as well so i've given them a small and medium rating um just drag these up can we can't right click from here okay um drag so i see a few more people joining on the uh on the stream so welcome um you've probably missed the technical difficulties that always ensue when i try and do too much i've got 12 story points in here i've said that i've got a capacity in this sprint it's a two-hour sprint i've got a capacity of 10 points but let's just start the sprint and unfortunately you're not going to see live stats on the bottom of the ticker unless uh unless i see overwhelming response from people that uh you you want to work on a rest api right now but the rest api is actually working it's the it's the python script that i'd have to run locally in the terminal and the shell script that will pull constantly to my instance to pull that down and create a text file that ticks along at the bottom of the stream but that might not be very interesting to people so i've got a sprint board here i'm just going to pick on the first one in the list i don't know if that's in the right order but this story i don't think you'll see it from here i'm going to call them stories from now on uh because they're actually posts on the on the community yes i've added a url field um so i can't make i can't set it ready because it needs acceptance criteria of course so i'll say uh question is answered i mean i'm not going to wait for it to be marked correct but if i say the question is answered that's acceptance criteria for me okay so i can click this link and i'll just have to make sure that i'm logged in if you have just joined in uh check the link in the description for the word cloud um at the moment we've got a few topics on here so as well if you're seeing if you're working with a mentee meter in um like in the room or remotely with your team and you see a theme on the screen like oh ucf or compliance or priorities then try and use the same wording because what will happen with the word cloud of course um for example if i uh go in here and vote is it setting up setup ram okay set up ram if i use exactly the same words then the word cloud will receive that and then make it more prevalent on the screen more obvious if i put ram on its own it won't it won't recognize the difference it will treat the the phrase so have a look what's going on on the screen and use that as well um but yeah setting up a ram maybe we'll maybe we'll get to that but i wanted to try and use this as a bit of a communication um you know a bit of engagement collaboration and we'll try and talk around some of these topics but if i was in the room or doing a virtual workshop with a customer or an organization i'd be saying okay i see a little bit of um focus on on risk assessment methodologies here who's who suggested this and let's talk about it let's see what it means because for example i don't really know what consensus means in this context so i'd be asking what do you mean by consensus and then hopefully the person that's posted that um kind of engages and we can have a conversation um there's a few things in here and i i like i like the fact that we've got some entries you know this could have been a blank board so um okay this is the community and i'm trying to maintain my pole position here and jan um who is a principal technical trainer at servicenow and absolutely amazing on the community she does so much to to answer people's questions um i'm only just sitting a hundred points ahead of her and i don't know how i've done that uh given that i've not really been on on the community too too much so uh i think that's more luck than anything but i'm trying to trying to widen that lead over jan just for a bit of fun but story here let's call it uh one double a c one treble zero six this is now ready um and i'm gonna say it's it's in progress because i'm actually looking at it i've got no description don't need anything else let's have a look what is the question and it's from mark actually i've got in reverse order because mark posted this only three hours ago and i said to mark i'm adding this uh to the to tonight's backlog and it's here it's somehow use up to all the other posts um and it's the first one we're looking at so issue assignments from mark we'd like to change the workflow when an issue is created after an attestation or indicated task failure well actually any issue will fail from an indicator failure not necessarily an indicator task any indicator failure any attestation failure also a control test failure as well um issue management in servicenow grc is probably one of the kind of most complex topics because issue is shared by uh compliance it's shared by risk it's shared by audit but they all have a slightly different kind of level of involvement and the the flows are slightly different and to be honest version 12 of grc is out now and i've not dug into that at all so um and i think actually my pdi my personal developer instance is still a little bit broken from the grc full flow sort of project that i attempted so i've tried to back out some of those changes so we might be up against the grain there but when an issue is created to assign the issue to a different team for review and to manage the process our logic is that the control owner might not be as independent as they need to be and genuine gen generally would need assistance from the compliance team to put the right processes in place okay so i guess when you say not as independent as they need to be it's the kind of okay you've got an issue your controls failed and the control owner says yeah i've sorted it out all done and there's no um governance there's no kind of four eyes on that process so but this needed needing assistance from the compliance team to put the processes in place two questions would there be any known ramifications to doing this so what we're talking about if we're talking about changing the workflow that by its own definition is customization okay that's the difference between configuration and customization if you're changing the workflow now issue itself is still left a little bit open um the i think what service now i've tried to do is say look this is this is a beast here and it's not right for servicenow to tell every organization exactly prescriptively how to manage issues it is left open on purpose okay so it's up to an organization to say what needs to be done and i think a lot of stuff's happened i've noticed in version 12 there's now a sub state in there which is for requesting further information i believe and we've also got issued triage that was brought in in version 11 and we're going to start to see a bit more of that so we do need to be very careful that we don't break issue and when we're talking about issue management in the context of compliance it's even more important than in risk i would say because in compliance it affects the ability of your control to be showing as compliance in risk if you've got an issue attached it doesn't really mean anything it's nice it's good for evidence but a control on its own with an issue attached it could mean a difference between you being green or red okay and that could be critical to an organization so we do need to be very careful what we do with issue management i mean there are some configuration options that are already available the one thing that's that i'm thinking about here is well the question would there be any known ramifications to doing this okay so if we're just talking specifically about assigning the dish the issue to a different team for review i think there's another option here without changing the workflow without changing that core functionality let's just go in uh where are we so we're in this uh we're in this board let's just go and take a quick look at um at issue so sn grc issue dot capital list just to pop it out in a new window and keep my board open hi michael okay so uh just going back to uh consensus so michael cook consensus among the project team on requirements and priorities that's a big one that is a big one if i was going to pull out my um i was gonna pull out my t-shirts uh sizes that's a large one right that's that's too big for this show um trying to get consensus among the project team on requirements and priorities yeah i guess it the main point there is making sure that that project team is made up of the right people okay so you need to have the right people you need to have the sponsor um you need to have people that can make decisions you need to have people that know the existing process that own the process and have that responsibility to live it you need to have obviously then the kind of technical implementation team sometimes you've got you've got a business analyst or maybe the technical consultant um is made up of people that are able to behave like a business analyst in in the project it depends what your project team is structured is it kind of a phased project where you do a project deliver it go live come back do another project a bit later or is it that kind of continuous delivery where you've got you know more of a agile product owner and a scrum team that's just constantly working through a backlog with with different kind of products it does depend on your setup trying to get that consensus among the project team i think it does come down to understanding and it's going to be if anything else one of the big c's in in this the agile process right conversation it's really about conversation for me you're going to have things you don't agree on but that's where the decision maker comes in you're going to have the sponsor as well who sets the priorities overall and sometimes you can't all agree um and you can't reach consensus but i think striving for that is is important having conversations about that and if you're going to join in on the mentee um you can just go on your phone or on the browser mentee.com add the code and you can start contributing i just saw some things come in here but this is from a business or technical perspective so if you're going to say compliance just do it with a typo and we'll see that compliant come up as well so use the phrases that you already see on the board if you see something there yeah i think i think so michael i think that is an agile organization or an execution question however it's it's relevant it's very relevant and one of the biggest problems um that i think i experience and you know the teams and the organizations i work with if you're coming to service now with that background in itsm which most of the technical resources have been um the audience that you're dealing with when you're doing a grc project is very different you can't talk to them about the technical stuff first and foremost you know you've got to really live their world and and that's why i say it comes down to conversation so we will go into issues let's take a look at issues this one's in analyze now probably i should go in as a compliance manager and you can use um like personas on your browser as well to switch between impersonations a bit easier i haven't set that up on this on this instance on this machine okay i'm on a different profile right now so i'm in as an admin so i might see certain things that you wouldn't see as a compliance manager or compliance user but yeah look here version 12 substate now if we look at the options and i've got snu tools turned on but nothing selected there basically it's more information required or information requested and information provided i'm not quite sure how you get to that stage but just going back to the exam question from mark when an issue is created to assign the issue to a different team for a review and manage the process well actually it's very important here different team for review you would have noticed in version 11 the introduction of the issue manager group and the issue manager role okay the group responsible for managing and reviewing the issue and the issue manager is the user responsible for managing and reviewing the issue and i think this is very important introduction it doesn't change the workflow but it gives the ability to have that oversight okay and you can with a few simple changes on the issue um have the once it moves to review yeah look okay perfect so moving to review now it's going mandatory so that's quite new okay your issue manager has to be somebody with let's just show this has to be somebody with the right role i believe oh it's dependent on issue manager group i thought it had a i had a reference qualifier on on roll okay so reference qualifier get issue manager group roles but issue manager group is not mandatory so therefore i can bypass this i thought the issue manager you would want this to be somebody with a grc manager grc user or create your own custom role there to say right somebody that's got some authority in the process that's done in the group so if i select the groups i can only select compliance managers right and then i select a risk manager okay so now i can move that to review uh okay of course if i'm moving it to review i need something to review due date becomes mandatory that's strange for me that's a strange time to become mandatory of a due date that should have maybe happened in analyze let's say i'm going to remediate it all fixed okay so all fixed go to review that is a bit slow i hope it's not logged me out because i took so long talking there no okay and that's excellent right without me changing anything the whole form is locked down now okay so it's in review state and if i was risk manager then i would be able to make a decision here and move it back to respond right and say sorry need to you know you say you've all fixed it but i'm not happy etc so your action plan all of that stuff so you've already got here two fields that handle the issue manager okay and the a different team for review right you've already got that separate segregation of duty and management of the process so you could use something very simple like assignment rules where do i want to be in here assignment rules and i think there's even something coming oh yeah look oh that's issue triage okay so issue triage out of the box don't want to do any spoilers michael but did you have that question uh so but this is just core assignment rules it's just prefixed on the menu item right for the table equals issue triage you could put the assignment rules here and say if the let's take a look at the issue because we've got issue source ad hoc issue type we wouldn't be assigning that yet classification i think in here no i don't know what the options are let's just configure i never know which one to click is it configure choices or show choice list it always confuses me which one i want yes it's that one okay so compliance there we go so value one two three four just remember that one two three four compliance risk audit vendor so i'm gonna say that's a one okay that's a little sn utils trick there just to be able to bypass the read-only field only good for development don't do that in production there's a reason so if i say classification i think that's a new field as well classification is compliant that's enough for me i'm going to say compliance manager that's not the best name so it applies to compliance manager and i want to assign it to compliance manager oh does this assign yeah this is no good this is going to do the assign assignment group assignment group like the core assignment group let's just check i've got one for quebec i just want to check it's not configurable i think it's not so let me just put in a script okay so current category current yeah current.assignment group set display value i'll never use that enter a script to further customize the assignment rule current dots is going to be issue manager i lost it i think it's called issue manager group might be wrong and i'm going to call that compliance manager save that but to be honest i've never done a script on assignment rule so i hope i've got that correct i hope that the applies to has filtered that correctly um that's assignment oh my issues over here um i wanted the name of it issue manager group yeah i got it right okay so that assignment rule is active if i then sorry i'm switching browsers around if i just go to sngrc issue dot do and create it as classification one which is compliance and just say test oh it didn't it didn't take it why did it not take that on insert there's a business rule here for some reason is it because of the details it's not attached to a control that's a control does that change the classification yes it does okay so let's just do that again check that that is control yes test assignment rule so it looks like my assignment group my assignment rule's not working but i feel like that's just because i haven't said it correctly um if i just as an example put in here compliance managers the following script requires personalizing the issue okay the other thing i could do is just get compliance manager there yeah let me just grab that sis id because i'm not happy about using um a hard code well not hardcoded i'd rather issue manager group dot set value it's not asking for a current update is it release planning i don't know whether that's going to work i don't know that you can do it i would have done it this way around actually current dot set value issue manager group and then save that let's just take a quick look we've got anything else coming in on the word cloud but it's nice to just see it move anyway um processes as well advanced risk assessment ram okay let's see how we do for time i feel like i'm really laboring this um this one for issue assignment rules i feel like it's could be an easy answer um let's just select then this one i believe that's a control yes nothing in the assignment group nothing in the issue manager group just say test and assign rule and save yes okay so that worked on assignment group it didn't work on issue manager group but effectively that's what we're aiming for here so just going back to mark's question okay so with regards to assign the issue to a different team for review and to manage the process you can see since version 11 and also improvements in version 12 of grc release that issue manager and issue magic group are introduced for this very purpose um without really touching any workflow perhaps with simon rules or a before business rule you can um set the issue management accordingly i feel like i've seen something on the release notes or roadmap uh at least around it might be issue prioritization it's part of the machine learning that's coming as well it's going to know who to give it to as well who's best placed and the other thing that i think i've also seen is machine learning about remediation tasks so if you're using issues and you don't quite see the value of remediation tasks but you think remediation tasks might be something good in the future start using them now okay that will start building your data and then you'll be able to use that for training in the future for your training data for the potential of issue management machine learning so the system will say well this type of issue you normally do this and it will come up with a remediation plan for you and you'll be able to select it and give you confidence ratings that's the potential but if you don't have the data to start with it can never know so start using them that i think they're pretty much a zero pain um you know slightly extra but the benefits there does anyone know which script would need to be changed um you can do this without scripting the benefit of the above approach does not change any workflow the control owner is still responsible but the issue manager provides oversight which seems to be what asking for okay so the other thing with issue management as well you don't always have to work the issue if it's an indicator failure right if you're checking weekly monthly this thing's good or bad and it fails it creates the issue that issue can be used to track it right if you've got overhead and you know that's not going to get solved easily that can be used to track it and provide the remediation plan and everything else okay it's a great option it will also give you some like view as to how you solved it right but you can go to the root cause and solve the root cause for example if the server is running low on disk space so i'm going back in time here does this even happen anymore um or maybe the cpu utilization is reaching and constantly running above 90 percent i'm thinking more of like uh data centers monitoring tool sets but imagine that scenario you can get an issue to go and order you know new cpus or more storage and show the remediation tasks for doing all of that but you might be able to make a very simple change that just allocates the additional storage and then and then rerun the indicator and it will automatically close it and all the evidence is backed up in your indicators with your indicator results the snapshots of your supporting data so you can see it you wouldn't necessarily be losing anything you might lose the approach and the planning but you don't always need to work the issue the issue is there as a notification to give you ownership prioritization etc but you can you can still solve the issue by just fixing the root cause and there's a little property for that on issue management obviously for control attestation um you need to retake the attestation so if your control attestations failed i can see why an issue might be more more relevant there um let's just put here also consider the fact that servicenow may introduce additional automation around issue triage for system generated faders such as indicators so changing the entry point process too heavily could create additional work to benefit from issue triage don't quite know what that's going to look like but at the moment issue triage is a manual process you create the issue triage and take it through a flow and to be honest that was one of the biggest changes to issue management really love it audit observations it's great now if you start to get indicators et cetera generating those issue triages um i think that will change the game but i'm gonna mark that down as a uh done okay i've answered the question have we got any feedback on that i don't think so um that's taking me back there which i didn't want so complete issue assignments um how are we doing on time that's taking me like nearly an hour there's no way i'm getting through this backlog um so we've got more on issue management here but i've already kind of covered that and i definitely had that i didn't assign it to me the primary assignee yes there we go okay so i think i put that down as a one pointer i think this is a one pointer as well why can't you see the details here in the scrum board i'm gonna open a beer because um that might be the only issue we get done and we're having a red stripe uh tonight so take a drink if you're on board or have a sip of your cup of tea coffee water etc so what we've got here how many points on this one i see the points oh yeah points there three so this is a bit bigger this one external respondents i'm going to move on i just want to go down say how do i change the audit report this one and it's the first one in the list so priority wise this one makes sense acceptance criteria is question is answered assigned to me and move this to work in progress so how do we change the audit report this is going to get a little bit technical now let's just take a quick look on here anything changed no looking good though okay let's tidy up some of these browser tabs that you might not see how do i change the audit report to include the controls tested and results instead of just the issues the template for audit reports only include issues however we need to also demonstrate to our external auditors what controls we've actually tested servicenow documentation provide no information to add additional tables or content into the report okay this one i think is i think i put is a one pointer i don't know what audit i've got installed in here i think i've got the advanced on i haven't got something that looks pretty pretty safe i want something not validate follow up here test test assessment okay so the audit report is something that is possible towards the end of the life cycle of the engagement and i am on updated versions of audit here so if you haven't seen some of this stuff before engagement dates and the ability to build in an audit plan advanced audience is is amazing um so much potential now audit was the one kind of like the poor cousin that's been left behind you've got in here i think that's a custom link there export report to pdf if i select a knowledge base here like audit and report template default audit report template okay and when i save this i can now see this button this ui action generate reports okay that is going to do the same process that you see happen with um policy when a policy gets published it produces a knowledge article so if i click generate reports here it gives you a preview first that doesn't happen in policy then you get the option to edit or publish so this is quite nice it's a draft but it has created the knowledge base article right now and you can see here name description scope objective objective results summary of issues no issues are associated we can edit or publish but if we just close that doesn't seem to change maybe if i maybe if i published it it would populate and now i've forgotten um what happens there how do we change it we just go into this report template and if anybody has worked with jelly before you'll know that this is an absolute joy it's not my favorite it's very powerful stuff there are other options in here and to be honest i've never done them i've never used scripts like that but i think there are um you can see how that's done as much as i don't like jelly as a personal preference like i have to learn it each time there's cheat sheets around and i need to shout out somebody who i can't remember right now the name was mentioned to me i will come back to i'll post in the description um if i can remember in time that used to post on the community about jelly and it was like the the one but if you needed anything about jelly you just need to search the archives for for that person um but effectively what happens in here if you've not worked with jelly before it's is xml i think jelly comes from ibm i don't know too much about it i think james neal was saying on his titans of now uh series well rob the dukes series for titans of now with james neal that a lot of people misused jelly and i think if used right then probably there are a lot of benefits and for me i just don't understand it very well and i feel like i don't need to understand it very well because we've got so many other options here but we've got we've got here um g tags evaluate so this means within here i can write some code write some javascript that's going to return a variable called profiles and profile is going to be a glide record okay so that's entities now if you're if you're just coming to this it's got issues in here okay so issues are coming in here what was the question oh the template only includes issues however we need to demonstrate what controls we actually tested okay so you just need to see the data model let's let's throw up a little draw io um and it's another tool i'm talking about workshops talking about collaboration especially in this remote working situation we're still in i'll just create a new diagram and i'll call this audit report yeah to documents that's fine until i cancel hold on audit report um using this tool gives us the ability to share like you can collaborate with teams if you use one drive you can connect it there and and you get real-time updates that's really good but just having this as a screen share in teams or whatever your tool is you can whiteboard ideas and i use it quite a lot on this stream as well slightly looney thanks jace slightly loony yes slightly loony i can never remember it i tell you why because i didn't used to use it and somebody told me about it it might be new check out jstop pro um for all things like servicenow past and present um jstop pro literally a catalogue of i mean look at all that stuff i don't know how you do it jase and that's not all there's so much more on here the news resources tools i know this is links to other things right this is link's other thing sorry where's the where's the stuff then for where's the like snapshot of all the old versions oh it's a reference somewhere jstop pro check it out it's a super resource um yeah slightly loony if you're looking for jelly logs so audit report what have we got we've got something like an engagement okay that's a task an engagement has m2m to to profiles right to entities and it's got lots of other m2m records that are generated as a result of these m2m so you've got controls in here you've got risks and because of those controls you've got control tests right so those entities when you move it into validate says okay here's all the controls and risks you've got and of those controls here's all the control tests that we've got for those things so those control tests then are they're not control tests sorry they are control they are test plans right a test plan is so you've got a test template which is against the control objective for each control you have a test plan which is for that entity how do i test that control for that entity specifically um somehow managed to move that yeah and then you have control tests which are audit tasks right so audit tasks is a base table and then off of here you've got interview and you've got walk through and you've got i think it's activity which could be a standalone task sorry it's a bit sensitive on the um on the gesture there um but then you've got control test okay and this is where this is like the real meat or the high protein substitute is for all the activity in engagement so let's just move that around a control test is an instance of a test plan but that's a these are all tasks um i'll put that there just because they are all of audit tasks the control test belongs to the engagement okay so if you look at an engagement so if i just go to sn audit task dot list and i'll spell sn correctly ah jace what am i up to grc it is mate yes uh if you want just you know what are the biggest grc challenges you can contribute to this um word cloud and we'll get a little bit more interactive um i've got a backlog of um stories which are all things that i've picked up from the grc community so tonight's show is um and i've got a shout out andrew andrew audrey door otherwise known as upside down andrew and you'll hear if you've listened to the between two functions podcast he was kind enough to invite me on and he told me that community service was his idea he did it first apparently but um we did we did have a conversation about that we're not really sure who did it first but we both had the same idea around the same time and um probably he had it first because he's 12 hours ahead um so that would make sense but community service is just going through the servicenow community trying to solve issues live i'm focusing on the grc community and i'm trying to answer some questions but it's taking me a lot longer than than i've planned per question because i'm just talking a lot so i've given myself kind of two hours for tonight and i'm just trying to answer this one by dddt which is a cool name um slightly disturbing avatar image and i've cracked open a red stripe to celebrate closing my first story before you can start modifying and the same with anything before you start writing a script you've got to understand the data model what you're trying to achieve if you before you start building this template you need to understand where these things work together so control test is audit task but audit task has got it's talking about parent being oh yeah because that's an activity so it's parent is a walk through um control test its parent is engagement i really dislike this approach right i don't know this might be controversial you know i always get caught up in naming convention conversations here for me it would be very simple if parent field was only ever something of its own class okay now you might get away with that on this table because a walkthrough is of a class audit task in some way but that's still not good enough parents should be um its own class so an incidence parent should only be an incident if you want to link an incident to a problem you use the problem field right and if you don't have a problem field create a problem field and be explicit be verbose don't use parent for any other task you want at the point here because why would this parent be that and this parent be that now you might be able to explain it but that activity's parent is is this it just it pains me somewhat that flexibility is sometimes bad parent okay you've also got top tasks in um so the other complexity in audit and some of the other areas of grc which i think was a bad design decision which was unknown at the time but they were extended planned task which comes from ppm so if you didn't have ppm you would see all sorts of um activity in your syslogs you've got top task in here as well top task task top task is it is that the label of it what problems does being generic with parent cause confusion uh confusion is being the main thing because imagine a world where you knew that parent was always a record of its own class no argument you would always know what's in parent and if you wanted to point to another table you called that other table reference field the name of the table that you referenced obviously that doesn't work quite for cis user because you've got things like assigned to you've got different kind of semantics but parents i just think should always be of its own class and i'd love to have examples of where that shouldn't be the case imagine if on here this field had this table had a field called engagement i would know that engagement was a reference to engagement and i could always go to engagement and get my engagement from that engagement field not sometimes look at parents parent dot parents um yeah maybe i think about these things too much anyway parent is what i need so uh where were we control tests a control test belongs to engagement by parent i'm up for debate on this by the way jay so i just i like to throw things out there and get um get feedback on it and i'm happy to be you know told i'm wrong yeah try to think of some i'd love it i'd like to have that debate because it it might just be i've seen it a couple of times it's wow me up a little bit and now i think that that's the answer and i haven't i haven't thought of everything else i just feel like parent if it was its own class and it couldn't be anything else you would never have the question that would be a fun discussion yes let's do it man let's do it did you see my comment earlier on um audio synthesis that's uh it was a slightly off-topic um conversation but ah knowledge registration is open people knowledge 2021 um if get registered there are some premium options available um did did i done if i said that um if i said that loud enough um knowledge 2021 registration is open okay get registered i'll share the i'll share the link so on the engagement task engagement template the audit task can be accessed from down here so if you want to know what controls you actually tested you would do something like g evaluate i'll just call this jvar control tests engagement id we've already got so this is the other reason i don't like jelly because it's like surely i've defined it there do i need to define it here and i don't know if i can define it up there and share it so i end up just copying and pasting and not really knowing um control tests i'm going to call this array control test i was looking at the hungarian notation recently it's already there i've copied it it's called control test ah because it's linking to issues right okay it's only getting issues that are generated as control tests not other issues look at that it's got top task i knew there was something called top task issue not blank okay i don't care about that i want to know what controls i've actually tested so i guess you would say state is not equal to skip to 7 i think that's closed complete if i change that to that's three seven is skipped yeah so not skipped that means you've tested it right if you closed complete i did everything i planned to do closed incomplete i started it but i didn't plan to do and skipped is didn't even start it i didn't bother didn't need to that's how i read those things so four and seven so i'm always rubbish at this is it not like does that work or you could do i've always rubbish at converting these two so it's not that and add or condition did anyone watch the creator toolbox where um i think it was chuck and andrew barnes we're trying to convert some stuff to um glide query i think that's a great way to kind of road test stuff you know take something that already works and see if you see if it breaks in the new way i'd love to see how glide query would solve this i'd love to feel confident in using glide query to solve that i'm sure that would be a bit easier or at least look a bit nicer but this is called control test while control test dot next i'm going to go array.push control i don't want to push the issue in there i want to push the is it item or is it called control imagine it was called control that would be amazing so here we've got a reference field that references the control guess what it's called control it's all control's not a task so it would never be apparent test plan references test plan i mean it just seems magical in here we want to say control now it's possible to test the same control twice in an audit engagement using two different test plans so if i wanted to dedupe this i can use a an array function or i could actually push it onto an object which kind of dedupes it along the way shout to courtney for that one um i not really not really sure um if that's what's intended but it's it's great you don't have to do an object.keys to turn it back to an array i like to do that but i've got an array there this isn't exactly going to print my stuff out because i then have to cycle through the array so why don't i do i even do this i've got a control test query why am i doing that let's just put control test and by doing that it returns it to this object up here so where do i cycle through issues if issue it broke out greater than this one which goes down to there nice it's just ugly man jvar issues jvar control test and this might be what james neal was saying you know this is not what jelly's intended for it works but it's a dark very dark art so that's testing it and that's saying wow next i don't care what the class is control test j market number yes short description description recommendation doesn't exist on control test let's call that control and get can i do get display value because it's a reference field control action plan has been added so it has been updated recently get message action plan assigned to that will work response won't work planned end date would work i'm not sure about all these that's a row okay so we've got table header table there the empty cells on purpose so that i missed something assigned to will work don't want just get rid of that bro jay bye she explanation doesn't exist so i can go i'm just going to save this and let's see if i go back to my engagement did you contribute anything on here what's your biggest challenges with with grc jace let's have a look setting up a ram still that's the one thing we haven't done so i'm just trying to check in yo satyaki how's it going i've missed loads in the chat so uh apologies let's just see if this engagement thing works um just going to refresh because i didn't really want to change i know it wasn't that i changed it was something else ah i need to select these audit default template have i got any control test first of all audit tasks yes i've got some although that's assuming top yet top task works let's generate reports do we see any control tests on here yep there we go control test controls empty did i not just let me check that quickly control test i put control i've got a typo in there why didn't no one tell me i haven't actually got that far down in the chat so you might have done let's just check this and do it again generate report that fix it control no didn't like it didn't like get display value control test get let's just do get value now it's good to get display value there it should work okay let's just check our data for example this one yeah there's no display value it's just it's demo data that works um you know export xml go to um hi dd dt that's like uh day day date time i don't know what it stands for uh you can modify the audit report template using a bit of jelly see it attach some updates to include it's not skipped complete needs a bit of tweaking i'm sure but you get the idea i hope how do we attach how do we attach add attachments you know if you're working on if you're on the community and you've got screenshots don't add them as attachments because you've got to download the file to view the attachment insert image and it will embed it through the wysiwyg editor you can just see it let's just um when i say that two downloads this one add so another story how do i change the audit report that's complete let's take a drink and i'm gonna just catch up on the chat so um let's just put this oh that moved what happened he might have just refreshed yeah satyaka sat satyaki um i did what i felt like i just missed the bit it's nice when the labels are the columns oh do you know what i thought satyaki was saying he's a fan of my work i was like wow thanks no he's a fan of jace i think we should all be fans of jace to be honest um the probe thing yes oh you think i've got the question answered things look good yeah the questions answered man this is the thing when i had the timer on i had like a pomodoro timer and i was saying um on my t-shirt sizes like small medium large um i can't find my small ones but a medium i said 20 minutes and to be honest it takes me longer than 20 minutes to intro the issue so um i was rushing trying to answer as many questions as possible and that really reduced the quality of my answers so here i'm taking the entire opposite approach and taking much longer than i should yeah thanks uh satyaki oh jace has added some stuff so let's see if we can figure out what jace added adoption you know what adoption i don't know who's i don't know if that was yours but i was thinking that that that was probably one of the hardest things to deal with purpose i think that's chase's i would guess that's yours jase um because i know we've spoken about grc before um processes and processes funny that that's come up twice process processes purpose so sometimes you use this mentee board to like try and bring ideas out from people and then you've got to try and join the dots up as well because you know if you're seeing process processes it's it's nice anyway like i said at the start nice to see that um anybody even entered anything on here but was that yours jay's purpose um what is the point of grc that's a that's a large one mate that's that's too big for this show purpose oh you submitted five you know what purpose i think process of processes was yours customizations not sure understanding process excellent yeah so i mean that is big these are big topics um but they're good ones and i don't know that i'm going to answer all of this stuff tonight so we're doing on time we've got well i my sprint is running for two hours where does it tell you that on this board okay it's just a guided board storyboard sprint planning if we look at my sprint um six done six left that's points why can't i see here we go yeah i'll give myself two hours for this sprint normally a sprint's two weeks not in this world two hours we've got um so i don't know that i can answer all of the things on the mentee but it will feed in i think it's a nice visual i'll share that as well um i've got a couple of things here hierarchy tree picker view not available if this is the risk statement one i think someone's already answered it and i just wanted to validate it so let's take a quick look yeah it should be like it's an out-of-the-box option so if you've got a reference field well guess what jace on the risk statement there's a field called parent right so there's a table called risk statement and its field is called parent guess what is parent references sm okay the table is not called risk statement it's called risk definition but that makes sense it's just been relabeled to risk statements you know there's nothing there's no rules on how long your sprint your beast like if you don't know any better and you've just started two weeks works i think two weeks gives the ability to get all the ceremonies in if you're doing them obviously in a one day sprint i mean you're only gonna have one daily stand up we could have hourly checkpoints and sometimes when we're doing hackathons a treat like each day as a sprint so i've got risk statement here it's got a parent field on there guess what parent references sngrc content but there's a reference qualifier okay so it enforces it but that is its parent class so risk statement comes from parent in that way that's the same as task but could the parent ever be something that's not a risk statement could it be a compliance oh look at that it's out of the box it is there maybe that's changed recently yeah i just think that's i'll keep banging on about how i'm gonna stop going on about it now it's not a real sprint though jason this is just asking this is just i selected a bunch of stories that a bunch of questions from the community and posted them as stories they're not real it's not real development i shouldn't have to build things each time but look here naveen it should be there out of the box on this statement not i think that's new i think that that wasn't always there so it'd be dictionary override risk definition reference qualifier column name yeah look tree picker equals true let's just check you don't always get a true view of this has this changed um show versions what can't i see why don't i see versions in here configure related list conversions is there but it's probably omitted if empty and therefore you have to go in through the list control because you can't right click on it and modify it now because it's not there sometimes that happens you lose you lose the versions if it's never been modified i think if we went back to an old version of risk it might not be there this is not only helpful it's correct but it's not my question so i can't mark it correct um thanks naveen just um just validated this is in here now on v12 not sure if it was always there so interested to find out from hp which is a cool name if you're talking about the source not sure if it was always there so interested to find out from hp what version i just want to use the right pronoun version find out what version hp is using boom i'm not going to um take any um i'm not going to take any uh glory for that one naveen answered this just validated it yeah even though nobody's gonna access my my instance um and check how we doing done three three out of three three out of six sorry three down three to go wednesday this time last week um i didn't do the live stream i did a premiere and i think i think last week's premiere is probably one of the most popular videos that i've had on the channel in the time available now it's not huge um for example if i wanted to monetize this channel i need to have something like a thousand subscribers and 4 000 hours of video watched in a year and i've got like nearly 20 of the number of subscribers needed and nowhere near the amount of videos but i got to about 120 views i think it was on on the video last week in a week i think that's my best performing video so far it was 18 minutes long i put chapters in there and i've just remembered now that i haven't put stream markers in so when i've done each issue i haven't done that so going back and putting chapters in afterwards is a bit of a task but i will i'll try and do that now let me just put a stream marker in right now um my my video last week was how to pass your quebec deltas um and i thought that might get a little bit of traffic um it's a little bit click-baity but i had some really positive feedback i think actually michael was tuned in um i think he he said it was helpful you know what did you think of the premiere do you mean the feature jace like using a premiere um or do you mean like what did i think of my own premiere like i haven't liked my own video if that's what you mean i use the premiere once just to test it out but because i normally stream around this time on a wednesday i was thinking maybe youtube might like me if i wasn't available that i still posted something and released it and it also fitted in with um like my obviously ever growing fan base that are expecting content for me each week now that i wasn't available i was having a barbecue with my parents in the garden because we're allowed to do so now um but quebec deltas i'd just done mine the day before and i thought hold on a minute this is something that's like i think people stress about and and obviously we joke about you know people posting on linkedin like past my deltas past my certification but it's obviously something that is such a milestone for people and it's very important so i wanted to just talk about that and just show people kind of how i do it and i don't really get stressed about deltas i i actually look forward to them i think they're you know don't even take that long really but i always find something out doing a delta and i think it's it's a great program um you can have a different debate about you know the the fact it's now chargeable um yeah i i i didn't hang out in the chat too much i had it on the phone um but i was like i had guests around but i was at the barbecue and i did just um commented in the chat a couple of times and i missed it because it was filtered on top chat in my phone and i wasn't logged in on on my phone properly um so how did i comment on the chat i'm not even sure how i did that anyway i realized that once i changed the filter from top chat to all messages i'd missed a load of comments from somebody so that was a lesson learned but yeah i think the premiere feature is good if you're going to do short videos maybe showing people that content is coming i think i used the premiere before to kind of clip out something from clip out something from an existing stream and then premiered it and that didn't really make much sense i was just messing around um let's uh switch it back to the screen and i just want to test this um where are we is it this one deep yeah i did a little animation before um i was messing around with that rj man if you're watching this where's where's my graphics you said you were going to sort me out some graphics and you went stone cold silent trying to retrieve indicator tasks for a control i think this is nice one because we can get a little scripting going on here and it's not jelly yeah if anyone's doing like graphics and stuff like that and want to get something on your portfolio you know here's a channel that needs some i want some lower thirds i want a little rolling i feel goes deep logo in the corner um yeah this is uh this is things i yearn for to make the channel better i've also i've got a little rest api on building js that was just the the api works i think if i hit it let me see let me hit it from this url i'll just do it on here boom look at that i've got three in draft three and complete so i wanted to connect that and have that streaming at the bottom like number of tasks i pass in the sprint id and it tells me the number the count of stories in each state and then that would be scrolling along the bottom but i never quite finished that in time and that's why i was late starting so that's another option let's uh close my console down tidy those things up and yeah javascript let's go copy this in over here why are you not copying there we go let's face the vs code let's take a look at the script let's take a look at the question uh what's the api for i think i missed the i think i answered the question didn't i um but yeah it's just a it's just a scripted rest api on my dev instance and then when i'm doing the stream i have a shell script that runs a python script that ingests the json and produces a text file and then obs accesses that text file and it changed live i did some messing around with it before yes yeah yeah i've watched some of them you know what i've got access to some of the um adobe suite uh creative cloud stuff but i just i don't have time to get good at that i'd love to be good at it but it's not it's not my area as much as i'd like to i actually wanted to do graphic design when i left school and ended up doing software development so i do love it but there's some people out here that are really good at it i was actually speaking to a uni student that's a bit busy with uni work that's coming up potentially going to be doing stuff so shout out to jimmy um if if um things quieten down we'll come back to that um yeah i i'd really like to just jazz things up a little bit but only with people's kind like a bit organically don't want to i haven't got a budget so anyway um i'm trying to inactivate child content let's make a stream of it oh thanks i don't know how to say i don't know how to say the name tr1 lux um need to log off but yeah thanks thanks you've been on for an hour and a half that's really nice thanks for staying tuned chase let's do it mate let's do it jace is off now as well um let's finish this thanks guys thanks everyone who's tuning in um we'll just answer this one last question we're an hour and a half um i'm trying to inactivate child content over control when a control is retired but i'm not able to fetch indicator task okay this is audit report but let's just do indicator task on here and i think somebody already answered this a little bit mark actually um so let's give him a helpful for getting involved yes let's do it chase i'm i'm up for that man trilux yes excellent i was kind of reading it like that but then i wasn't sure trilox trying your luck so something that might help would be a database for you so mark's kind of on the right lines here he's joining the tables up right so look look at this image item indicator indicator task but you don't need to do that because you're talking about a script here if you were trying to get a report of the data and display that and make it consumable from the end user perspective then you might want a database view i still don't think it's necessary because um like you said here sngrc item the thing is item is the base table so you can't always access the extended table so if we're talking only about controls and not talking about risks because risks is the sibling yeah over on that side or over on that side depending which way you want to put it uh this is an extension control has indicator control has control objective right has a kind of parent and control objective has indicator template so similarly to what we just talked about in audit where um a control objective that's kind of up here perhaps this is showing wrong because these are extensions okay this is an extension but this is a reference okay so from a data modeling perspective we would change that to a crow's foot somewhere down there yeah so a control objective has a control a control has an indicator a control objective has an indicator template and an indicator template has an indicator an indicator has an indicator task one or many and indicate a task and indicate a result have got an interesting relationship to each other because for it really depends i'll tell you what whoever designed the apis for the indicators i love it it's literally one of the i think best like the strategy pattern that's been used and the apis now that said there's a performance issue with indicators that we can solve quite easily by executing at the indicator template level um and not indicating every single indicator every single time like running the same query every single time and then checking it for the reference field we could run the indicator at the template level and then only like cycle through it and match against the indicators not a difficult change to make to improve performance but whoever's designed that strategy pattern is great if an indicator is a manual indicator that means the decision has to be made manually did this indicator pass or fail the indicator if it's a automated like a basic or scripted the result is calculated and decision made by the system so when it's manual there's a task the task gets assigned then when that task gets closed that generates an indicator result so this is like a staging if you like for the indicator decision for the indicator results and gives the ability for anybody in the organization to respond to um to that and it's great you know i'll give the example for customers to say um like maybe the security guard or the receptionist might do a walk around and check that the fire extinguishers are all in the right place um that could be an indicator task right yes or no is it passed or failed so indicators if i'm looking at a control when the control retires i want to deactivate the indicator task so you won't be deactivating the indicator task here you i'm trying to inactivate evidences i don't know what we mean by evidences because indicators and the supporting data they've got a passive relationship right it's just a snapshot of the evidence that generated the indicator is it's not something that the indicator is responsible for when a controller is retired so let's look at this okay so given you are already writing a script it won't be necessary for a db view but the data model that i never know how to say that quest here to demonstrate the relationships you need however what you are saying needs a bit more clarity because you when you say in activate and i'm going to say deactivating the indicator task this should mean closing it skipping it because it is a task whereas an indicator does have active flag that determines whether it will be executed again executed executed again so if you have deactivated the indicator no more indicator tasks should be generated if you have outstanding indicator tasks that belong to a control which is now retired and he indicates a task should now retire the indicator should no longer be worked on and it should be closed incomplete or skipped assuming that the script should be something like let's just validate this now i looked at this script briefly when i was copying and setting up my backlog i did like the fact that it created a function in here so who's the person that's posted this sorry uh prakash yeah i like this function i do take issue a little bit with some of the naming conventions but i understand it wreck wreck is a record you know i i'm a little bit anal on the naming conventions but this doesn't make sense from here mark inactive okay i thought i saw it being oh it's commented out deactivate test plans so you've got right so what have we got here this is a business rule on control right so when a business rule changes current item id is that's the control id this is telling you the class name if class name equals control okay you could do this with a switch let's let's just switch it up a little bit switch class name okay in case sn compliance control and this will be do and then we'll break and then case sn risk risk do break now we don't need a default really because if it's not one of those things then it doesn't fit our current use case if it's control or risk so actually you're ordering and sometimes i don't like this to drop through but in here you've got this so if we do it the other way around no this will work there okay with no break so control will execute this it doesn't break and it drops through i think it will drop through and run this as well but only for risk it will run this so that would deal with some of that complexity so we tidy that up mark inactive table field item table field item i'm not going to take too much issue but if wreck is valid good check nice defensive i would do it this way around look at that all the way down there hanging around get rid of that get rid of that and return false here and say if rec is not yeah if it's not valid then return false and then we can do that and just tidy our code up once we start enclosing brackets and nesting brackets fail early fail early that's what i say simple is that right record field item i mean you're checking that the tables are valid you're not necessarily checking that the query is valid and the field's valid but you're passing the field in you're also passing the table in so query while it's next add info message you're assuming indicator here uh get row count that's going to be the same row count every time rex set value active true oh that's horrible gi indicator task you don't need to do this i don't think well come on let's use camel case see that's that's the i do you see you got gr there i would have called this gr wreck if you're gonna call it rec right and when you've got a generic table it's quite difficult where do we have wreck before yeah so i'll do it that way but that's just me there's an update unable to deactivate gr rec dot get value number why don't you do item task okay indicator they all have number actually so in this case they've all got number that will work i like the fact you're using get message as well international uh localization it's good okay but this is for a task not for a test plan so that won't work for test plan so let's just comment that back out because that needs some consideration i want to get my indicators so i'm saying in here indicator mark indicator inactive well you've you're not marking the indicator inactive here greg dot set value i think i could did i delete it out of the uh the code yeah yeah set active true set value active so i use single quotes false right set inactive so here you'd be setting the test plan or the indicator to inactive that's great then you would say indicate a task why would you done an update there you got a query okay but you're not cycling through that query i would break this out okay there we are that's in their function here function close open indicator tasks and probably put the indicator id in there and i'll just put that in there don't need item id because there's a one-to-many on that picture indicator task belongs to indicator um you don't need item item belongs indicator belongs to item in fact i've got that wrong in that way because it belongs here which means it can belong to eva which is fine so there's no okay so now we're setting we've got something to update we don't need geo-indicated tasks or you shouldn't use get road count but i understand why you're doing it don't put it in the business rule don't put info messages in your business rule i know it's just for debugging purposes you can debug a business rule using script debugger uh grec glide record table add query if grec next while greg next set value let's just tidy this no okay it's because it's not embedded you know what gs add error message but you didn't put in here due to if you turn that into an array which one do we need to be there you can also say gr wreck dot get last error message i think that's what it's called due to error so if you're going to put that in that's nice to have that you attempt to update it gr rec set false and then you can say close open indicator tasks gr wreck dot get unique value and i would say if table there's a lot of different if statements going on here if i'm saying the negative here checking a string of you know a a set of different conditions i would string up a load of all statements and return false on a one-liner if i'm kind of doing this if and it's even if it's only one thing like here sometimes it just makes it a bit easier if you've got a lot going on a lot of nesting to just use those brackets even you know it makes it easier to expand on afterwards if table equals then close open indicator task for that okay which means that you could then open that back up yeah and it doesn't matter it's not if that comes through it's not going to try and close open indicator tasks so here we close open indicator tasks but we don't we want to add query we want a gr indicator task to add active query okay we don't start touching existing ones that are closed and we want to say query gr indicator task dot i try and remember here can you do this set value state seven skipped um let's just check this on on the instance indicators uh what we're doing opening another window have we got any that are not basic filter out yes some manual ones just be aware that i did potentially break this um potentially broke this look at that open tasks with my full flow project that was uh just a bit of fun it looks running every day state open okay so if i was to change the state to seven that's cancelled lovely and if i cancel it i don't think that creates an indicator result which is fine so let's look at script state seven cancelled you can't set additional comments using set value just do gs.get message just for localization purposes additional comments equals auto closure of yeah to be honest you could you could stack it that way rather than putting this in the script here if you've got a business rule i assume it's a business rule running on control that says when a control um when a control gets retired then deactivate your test plans and your indicators what you could then do is put a business rule on indicators and say when an indicator gets retired deactivated close all open tasks okay make sure you're using after business rules and that will allow you to put a little bit more meaningful information in here we wouldn't be trying to say well indicate a task i'm only passing indicator id so therefore i want that number you know i think in here we can do indicator task dot update multiple now i don't often use this let's return it's always good to return something so we return that that should work i'm fairly comfortable that would work so if i go to my indicator and i go to my control what's my control got has he got any test plans no let's create let's go to that's another control objective okay we won't do it right now let's just configure business rules and probably need to change scope to glc policy and compliance default let's just create create a business rule now here we are 155 i said sprint's gonna close in five minutes uh closure of sub records advanced do after make sure it's definitely happened after update active changes to false let's do state changes to retire that's a bit more explicit but um changes to retired boom in here execute rule doesn't like there yeah you see expected a break statement however i want to drop through okay i want that there it's intentional it's good that you called it out thanks let's see if this works and you know i said you don't need to put all your statements in fire up debugger probably got lots of i've probably got lots of stuff in there i haven't moved this one to in progress i'm not keeping my sprint board up today uh prevented me because i say question is answered me points i said this is one point you know i need to get realistic script debugger got my business rule i need to go back to my indicator now back to my control i've got a break point on there if i click retire break point is in my business rule has been fired that's excellent and then we can look at our runtime variables yep so switch class name has come in for control marking active it's passing in table audit test plan is valid add query what's field control item query while it's next there is none we knew that but it's dropped through you see that so it's going to run indicators as well so that switch statement with a drop through or password i hope i'm using the right term that will work let's pass in here okay oh we've got some set value to false on the indicator it is indicator close indicator tasks but indicator id add active query query set state i just don't know if this works hopefully that doesn't take me into the business rule on before workflows and so on because sometimes script debugger takes you down a massive rabbit hole and we really go deep and we don't have time for that right now the sprint's about to close did i click it sometimes i'm left wondering did i click script debugger did that work we're talking about 40-yard record so it maybe won't be instantaneous something's happening i completely forgot what i was going to do tonight as well i was going to do a live zoom um and actually publish the zoom id didn't work but yeah shout out to mike cook he's uh just posted on slack yeah thanks mike thanks for joining in on the show great to have you thanks for taking part in the uh biggest grc challenges um board i'm just waiting for this script to run now but sometimes this happens with debugger um there we go it did work right okay so if i just go back to my breakpoints that i was in was it a business rule close your sub records this one closure there there you see i haven't actually done the update so i'm all i'm closing tasks close an indicator task and then it might not actually let me update so at this point i'm yeah at this point i've now closed tasks i assume that's works it took so long but i've done this the wrong way around sometimes that click is a bit like did it happen i was going to play that out just click play okay while record equals next yeah that's going to keep coming back round isn't it i'm going to end the debugger that looks like it's working so on here this control gone to retired indicators gone to inactive that's not a manual one is it yeah that is a manual but it didn't have any tasks because they're not open tasks yeah the tasks aren't open which is good but i just wanted to see if i say sngrc indicator task dot list and order by updated universal request did you see that universal request that's requested something to look at um look at these cancelled it didn't push to the it didn't push to the additional comments did it additional comments okay so i didn't get my additional comments in there but it did cancel that works um i'm taking a drink it's wednesday in the uk it's 11 o'clock p.m 2300 bst it's british summer time it's time to wrap it up now and i think uh we're very low on on streams stream viewers right now anyway when we're doing insert code this one change it to javascript um however the closure of open indicator tasks before the update of the active on myself is wrong and i would even go so far as breaking out the function for closure indicator tasks to its own business rule on indicator um and it should work indicator tasks are different comments equals i don't think the additional comments then we're going to say that is complete so what have we done four out of four four done two remaining that's a success um let's just wrap it up tonight i'm getting a bit tired let's uh say thanks to everyone for tuning in um the themes that we got on the biggest challenges i think were very relevant great to have some people joining in um sorry jimmy didn't get to ucf uh you need to be on the stream i think to uh to push that up and just keep posting ucf ucf that would that would be huge there we'd have to talk about it um yeah this is community service so really focusing on um people on the grc community um trying to give back a little bit for for those people that are just getting up to speed um what else have we got to talk about knowledge 2021 registration is open um i've registered today creatorcon is going to be interesting shout out to raph who's doing something on the hackathon side for our team this year i'll wait to hear a bit more about that um oh actually i could i don't know sorry it's a different screen so a few things didn't get to tonight the rest api it looks like the next session is going to be or at least one of the next sessions because i've also got some other ideas i want to talk about natural language query shout out to justin loftus if you check out the up3 blog post um he's got the natural language search in his top picks of quebec that's i think the third time i've seen that mentioned and i just want to explore it because i never use it i just keep going to the condition builder and i know i'm missing a trick i think it's a game changer for customers there i want to see what's going on with that one um what else that's about it yeah let's try and keep it number one on the leaderboard for the grc community thanks to everyone that's keeping the community active getting involved in that any feedback if you want to get on the show if you want to get involved just give me a shout but otherwise take care stay safe and i'll see you soon you