okay good evening good morning good afternoon welcome back to the channel this is phil goes deep um and just going to introduce myself on phil i'm messing around with some new equipment tonight so um excuse the poor green screen situation that we've got going on i've got a lot of lights trying to figure that out and it's not working for me um so i've got a crease in the in the green screen but i'm messing around with uh a new camera that's got some auto framing um which is actually a very nice uh very nice camera but it's the the green screen that's letting me down tonight i hope the volume is okay i'll try and keep the uh try to keep the levels consistent however it is just going to 11 p.m in the uk so welcome back to the channel it's been a little while but thanks for joining me um get involved on the chat and tonight i'm going to start going through an app that i'm playing around with a little bit of a pet project i'm calling it discode discode for um discovery of code code discovery discodery i'm not quite sure yet but that's the working title i think this might play as a bit of a community app so if you think it's a good idea and you like it we'll see if we can get this opened up and shared maybe open the repo but just before i do that i just need to check a couple of things and i'm going to walk through some of it tonight i've just got it installed on my pdi um it's not the most beautiful uh set of code just yet it's a bit scrappy so i'd like to tidy that up really before i share it and anyone else suffers from some of the pain i've created um so what is discode it is uh an app that will scan an application look at the tables that are in the application and then look at the logic that's running on those tables and what apis it's calling so you know if it's if you've got business rules calling script includes script includes extending other script includes script includes calling other script includes ui actions are included as well um so i'll walk you through a little bit of that and just see if we can um add a couple of um extra features tonight but really just checking out also my uh new camera which i'm very excited about but i don't think i've got it tuned in just yet let's see what we can do if we switch it over this way yes so i'm down in the corner i'm not sure about that size if it's taking up too much space and i seem to have a bit of a line there so let me actually see if i can fix that a little bit very quickly i think that's just the crop maybe there okay don't know what that's like here if you're watching and it's it's moving around i also need to get the uh hackathon app that i built um in creatorcon installed on here and try and bring that experience into the uh into the stream as well because that's that's something that i looked at uh trying to do so yeah if you're involved get involved on the chat thanks for joining us and if you're watching it back just leave a comment like subscribe um all of those keywords let's see what are we doing disco so also i'm very pleased to say i've got uh the vs code servicenow extension attached to this uh this profile on on the machine so yeah been using it on on a different profile i'm very happy with it but basically i've got two two script includes in here and also i was watching i should link it i should link it on the channel but there's um i think it's called vs code 2020 or code 2020 um there's somebody that shares features for vs code and let's see if i've got this installed already draw io if you anyone's watched the channel you'll know that i i'm a big fan of um of durio um so having it built into vs code seems like a great idea when i'm using it in my day job then i am using it with onedrive integration and i don't think that works through vs code just yet so for the purposes of this channel i think it will be fine i'm going to try and use it through there because i don't use onedrive when i'm streaming see says it's okay it's installed excellent i've also been looking at uh touch touch portal which is uh an integration from your mobile to to things like obs but it can also do lots of workflow um so it's very good apparently for people doing video editing audio editing and so on but you can build macros into it and and kind of workflow your world whatever you're doing um and and specifically for obs but it will do things like sound boards and change scene transitions i couldn't get it working so far but that's another thing that i'm looking at so if you're if you are a streamer or even if you just want to workflow your life in some way make life easier you're doing repetitive functions you know something like touch portal if i can get that working i will be trying to bring that on to this as well just to save me clicking around and changing over here if you see me looking over here this is my control screen okay so i've got i've got joyo installed so if i go like this draw i can create a new drawing diagram and i don't really want that stored in there i don't think i want it stored in there i'm just going to call it this code i don't know whether storing files that are not service now files in this location creates any problems i'm not sure but yeah how nice is that so what we've got is is core and i like to i'm not using core bass um and and bass just yet i've just literally just fired this up so i started building my functionality but then i've got the concept of of scan okay so what i was thinking um design wise is that um scan abstract is like for all scans maybe scan core but if you look at some of the strategy patterns for things like indicators in grc then you'll see like you've got indicator abstract or indicator generator or is it profile generator item generator abstract strategy i think it's called so abstract is like applies to everything and then what i thought we might have is something like scan business rules or something like that scan script include but obviously each of these will have that scan script include would have kind of core methods in there so things like run would be called and exists at the base level but down here it will be extended and overridden and then be very specific to how it looks at script includes so that's the kind of api um if you want to see the table design this is also i think very nice you know talking to a few people in the community about this idea for discode and one of the current benefits as it stands is that all of the tables that i'm using are extended there basically it will take any object that it finds and it will create a ci and therefore i'm able to leverage the dependency view so it will build the ci relationships um that means that that's really where the power of this app is is like doing discovery if you've let anything loose on your infrastructure before where it goes out into the network into the data center looks at the devices on the network finds a server looks what apps are running databases what's talking to what etc and brings that into the cmdb and allows you to visualize your infrastructure um that is that's really what we're doing here but inside the platform very specifically for applications that we that we point at it so yeah that relies on for that to work it needs to have cmdb based tables cmdb base tables are also listed as exempt from the madrid licensing model so that's quite important from um from the perspective of licensing custom tables etc so whether that makes it more attractive i don't know if if this is something that um you know servicenow customers really want or if this is something for the developer community it seems like some of the developer community that are customer based might have an interest in this so let's have a look let's see what it's doing but this is some of the thinking around the design um and does that just save if i command s i think so where's that stored there so does that change color if i move that a little bit does that tell us that it's changed no okay so scan abstract extends core okay core has got uh i like to use constants for tables if you've ever built an app and then had to for some reason change scope then going through all your glide record calls and looking for those tables and trying to replace them is pain that you don't need also it saves you having to remember um or type out a long name although that's not such a problem yeah this is this is what i started doing a while ago and yeah constant table and metadata so i've mimicked also the the existing table structure for cis metadata which is the application file so this allows me to have a table which represents the application file and that's extended then into script include business rule ui action and table i've used more friendly names i haven't matched you know you can see here it's not called sysscript syscript include um cis ui action or cis db object this could go down to the level of fields as well we could actually go down to the level of methods in the script include but this is an opportunity to move to fix regex you'll see some of uh some best practices are not being followed right now so i have got some hardcoded sys ids just to make this work okay i haven't put any comments in i'm not using glide record secure i've just really got this working so core is my kind of base where i definitely want to store things like my constants table maps yeah basic basic functionality that's completely central i also like to put in things like ignore that that's not that's not good that was an idea um get gr okay so i like to do a get gr just to save a little bit of functionality and then what i do is so for instance get ci business rule that's going to get and i pass in the constant therefore my function only passes in the id because i've said what class it is i just need the id so um get gr get grci from source yeah i'm not entirely pleased with with this code it's a little bit sprawling um come up with some ideas as i was going along hopefully hopefully it's not too far from where we need it to be okay so let's see it in action i've just installed it so i don't even know if it's going to work on this instance but one of the things i was thinking is to have a flow that scans regularly and therefore have a property of scopes that it regularly scans just to keep it up to date i'm also wondering whether things like cmdb baseline would be interesting so if you've changed the script you've changed the record in in some way that you can kind of see a snapshot of it over time so cmdb baseline and cmdb based on diff might work oh james sorry um just looking at your message in doing this are you not technically misusing the cmdb tables no absolutely not they're configuration items right when you've got um you know i'm not running any logic on the cmdb so it's not like building tasks on cmdb i'm not trying to avoid um licensing right this is my argument and uh let me know if you think this this is flawed in any way but when you're building an application your application is made up of configuration items tables business rules um everything that's on the application file is a ci okay it's a configuration item so therefore it's just represented in the cmdb i don't think it's misusing the cmdb at all but i just saw your message a bit difficult to see the code so sorry i've got this set up for myself not for streaming actually so let's just cut that over there hopefully that's that's a bit better hopefully the volumes are right i don't know how the um i don't know how the video is because of the the poor green screen so um yeah draw io hasn't gone too crazy in there but that's what we're doing let's have a look at it then so i've got it installed um i've got studio up and running so these are my tables they're all prefix ci ci application file etc and they because they all extend from ci application file anything that's core and going to be useful across them i can just add to this table and obviously inherit it into my my four sub tables right now one of the things i've got is this field called basis metadata okay that's a reference to the application file so that gives us always a reference back to the file in question so um yeah let's let's watch it work so how do we call it obviously i'm gonna use explore not least because it allows me to execute from from in code and what i need to do is new scan abstract dot run i think just from memory i built this on the weekend so i'm not quite sure how what the entry points will be so that's why i'm saying a flow might be the entry point because you would potentially want to scan regularly i don't think it's something that anyone wants to go in and type code to run but where would you do it would it be a ui action on a business rule would it make sense i think we scan from the application level so i'm just going to go to scan abstract run yeah so we take string scope so the string of the scope name let's also just look at the application files at the moment so nothing in here nothing up my sleeves okay i'm gonna do one of my favorite applications the profiles application for grc and i'm sure the the code can be optimized in some way i'm not triggering it asynchronously or anything like that but that's another reason to maybe scan it in the background let's see how long this is probably one of the bigger tables and i've just added some regex into it recently that let me see if i can find i thought i'd put here we go i just dropped him down here on line 144 so i was using explore as well for for the regex and trying to trying to um tune it okay so that's worked got some stuff right let's just show for the purposes of the regex argument um so if i go and grab i haven't got any glide ajax in here new class yeah so this is when it's extended so if i paste in so i had this idea quite a while ago and i really i hit the hurdle of um regex it kind of scared me i think i was trying to take on too much but if i grab um i don't know indicator engine bass and just grab that code and paste it in here you can see that it's got in my output i want to look at my match groups so glide date time glide date glide record glide record okay so yeah this was for me trying to get hold of not just the glide record but if it's glide record then understand what tables are being called as well so what i want to do is take this a this um regex and try and get those values and know that my code is calling a glide record to a table and connect that relationship as well so um yeah so at the moment james i want to get this tidied up i want to just get proper clearance that i can kind of release this in into a repo and really the the questionnaire is what scope it goes under i think the the concept of this is is going to be fine to share um but yeah that's what our plan is is just get it in a public repo and see what people um think of it and and contribute seems like it hasn't got any business rules this can't be right said it created some stuff have i it's not running anymore slowed the instance down doing something yeah the that's the idea though the the repo would be um i think the best place so okay basic indicator strategy we'll see the relations here okay level three business rules if we visualize this now there we go so which one did i yeah basic indicator strategy so basic indicator strategy is extended from basic indicator strategy base okay and that is called no extended ah indicator strategy that calls it yeah so grc utils i'm not sure i've got parent child always the right way around here and also what happens if grc utils calls basic indicator strategy and basic indicator strategy calls grc utils that will create a circular reference and and i don't think the cmdb will will be too happy about that so to be honest i haven't encountered that yet but if i expand whoa wow what have we got going on here so these business rules are calling grc utils i mean some of the conversation i was having was trying to um consider the risk involved right so if you were about to make changes to grc utils obviously viewing this in this in the cmdb dependency view you can see that this is this is going to be scary but potentially that scale of relationships could come up because if i went into script includes and i said okay i'm gonna change this script include grc utils like something could come up here and tell me that this this api is being called by 83 sorry 83 business rules or however many it was let's view the map from from grc utils 84 business rules are calling it let's expand those so i think some of this is is quite nice to visualize how things are hanging together um what we've got here so we can see the assessment new tools what it's not doing at the moment it's not walking too much so when it finds something it doesn't then scan that so that's the kind of i'm trying to think of an apologies if you're getting any background noise of a dog snoring it is my dog um so apologies so uh yeah the concept of a node i think is in terms of naming the apis and trying to you know make this thing you know i'm calling it scan abstract i'm not really happy with that name it needs to kind of have the ability to jump over to the next node work out what that node is and then scan it and obviously that's going to be recursive it's going to keep jumping and finding stuff and it could easily get into a mess i've got one thing in it at the moment that is doing that so if i go to scan abstract at the moment i'm calling it script includes a ui action scan business rule to script include and i believe somewhere in here one of these are called it calls itself so yeah look at that so scan script include to business rule when it gets hold of its its parent it then loops back through and calls itself again yeah to be honest james i haven't thought of how to handle risk and measure risk you know that's that's um yeah so james is saying would you not want to automatically give it a risk value example low medium high yeah quite possibly quite possibly i haven't i haven't gone there yet i've literally let's look at it from a table perspective if i go to sngrc indicator as a table you can see that this table extends this table okay and expand that so from a table perspective i can see the business rules that are running on here and the ui actions where are the ui actions so if we view it by group maybe you can see all the script includes talking to each other and the ui actions down here i don't think that's the best the best view radial not sure been playing with a few of the layouts and obviously as well you can increase like the levels i don't think that matters for me right now but you can also build in here some some views and come up with some custom settings you know focus on ui actions from a table um you can filter ci's by relationship types map indicators so i haven't done anything with that i think oh it's not brought in actually from the the instance that i built this on i did create some svg uh some svg icons for tables so i wonder if they got picked up is it called map icons yeah i wonder if they're if they're in here and the value just doesn't exist i thought this had oh that's the icon ci type that is the dog no okay so that that hasn't been picked up that's data i needed to add that as an application file perhaps so i did give these a different logo so a table i don't know was just a database i had like um some brackets for business rules and a whiteboard or something for um for script includes to try and imitate a class so yeah we're talking about adding risk values automatically we need a way to determine what that risk is right is it the number of cis is it the number of business rules is it relative or is it explicit so yeah i don't know i think it's the possibility is there and you know you could also start to connect in the update sets right because if you know that that record there i don't know ciui action you know what that record is so if we view form that takes us to the ci and looks like i haven't actually done the the form on the ui action yet so let's just do that quickly i think what i should have done is set the form up on the base table and then it would have inherited the form to begin with and it might not be too late to do that but what i want on here is base basis metadata and ci cheers james yeah it's late there mate it's late here so it's even later where you are so all the best man thanks for tuning in and uh yeah i'll keep you posted um stay safe mate let's have a look i'm am i going too far have i missed the formatters yes ci relations but this baseline diff um i wonder if that is something that could be useful no bass lines exist yet so yeah my point is the ci ui action just represents this application file so we know what this application file is which means based on the class of the record we know how that would look in the sys updates yeah in the versions so we could connect in you know that's an element of risk if someone else is already changing it if there's multiple changes against it see we've got has role there that could be something that we scan for we know where the roles are being used what what access does a certain role have based on the acls based on the conditions based on the scripts so that that's something we haven't really considered i say we that's the royal we so maybe we create a table and we'll extend ci application file i'll call this ci let's just check our naming conventions yeah okay so prefixes with that anyway so ci um roll and that should extend ci application file we'll create a module for that we don't need any columns to start with because it's going to get our our base our base in there so i think roll might be quite interesting and i'm still not sure on the entry point like where where would you want to trigger your scans from is it a flow with a property of the list of the scopes that you're scanning do we have a table that records our our scan schedules or do we just create scheduled jobs i think if you're going to create scheduled jobs then you should just create a flow so we've got ci roll so the first thing we should do let's then see how this works so in the course script come in here c table roll there and then i do command s to save command shift p now sync current file i need to learn that that shortcut says shift shift alt command sh yeah shift alt command s lovely okay so that puts my table in here how do we scan for roll and also what relationships do we have so we need kind of like what do you call a relationship so you say has access to accesses has access to something like that i'm trying to make sure that i'm using completely like custom relationships so i don't want my relationships to get messed up with the rest of the systems even if there's one that already exists by the same name because that will allow us to to kind of rename them so ci relation types so the parent will be if we say the parent is the role has access can access has access to accessed by and you could even read write like can read can write can delete something like that so uh just created that one so i'm going to copy that cis id okay so i'm just hard coding them for now so c for constant relationship id access all right we'll do so what we're going to do to scan it so i'm in core so putting them in core makes them available to my scan you can see when we run it based on scope we create this object of of source files okay that takes care of creating any any record we find we create the ci for and then it's all kind of contained in an object that gets processed the design of that object is not not perfect right now that's what i'm kind of working on so class will be so process source file i think is in core process source file so do i need to define my new scope anywhere or does it just yes it gets ci business rules so what we need is get ci roll okay and then that will be c table roll and that gives me access to the ci get ci from source create update ci from source set relationship we need so we'll set relationship access and that will be access so it all starts some of this is like i feel really nice like this structure makes sense and then when i start getting down into some of the weeds of it i'm not so happy with some of my methods so it does need to last i started trying something down here but um yeah some of it just makes sense some of it i need to consider again grci set get gr source so get gr source where's that called from down here create yeah object table map that's where we need it's this thing okay so i've put this no scan option in here okay so we've got the table record but we won't scan it that's how we deal with the scanning so is it cis user role what's the table name sys underscore user role dot roll dot list yes okay says user role cis user role so yeah you can't call a you can't call a constant from within here at least we couldn't when i was first doing it maybe you can within an object now so again something that might get tidied up so what do we care about on the roll table is name is it actually name yes name name so that will work for us that's all i'm doing that's this allows us to this table map here will allow us to say this table so script include business rule ui action i want to take the name fields the value of the name field and put that into the field on the ci table by this name so name name is just working right now but as we expand that out we'll take maybe in fact yes not in here that the relationship map stuff so i think it's in the scan abstracts when we start scanning a table an extended of the table it's not using yeah it's using superclass and there's another thing it might be business rule it's using collection script contains condition contains um not sure where it is so what are we doing we're scanning roll so where will roll have access to table i'm just going to call this scan roll scan roll to table i guess but then we would also you know scan role to ui ui action lowercase i think that's what i've done elsewhere yeah um where else do we condition roles i mean you can do it on business rules right on condition so i'm not going to try and solve everything right now let's just scan roll to table so we've got something with table in and this is why i want to think about the the kind of concept here but where is their commonality and where is there things that are just completely unique and you know where does inheritance where his inheritance at his best so that's something that i'm kind of mulling over but we've got here scan okay got scan table scan table the business rule scan table to ui action let's just take this at the top scan roll scan roll to table we take gr source in class name source id search string i'm not being defensive here i think i have done it yeah look i've put this in into most of them now just in case that gets called directly and another thing i've started doing is um all of my scripts include methods i just prefixed them all with um underscore so i make everything private privacy first i'll make everything private and then i expose those methods publicly when i know that that's how i want somebody outside of the api to interact with it so when it's talking to itself it's all private that does create potential issues for overrides because if somebody overrides the public method but that's that's something they'd have to do if they're overriding something um to think about so what's my what's my string okay what do i need it to be so i also need to so i've got a role that's the thing coming in so gr source is my role okay and that's going to give us the role there so let's just check this sngrc dot um user yeah okay so that's how we expect it to look and roles have inheritance right as well so we probably want to see that because you get access because you've inherited so we definitely want to see some inheritance in the role map as well so actually scan role should have here um extension scan role extension scan role inheritance probably is a name so just comment them out for now scan roll to table so we get the name that's going to be the role let's call this string roll name that's just a little bit cleaner because we know what we're expecting in there roll name so our target is table so that's cis db object it's actually not it's acls right we want to go via the acls in this example so acl let's think about an sngrc indicator so it's not it's here access roles cis security acl role and is that a reference yes so we're gonna go to the acl roll and the acl okay i need to think about this so the access control contains records a type record type record so hcl role add target query is going to be cis user role going to be source id okay source id because that's our role don't think we need this string roll name so this will get us all acls for that role but i want to get those were the acl just show that this is security acl type this security acl dot type is record now it might have a dot you might have a dot it might have i think after let's look at issue issues got a bit more complex issues got more complex acls in it so this just starts with but yeah it starts going down to field level okay so we want the records we're going to query we're going to get this our parent id is our role and that doesn't need to happen excuse me that doesn't need to happen inside the loop i've done this somewhere somewhere else as well that means we've got the parent the only problem is you're doing it here even if you haven't got anything in the table so that could be unnecessary you might want to test it has next on this you know as this scales up performance is going to be i think very important so we definitely want to look for marginal gains and that could be something that's a marginal gain but what we don't want to do is call it every time we loop through so so what is our relationship going to be roll has access to table so our parent is our role that has access to the table therefore our table is the child so that's going to be cis db object but we don't know at this moment in time so var string target table name equals gr target dot i don't know whether it's get value because so in fact var gr acl equals gr target dot a the hcl from here that's a reference field that gets us our acl so if we do this dot get ref record i'm not sure does that work as a parameter so if i did that there does that take in it doesn't look like it takes an input so i think it has to be that way around so that gets us our acl so our string table name no string acl target equals gr acl dot get value name i don't think we need to default that just get value uh array acl target equals string acl target dot split we want to split it on the dots okay and if not then base array that should work anyway so then our table name is going to be array acl target would be the first value or we'll just give a blank string there in case it's empty that gets us our table name our table name will be then what we can do is child id sysdb object so at this point we've got our target but we haven't looked up what we want to do is look up the table by name yeah that's getting the reference that's still a reference to the table this is this script i'm just looking so streamless looking for things against the table what's it not happy about something here it's telling me off about my rejects okay i'm not worried about that um have forgot anywhere where i look up so name table get source file object so that goes through all the all the tables get array tables to scan it gets me to tables and scope yeah at the moment i don't think i have a way to actually get the table from from its name so if i go gr table equals new glide records cis db object gr table dot get name and if i just went sngrc issue what would i have here issue that looks pretty legit to me i'm not sure it's robust i'm sure there's going to be some things in here that when we're trying to do patterns and consistently access things this thing's just going to fall down so i'm going to say get table from name as a function yeah function i'm going to call that string table name default format always beautify so there we go okay so get table from name that means down here string target table name i can say rgr table equals this dot get table from name string target table name string target table name that gets me my table var table id equals gr table dot get unique value and therefore that becomes my table id there which gets me my ci sorry these headphones are just a bit too thin from for that part of my head there that's um yeah my ears my ears are actually too big for for headphones especially ones that go over the year that's why normally i've got these they're nice very comfortable for about an hour and then they start to hurt so what we got table id child id so my parent id is my role turns out i don't think i need string role name not really relevant um unless for nothing other than just noising up the the logs i use gs ad info message only because when i execute it from explore it doesn't leave any footprint in the log so i just want to see something's happened and just get a feel for it all of that stuff would come out so we're checking now have i got a parent id and a child id after all of that have i got a parent id and a child id and are they kind of different from each other that avoids a recursive circular reference on the relationship table but i don't want to set relationship execute i just want to say set relationship access so if this works if this works then that that should generate some role records and some relationships to tables i'm not sure that my entry point is completely solid but scan roll which i love the name of to be honest with you okay we're not actually executing business rules that way around this should be a switch obviously sis user role keep capitalizing our cis user role then i'm going to scan role doesn't like it because of the commas scan and gr source is coming in so object source file gets process source file which gets all the gets an array of the objects so array of the tables that are not scanning and then goes and processes them scan roll should should work so commander s command shift o s no there we go sync does that just save if we do it i guess it does okay let's hit it up where's my where's my scan one gone it's going to stick with smgrc right now because we didn't have any roles in there let's just reload i want that new application menu for um ci that's what's under this code yeah ci rolls nothing in here right now let's let this loose just on the scope so it took 46 seconds last time that was the first time it ran um it should be a bit quicker the next time around because it's not creating records or relationships but it is checking each one of them and it also doesn't have a way like it doesn't decouple them i'm not populating the last discovered date on the ci as well there's there we go that looks good so did i rename the message when i scan abstract scan roll scan roll to table that still says execute hmm says no changes that's funny you have to save first wow that might not have worked then let's just run it again yeah last discovered some of those core discovery features possibly my reference id to systematic data that's good to have the reference to application file but correlation id might also do the trick just to put a cis id in a string field don't know if that's of any benefit can you see anything that says access down i don't think it loads all of them by the way no error type oh type cannot find function get unique value in object false so i'm pretty sure that's coming from get unique value on here get table from name string table name because i do a get unique value here so that's where that's failing line one one two let's go before that let's see what's happening because i've not debugged that part of the code at all is there a way it would be nice if my object doesn't kind of commit itself to everything every time but what if i just wanted to do just one small part of it so the object method uh the the approach to that source process source file object it's all or nothing at the moment and also i'm just only allowing it via a scope name and does the whole thing so there's lots to to think about on that just need to fire up the debugger and that should be enough so i'll just let it get to that point what i should have also checked actually just like did it create some and not the others i'm going in a little bit blind right now but let's just see what it does the first time you know it's going to break on the first time it goes into that function so it should be interesting to see it what's the time well it's gone midnight in the uk so if you are in the uk or in europe then um happy tuesday so we're at this point what have we got already string target table name okay i don't think we're capturing that table yet so this get table from name that should work yeah that works table id works okay so string source is our db object source id yeah that should work so get gr from source what's our table name it knows it sysdb object grci we're going to go and check does that table exist says it does the grci says that the assessment instance table has been mapped that's that's good to know because then we are you know we are getting some kind of core functionality there which is important i feel like that failed then no it didn't okay sometimes when debugger kicks back so like like so quickly i feel like something went wrong and i missed it so let's just look ch child parent they're different set relationship access that should work i'm gonna check first do we exist we do exist because it's run once already okay we're going into the next one so this is interesting we've got here the acl target so audit advanced observation dot action plan i never actually saw what that was last time so we definitely want zero target table name okay i'm gonna step over that yeah does that get me table id gonna play it the next time meant to step over it table id is working grc task so what was my array okay let's see that works grc task table id do you know what is it actually far in so how does it know what his table id is gonna be before it's got there does it change so what's table id dcd0c3 yeah it changed interesting i thought each loop round it would start it again but it's kind of holding on to the values so that's so advanced evidence response advanced issue triage advanced issue triage evidence response indicator template issue assessment scope and advanced risk evidence request advanced audit advanced evidence grc tasks that's remediation task advanced issue triage you'll see advanced evidence response remediation task compliance authority document risk assessment instance glc issue so you know this is it it's building up a kind of view of all of these tables that you might not otherwise have kind of known we're talking to each other or relevant and quite often you start exploring things and you go down a rabbit hole i think that's kind of where this um where the idea for this channel started actually is it's not not just about kind of going deep and um you know yeah getting lost going in a rabbit hole that's quite possible to do if you just do the table name dot config i'm a big fan of that so it's a great way to understand what's going on in your application but sometimes it's difficult to kind of zoom out so i'm just watching these tables feels like this thing's working i'm just waiting for a string target table name i'm waiting for something funny to come in there which means that my table id which means my glide record for table will will fail but they all look very legitimate oh vowel entry interesting vulnerability that's where it's failing is it because i haven't got that table on my instance but there's an acl for it okay that's where it failed so if i go back to explore we'll see maybe an error message down here yeah so you know one of the one of the key things here is is about defensive coding so how can we make that defensive basically if no gr table we could just continue okay which will go to the next loop um that means if it's false but we could also say if no grtable dot is valid records just in case it kind of holds on to it from last time shouldn't hold on to it from last time that should get us returned false so that should be okay so let's put in here that some acls are created for tables which do not exist eg sn evolve something so we save sync i'm going to keep debugger um turned off and just see if i run this again do we get any errors i'm just going to i can't get rid of desktop so i just want to get the rolls in see if this works then i will just look at it on the map looks like yep undefined okay we don't actually return anything in our in our run i don't think oh we do return but uh nothing gets returned in here i do always think it's worth having a return especially for run think about that from the beginning of like you know from a response perspective you don't have to do anything with what comes back but it'd be nice to know some kind of report on what really happened here and return objects rather than returning specifically strings you know return an object and then you can extend it i've got an example at the moment where i've built something that i'm quite happy with quite proud of and now i want to expand on it which means i have to change the return so the thing that's already being returned is being accessed and everything's been consuming it but now i want to at the same point return some additional stuff so an object is best placed for that and i should have thought about that from the beginning really okay so what we've got here that's a bit of a that's a bit of a weird role name there sngrc dot sngrc system admin is that is that real cis user roles says sngrc okay okay not sure i'm sure i'm too pleased about that um let's configure do you know what i definitely should configure the base on this i think it will inherit when i create a new table if i change the the base form layout that should that should work let's do two things i want to put the base on there most recent discovery i'm going to start putting that on as well ci relations cr base diff i want to set this last discovered date as well i want to start setting that in the moment i want my roles i want to deal with the extensions as well that's one thing i'm going to do because i feel like i'm in the flow of roles right now but grc user grc reader should have some should be should have some acls look at that that's not right that road doesn't cool that's not right what's happened here oh is it because ah because that level one has access to that's interesting actually yeah so if i've got access to these tables and these tables are able to execute so they need to be validated right you would depends if the condition fits so this needs to be qualified it's a bit noisy right now but if you think about it that run layouts let's expand yeah we definitely need a different relationship for right read wow so i don't think the re i don't think it's right that the reader just because the table can execute the business rules that we kind of suggest that the role can execute things because they can't yeah so you wouldn't be able to click those buttons well okay so sn grc dot admin yeah that's got that's got pretty uh interesting let's um let's just look at it from an issue perspective the issue table yeah you can see the roll there roll roll roll and it would be good that um no users over here so notice like the manager grc manager isn't included in here but the grc manager inherits user okay so yeah we need to we need to get these records um has access it should say read like crud basically create read update that needs to happen because this is this is misleading i would say um but let's do the role inheritance let's do roll inheritance because i think that will be good so we've got scan roll to table this scan roll inheritance so if it's inherited you've got a role let's have a look at the table structure because we do we want to go both ways on the roll upstream downstream inheritance that contains roles have we got the manager we must have the manager let's just go this way to start with so this roll contains roll contains roll cis roll contains so scan role inheritance is a function that's going to take in grc source contain equals new glide record i've gone plural there because it's not plural of the item it's plural as a there's a word because contain would seem wrong the table name is in the singular but it is in the appears to be in the plural but i don't think that's plural i'm not sure what to call it grammatically but add query okay so our source is role and that will be our source id and if we take this you know our class not sure why we want that so we get our role grow contains dot query rgr roll contains dot next um grow contains.next what are we going to get we're going to get the contains is a reference to the role so var string roll contained id equals let's do it that way we'll get value contains which is actually that's our target if we were going to use that's what we should have called it's gr target actually if we had done it that way anyway so our parent id again parent id when we're looking at it from a scan perspective that grc source gr source is the same parent id so parent id here because it's our ci so we have to look it up or create it and we're looking it up and then going back out and looking it up again so this way it's self-contained the other way around it's um yeah not self-like it wouldn't stand alone it would need it to be passed in but you know i'm just thinking about from performance so we get our controls this child id will be this one oops whoops yeah yeah look at that system the object creates yeah that should be class names that's why class name exists up here and it's not table id it's roll id and we put this in i want to get the extends one that's not checking for see code is so inconsistent between here that one funny how the extends doesn't have it let's just take this one i can change the i can change the wording okay so extends roll files open so roll id roll name sorry call name's not even coming up i don't even want the error info message in there now set relationship extends extend i think i should change this gr target this target id source target right there so we're only going down but that should be fine uh the other thing is for the extends where we've got recursive here so this dot scan role inheritance gr target and that is recursive as well should we do that at the end it's gonna roll inheritance let's have a go let's see what happens and whatever happens now we're gonna wrap it up so let's just see what happens if we get some roll inheritance in here then that's that's a nice thing shout out to james foot thanks for tuning in tonight mate i saw a few other people did did come on the stream but didn't get involved oh cannot read property table from undefined that's so dog's been a bit noisy um having a scratch so line 110 let's just see we can fix that what have i done wrong ah scan role inheritance cannot read property table from undefined scan role inheritance where's table coming from then create updates here i wonder if if i go and look at the dependency quickly and just look at sngrc dot manager um i only want to see roll in here that work doesn't look like it's applied so what's gone wrong what's gone wrong see i can't help myself in here line 110 it went wrong there you definitely need to be able to just like just scan a specific part of of of the application just scan tables just scan roll this this item coming that way that that also needs to be considered i think but i do need this oh debugger it's triggered isn't it no no it's just taking ages okay yeah i do need this to just get through but i just want to take there we go scan so what's going on gr target is valid so table name works there parent id ah string class names this user role contains is that what it is it's because we're scanning a table uh when it first comes in gr target is not okay so what it is gr target dots contains so role is contained so target ids contains so dot contains dot get ref record and let's oh grow equals if gl roll that's what it is because i'm passing in assist user role contains gr target is not the actual glide record of the roll itself so actually just turn that off and shoot from the hip i'm not sure i like the way the the camera zooms in on me while i'm drinking my water should zoom out and give me some yeah we don't want any i don't want any bacon sani moments that uh green screen is still not great up here is it this bit i've got the uh camera on portrait mode so um doesn't give me doesn't give me the kind of the ability to use my hands when i'm talking but looks like that's been successful therefore if i look at grc i'm gonna go admin yeah look at that so the developer let's um yeah so you can see here that admin gets access to these tables but it inherits the manager role which gets access to these tables but inherits the grc user role which gets access to these tables and this role and this role probably if we increase that i don't know yep we see that that right there has got access to those roles so um wow that that has i think that was one of my more enjoyable results actually business user role so i mean i just i could just spend ages studying the findings of this obviously that needs to happen to to to kind of um to validate what's going on but i definitely think we need to distinguish between just has access to right so what i'll do i'll go in and kill all those relationships create four new ones so it'll be called access create access read access update i think that will be a bit more interesting and we'll separate some of this grc manager 55 tables not shown look at that you've got here this table ah what's this what sometimes it doesn't group it no hmm yeah that's not a bad view okay let's wrap it up let's wrap it up so no that's not what we wanted hold on hold on no not that way this one okay yes thank you for tuning in tonight thanks to james for getting very vocal on the chat i enjoyed the participation it's very late in the uk it's even later in europe and it's even earlier in australia so if you are tuned in from down under good morning and yeah we'll catch up soon i don't want to mention what's happening um on wednesday evening uh in the uk at 8 p.m i'm just gonna do that just yeah so hopefully uh next time we speak we'll uh have still be smiling still so we can hope for but i hope everyone stays safe and thanks for joining us any comments any thoughts you've got just add them into the comments hit me up on sn devs on the slack channel grc community in the uh servicenow community forums where else um yeah that's probably probably the best place oh shout out to casey i forgot i've got a big up casey for the um sn devs uh slack sticker so where should that go maybe that should maybe that should go there i'm sure i'm not going to ruin my mic is it it's only the only mic only cost 20 quid um maybe that's where that should go just not sure what angle it should probably go the same angle as the service now yeah yeah shout out to casey for getting them over much appreciated hmm i'll have a think about that well i think that's probably the best place for it yeah shame about that about that logo shame about the logo uh thanks thanks casey sndfs.slack.com um yeah obviously check out the developer community site as well rome's coming as well so lots of things to look forward to but right now it's time for bed so um stay safe and take care thank you you