okay good evening ladies and gentlemen welcome to phil goes deep this is the grc irm full flow series part eight and i do not quite know what i'm going to cover last time i got a bit uh involved in the grc utils so somewhere between grc assessment utils and grc item generator i think we're going to continue to convert the grc application in servicenow into flow designer i set the challenge of trying to do this within 24 hours each part is around 80 minutes long which means that there will be 18 shows and this is number eight so there's still 10 remaining if i continue i'm not sure if i will do this all the way through i think i did this as a bit of a discovery and i've learned a lot along the way whether it's worth continuing or not i think i'll decide in in a few more hours time but until then i'll just keep coming back each week apologies i did not schedule today i just turned up and thought i better start doing something so links in the description my hair's still pink it's not october anymore breast cancer awareness is over but i have raised nearly 1200 pounds i've got 68 supporters there the link is still in the description and as of tomorrow in the uk i don't believe hairdressers are going to be open so my hair is probably going to stay pink for a little bit longer but i'll continue to grow out the mullet and we'll see what what it looks like in december not a priority right now but do check out the link in the description if you are interested spread the word and make sure you get yourselves checked okay it's very serious um it is going to be into movember now and i won't be trying to generate any sponsorship directly but i probably will share a link with you um soon i don't have the luxury of being able to grow a moustache properly so let's see what we can share on that but definitely um men's health women's health all very important right now back into the detail we have so far converted indicators issues issue grouping and grc utils there's still a bit more to to go so i'm going to i think start with assessment utils so let me share my screen and i will just talk you through this diagram briefly so how we convert over into flow designer we look for those calls and then we review them create actions and then create sub flows and flows and then go back and and replace those calls i did think about something after the show last week that in a couple of cases i have converted script actions and made the script action called the um called the subflow but that script action is getting called from a ui action so actually we could bypass the script action and go straight to the subflow technically speaking that's probably what we should be doing but that occurred to me after the event so i hope the audio levels are okay they seem a bit better in my ears i don't have that annoying buzzing um so get involved on the chat i've also got a link in the description to the service now community and i've got version 11 of the grc apps running on a paris instance so i'll fire up flow designer and we've got a blank sheet of paper here for grc assessment utils let's see what we can see if we go to the script includes and apologies as well if there's any background noise uh it is going to be fireworks night tomorrow in the uk so some people are celebrating that early all right let's take a quick look at this api grc assessment utils and i'll tell you i think a good way to see the different places this is getting called is to do a good old code search i'm using ms code search available from the share site we've got nine nine business rules one ui page one ui action and a widget okay one widget let's just take a quick look grc assessment list get assessments okay so that's not a flow don't look to convert that but ui action ungroup assessments this will be good one remove from group ah so the ui page group assessment gets called from a ui action so you do the ui action against this is uh consolidated attestations or groups grouped assessments you can group a number of assessment instances together and you do that from a ui action from the list choice and that is client caller board and fires up this ui page and then that ui page is obviously processing that so i guess you could pass from the processing script you could call the subflow from a ui page processing script so i've not i've not done that before that might be an interesting one so we have a ui action which is group i'm just going to put here group assessment that calls a ui page um the ui page is then calling for our results so that's grouping and then there's ungrouping so i'll just think about those script actions sometimes the script action is used to maintain um the asynchronous state from a ui action so that you've clicked the ui action and then you click the ui action and you don't want to sit there waiting for that response so it just chucks you just get the ui action just to chuck an event and the script action then picks it up and processes it asynchronously but obviously with flow designer we can trigger flows asynchronously so in in some of these cases i was looking at for grc utils you can just get rid of the script action get the ui action to just call the uh subflow asynchronously and that's effectively what looks like we're going to do here the ui action we're going to call remove from group current so these are two actions and flows to create let's just see where else they're getting called just check okay grc assessment client utils that i assume is an ajax script just because it says client in there client callable extends ajax so we'll be touching that one assessment new tools the one we're looking at base is the one we're actually converting and then we've got nine business rules so assess risk and clear response info have to be careful some of these are definitely in the right scope actually so yeah these are business rules coming from policy and compliance risk management this one's good cancer assessments if draft retired and it's after cancer assessments if exempted sounds policy and compliance-ish delete assessment results this business rule that's before anyway um this business rule doesn't make sense to me delete assessment results because it gets default item assessment which is the only one based on the name it doesn't make sense because you have a property called grc at a station which sets the default or this is your default attestation on you know out of the box it's the only one you've got but then it only deletes results if you match the default assessment this bit i need to come back to this at some point i'll probably post on the community about it and raise an idea because this is um it has never quite made sense to me that one but anyway it's a before business rule we can't convert that mark control is compliant if effective that's policy in compliance remove from group if cancelled that one sounds profile yeah that's profiles but that's before so we can't do that one update children when parent is complete that's profiles and that's asynchronous how nice update item and assessment complete after excellent so we've got three business rules that we can we can actually convert here so let's just start at the back this one it's gonna call evaluate assessment results this one is calling copy response ah it's a group right so when to run if it's attestation risk assessment state changes to complete grouped assessment is empty is empty but response type is not empty i just want to flag the fact that that one's async um update children can cancel assessments if draft or retire so when you move the control or the risk back to draft or retire cancels the attestation or the assessment nice um let's get the call in here well this is a bit more interesting so i'm just thinking if we what are we doing here so we're displaying messages does flow designer this flow designer i mean i've got a demo one in here doesn't flow designer does flow designer able to post messages servicenow core because i know some of it will run in the foreground is document templates generate pdf well i've just stumbled into a whole new world generate pdf document this is not what i was that's blowing my mind i'm i'm actually looking at stuff around this at the moment and i did not know that was in flow designer so that's caught me off guard okay let's do a little test here um we'll do a little side we'll do a little sideshow because i want to know i haven't got anyone live anyway so if you're watching this back um hopefully this is useful i want to know can i post post message let's say that post message um i need a new i'll need a new category anyway let's do i still keep it in grcu tools okay so i'll get an action because in my action i want a script okay and my input i'm going to call it a message and that's a string and it's mandatory and in here i want a variable called string string message my value will be message from my input and i'm going to do a gs.get message inputs dot string message so i'll get a message here and then geostar add info message string message now what i'm wondering obviously with get message we can pass in inputs i'm still not great at handling understanding how to handle objects that aren't kind of predefined in some kind of schema where it could grow if if you want to be handling things like glide records if you look at how generate issue works that way of passing in a dynamic set of fields if you try to do that same kind of thing in flow designer now the data type seems to be tripping up on there i might just have this wrong so let me publish this i've got an action then if i then have do i need a flow can i test this action hello run test so i guess there's no choice there it says run test in background just refresh it's not sitting in the cache somewhere hmm so business rules business rules that are passing messages back can't seem to cope with flow designer why am i looking here so gst add info message not possible is it possible just not doing it right hello came in yeah that came in here string message you can see let me just check one other thing as well do you want to check keep pressing on key sorry i can't see my keyboard okay let's just put an exclamation mark on this save that and test that well i didn't get a message on the screen action's been executed viewing script or text that's great that we see the text but i want to see the run time value hmm so if you've got a business rule what i'm thinking is that you will want these messages so you could tr you could make this bit go off the flow designer but then what's the point that's all i'm wondering i know i can make this happen from flow designer but what's the point let's find let's see let's let's do it i'm not convinced that the value here and this is why i'm not sure if i'm going to continue with this series much longer if i do eight episodes and i've got to um once get my calculator out let's have a look what is um i can't do that maths in my head because i wanted to go 8 times 80 is 640 and divide that by 60. 10.6 yeah so three episodes is four hours so not episode number nine would take me to 12 hours halfway through and i could just blindly keep going and like here convert everything out of kind of kind of stubbornness if you like but i i i'm questioning i am questioning some of the value here i know i haven't done anything other than profiles this is cancel cancel assessments it's called cancel existing assessments actually cancel existing assessments let me just get that script step in here current is going to come in current is okay see current if i go to assessment utils okay i'm just reading this comment i've not read this uh there is a comment in here supports below two group types this function group creates a group of assessment instances so that user can take all the selected instances using a single ui page consolidate this function creates a consolidated group of assessment instances the user can take only one set of questions and after submit answers will be copied over to assessment instances metric type is default group by can be further grouped by item content or sngrc profile now sebastian posted on the community recently asking a question about this so i'll see i'll see if we can figure it out yeah so that that's item so what we're passing in here is an input is item effect here as an input is item and this is a reference to sngrc item which is control or risk that's mandatory an item here is going to come in there let's call that gr item and this will be inputs.gr item now does this return var total yeah so let's put output dot total equals new grc and here we create a variable called total and assume that's an integer let's put in here a default value of zero and then our output is going to be total total integer and exit mode map that into there publish that as an action and you can't oh hold on a minute so i can just call actions directly i think i got a bit confused with this and i was triggering the subfloor you don't even need the subflow in some cases then why okay i'm just thinking about when so if you if you look in here conversion steps you know i was saying we'll always create the action we always create a sub flow so if we're going if we know we're going to create a flow we would create the subflow because that means we've got the ability to trigger it from business rule etc but actually you can trigger the action from here i must have missed this i must have missed it so let me copy i don't want the whole thing i'll get the try catch if i go into here i'm going to say var total equals cancel existing assessment current boom then has to be inside here function cancel existing assessment item yeah oh that's that's nice the way it produces that comment whoever built this code snippet part of flow design is very good now var total equals outputs total i just want to then return total there if i return total there that's my function my function returns total i total up here and we're executing synchronously we can get rid of those lines we don't need notes because this might have errored i don't want my error down here it's going to throw the error but i want to make sure that i still get a value that can be processed as expected so therefore where's total used yeah if that came back as null it potentially caused a problem so because i want it to be an integer i'm going to default it that's made my business rule a bit bigger there let's try this out how are we doing on time half an hour in so have i got some controls yeah so this one's in a test return that to draft i'll cancel one existing attestation and therefore in my flow designer if i look at executions just now control 2004 should be the one that we can see coming in as our runtime value i even tells you the cooling source triggered from script that runtime value 204 that's lovely you know what that is lovely the only thing for me is that it's a lot of overhead from a scripting perspective to plug that action in and clearly i've got outputs i want it to run synchronously because i want to communicate what happens to the user and there's no use there's no um no glide system messages available from moving flow designer so if i want to post these messages i have to use a business rule but i've got that debugging powerhouse of flow designer here even tells me where it came from calling source ui action return to draft not strictly true is it because return to draft is what triggered this business rule so that's not strictly true let me open the context record see what we can see opening operations view okay just learning my way around open action logs nope nothing in here oh good evening if you just tuned in just having a little click around in flow designer i've converted an action um i've converted a business rule which cancels assessments from a control when the control or risk moves back to draft or moves to retired it will go and cancel the assessment however this business rule communicates a message to the user and we can't trigger that message from within flow designer itself so what i've got is the business rule making a call directly to the action not to the subflow directly to the action so that worked and when i look at this i can see that the ui action is is labeled as the source but it wasn't the thing that triggered the action directly the ui action triggered the business rule the business rule called the action so all i'm thinking here is if you've got layer upon layer you lose a little bit of visibility and i noticed this last time in episode 7 where i [Music] expected that i had a flow a sub flow and an action so when the flow was triggered i expected that all of the context of the flow would be in the flow and the subflow would be in the subflow but actually that sub flow never showed us having an execution against it so it's almost in my head i'm thinking that it kind of compiles the action subflow and everything up to the flow into one runtime and then the flow executions are kind of stored at the flow level which for me took a little bit away from it i thought that if i go to this action and look at executions i would see all the executions and what flows they'd come from and when but at the moment it seems like it's all kind of baked baked into the flow when it runs so that's what i'm learning but effectively that business rule which is so i'm also i'm converting i know a couple of people just tuned in i'm converting the grc assessment utils api and i've done this one cancel assessments let me just get a copy of my action i'm in two different windows for flow designer which can't be good cancel existing assessments in there so i'm just going to flag that let's add info message uh the next one update children i closed it let me see update children when parent is complete update children when parents complete this one update children so it's just one that runs async yeah nice the only thing that's not nice about this when i look at converting it is the it's the number of conditions but it's not a problem we'll go and create our action now what's the call copy response copy response this is going to be in the assessment utils and i'm looking in here for copy response oh it's called copy response and then it calls in copy response to children assessment i assume is the glide record yes of the assessment okay no problem copy response and that's got a return in there no no return that returns blank what null so uh copy response our input is going to be assessment and this is a reference to the assessment instance table mandatory and we need a script step copy this out here boom and my input is going to be i've got an extra s in there haven't i right this is just a request for anyone that's writing code if you notice a typo and check for them please if you notice a typo go and correct it don't just copy and paste that throughout your code because when people are trying to work with your code or read it or in fact trying to extend it they then have to replicate your your typos when you're doing peer reviews look for typos it's just a request i mean optional so there's no return in this copy response no return publish this as an action i did say in the previous one i'll convert the subflows directly but questioning the value and the sanity of that decision so i don't need this one open i'm just going to go straight into a flow now and this is update children when parent is complete if you've just tuned in give me a shout on the chat and just let me know make sure the audio's audio levels are okay we need these conditions for this business rule asynchronously on update so updated assessment assessment instance lots of filters in here i just going to say for every update because i don't want to miss anything i need to check the docs on this i need to be very confident uh this is going to run in the background that's nice extra options in here when to run on current and extended as well so you don't automatically inherit the functionality but you can if you want very nice stuff so metric type evaluation method that's easy electric type what can i type here typed on the other bit evaluation method is one of attestation or risk assessment and i'm going to check these in the other window so risk assessment and state is complete and grouped assessment is empty and control risk is empty and response type is not none any other conditions now i did notice interestingly that the order on the business rule is a thousand which means that it might be trying to compete with workflows might just be because it's asynchronous and we want to make sure that it does run well after everything else just don't get caught out by that so i've got my trigger and my action is profiles assessment copy response i'll just pass that assessment record in and activate the flow so therefore i need a grouped assessment in fact i need to turn the business rule off it's not that one where's the business wall gone what was it called update children i just realized when my business was gone i moved it to a different window so i could can copy the conditions over ah there we go this is it i had a bit of a late night last night watching the news so i think that's taking its toll what i want then is my controls if i take these two they don't have an attestation but they are in draft so that's good yeah let me attest these unless they're attached to control objectives i shouldn't have just done that i just found a little back door there list editing attestations control objectives yeah let's do it properly there we go list edit on attestation field on control should be restricted i think and you can do that either using acls or list control just configure list control here and therefore see list edit type disable this editing but that does it on the whole row on the whole table um if you do it with acls you can lock down just that field and say that field cannot be list edited so that's quite nice if you want to do it that way uh move these three to a test then i'll go to my attestations got three of them let me just group them same response doesn't really matter same response is easier to take i'm going to say no fail because when i submit this then my flow designer executions just now is queued in progress complete run time five seconds but you know i can see the script that ran in here but i can't see the run time of the script it would be really nice to be able to see okay what was what was that value at the time there's no way to see that i don't think but you do get times in here so you can see when something took a certain amount of time but it worked and the business rule was deactivated so that's another one off the list copy response and this is a replace to a flow just map these across my color coding's gone as well not them as green for some reason my text has got a background car okay um how we doing update item when assessment complete yeah i i am uh it looks like the stream might have paused so apologies if you get any interruption there you see the lighting looks a little bit out on my background my stream back yeah 49 minutes which means you've got half an hour remaining update children when the parents complete it's done i'm just wondering and then if anyone's involved or wants to get involved on this really is it worth continuing here is there anything that i've you know i'm going to write on my responses i've got this article on the community i've posted some findings but i need to take a little bit of time and kind of digest what i've attempted here because i think i've proven enough to know whether it's worth doing there were a couple of areas of grc that i'd never quite got to do which maybe i'll do now because this might be the last one it might be part eight might be the final the grand finale so when from a control objective when i map entity types to control objectives lots and lots of magic happens and this all comes from the m2m tables and this is not the only mtm table so the control objective to entity type table is not a real m2m table and it's extended so the actual table is called sngrc m2m content profile type so content is extended to control objective and to risk statement and citation but citations aren't mapped to entity types so this has a business rule that runs on the base table several business rules if we just look at the the profiles app generate links is the main one okay so if i look i'm just tidy up some of these tabs that i know you can't see them uh generate links delete links i think in for i can see here when to run so before before these are out of scope anyway so ignore those these create item generation record okay so we've got generate links delete links and gen create item generation record um good evening for the new users give me a shout on the chat and see what's happening subscribe to the channel as well um i know when i've watched other channels they say that subscribe to the channel and i don't know where that button is but if you do like this stuff get involved i will be posting more things around grc irm it's very there's there's a lot to come in there's lots going on and i think with that in mind this full flow series may have reached its natural natural end so delete links generate links generate links is the main the main puppy here and so i think that we can replace generate links quite nicely with a flow designer and get greater visibility so what i don't i don't know about this but item generator you've got your m2m so you've got your entity type to content which calls generate links okay you've also got from policy it will be entity type to document okay so this entity type table here if i configure all on here we've got generate links again it runs asynchronously so this can get a little bit tricky when you're mapping things at high volume a lot of the time things can get a little bit overlapped and a bit stuck and you can't see what's going on so my hope was that converting this stuff to flow designer would increase the visibility of of those things but it doesn't change the api that's being called it's called generate links so what i'm wondering if we've got so this is from the document table document to entity type which is extended into if you think about this these m2m tables this is entity type to control objective this is entity type to risk statement so the table structure here so these tables are extended and this once a document is extended so entity type map to policy entity type map to risk framework and it's the business rule on these two tables which that extend logic extends into these ones so when you map an entity type to a policy it triggers this which then maps the entity type to all of the control objectives that are attached to that policy and then each one of these calls this generate links and it cascades the the mappings to another m2m table and then that m2m table triggers another one so when it's running asynchronously it can get a little bit caught up in itself and equally it does a generate item generation record you've seen it there create item generation record but this runs after so if you've got asynchronous processing this is why sometimes the sngrc item generation table ends up with some leftover records and it's been happening for a number of years and never quite got solved it's intermittent it's not really reproducible but from my experience happens at high volume and it's just the nature of asynchronous business rules i think but my hope is that maybe moving some of this into flow designer does increase the visibility in the traceability so you can explain it when it when it happens where else does generate okay we haven't done done this all by it's all by hand by memory let's just go what other where else is generate links i'm just going to do that to make sure it's talking about the actual method where it's getting called from so we've got five business rules there all the same oh alrighty this is the this is the one this is control objective to risk statement table last associated but look each time it just calls generate links but generate links here is saying if new so it's expecting a return which means that that runs so the business rule runs asynchronously but the call to the api doesn't where's generate links i'm in the wrong i need item generator engine which i haven't downloaded yet let me go and get it script include uh item generator base let's go let me convert the type to javascript and we're looking for generate links and actually look it does that get method so generate links is the generic entry point it does return get method see get method should be returning a method it shouldn't be calling the method it returns so if you look at the indicator framework you've got indicator strategies in it says get strategy then gets run here you get a method depending on the method it's calling the script so it's not really getting method is it and none of these are returning so it's got to try catching here are just in a class name and here catch actually it's not handling the error um as in it's not dealing with the error it's saying what if you if that errors it must be this that's quite a novel use of try catch for me um right generate links so it's checking here are you an instance of and that's a custom method within this api but basically did you is the table that you're on did it get extended from the document to profile type which is entity type so is it coming from policy or risk statement yeah is it generate or delete an operation get method operation comes in here okay so generate just passing i was worried there that the business rule carries the operation i don't know if business if flow designer has access to operation yeah what to do try and convert some of these now so i'm just thinking about all the different end points that are going to call generate links so if we look there at the code you've got document type let's get method is instance of sngrc content content to doc right so if you map a control objective to a policy or if you potentially map the risk statement to the risk framework then that should cascade the generate links there is going to go and attach the entity type to the content records directly content to profile this must be the new table additional entities let's just take a look at this i'm not going to convert these tonight i think that's a bit too a bit too much of a bigger job i want to map that out and understand it but this is so maybe episode 9 if we roll it up to 12 hours um round it up and we'll do generate links on the next one this table i did the wrong way i did the config on there content to entities yeah so if you attach an additional entity which again is a lovely feature so additional entities here if i open that in a new window content to entities and actually they haven't bothered extending that they've just kept that generic so i bet this configure the table that's pointing to content that's going into yeah it's called content and you know what this naming convention is beautiful right it's a reference field and it tells you the field name is the table it relates to there's no question what that might be the only time or at least a scenario i can think of for instance the incident table you've got opened by assigned to caller um requested for i think comes from catalog items you've got three or four different references to the same table there with different contexts so actually calling it the table name as a blanket statement doesn't work on this m2m table structure it does work so absolutely on them to him and that naming convention makes perfect sense content to entity what else have we got in here that's content to profile profile to profile type so let's imagine then that we've got our entity types mapped to all of our documents and content so we've got a map to risk frameworks risk statements mapped to policies control objectives we've got controls we've got risks we've got risk statements control objectives all mapped to each other which is then generating the links between the controls and the risks for the same entities we've got a few additional entities out there that shouldn't make any diff put a pin in that one then my entity type is running every hour the scheduled job is running every hour to check my entity type so if i said all critical business services and i've got three critical business services and then i add in a new critical business service within an hour that new business service is going to be generated as an entity and guess where that's going to live that entity is going to get mapped to the entity type when you create the record there equally what if you've got a manual grouping of entity types and you manually add it in at that point you're generating links so for everywhere that that entity type exists that new entity needs to permeate and go and create new controls new risks and new risk to control mappings where appropriate instance of profile type so hmm it's not checking here so basically saying if you're triggered from a profile type then delete links so where does that get caught then how can that get called against that record type i did a code search didn't i generate links some change screens generate links 10 minutes left on the show people so be good if from here you can see what it was that's risk statement ah hold on a second i'm jumping to conclusions so just because get method so delete links let's just check that because that's calling get method and that's probably where it's coming in from it says if content comes from entity type it can't be that one no hmm no idea when that potent that particular flow could have happened if it's an instance of a profile type i have to look into that a bit further but hopefully this has been helpful for you to see this in detail if you haven't already explored this api the item generator engine base the thing is just exploring this and looking at the code you might not you know you need to see here i think a little bit of the architects you need to understand the data model and the extension model that's been applied to the grc table structure for instance as i say the m2m tables are not real m2ms and the reason there is because of the extension model so the fact that entity to document gets extended into policy etc etcetera the existing data model as well around is ngrc item content document the way those get extended into the relevant control risk statements policies frameworks etc when you when you have those things you want to start joining them up together there's a lot of data interconnected and it needs to keep track of itself so you need to see the code and see how it's kind of handling it but you need to also understand the environment quite well and then i was hoping that maybe moving it to flow designer will enable us to visualize what's going on a bit more so i think i'll definitely going to do one more episode i was thinking tonight might be the last one um just because it feels like it was kind of stagnating and i wasn't sure if i was achieving anything here but this is actually one of the main areas that i want to get into it's one of the main kind of it's like a black box right you can't really see what's going on in it you know it's happening the other one that might also be useful is the compliance score roll up because that is also running asynchronously you can't necessarily see that happening and where it's happening so maybe there's kind of two definite use cases that need to get tackled but this is in terms of grc profiles this is core entity scoping is one of the main conversations we have with customers when we're talking about their grc implementation if you can't understand the entity structure within an organization you're not very easily going to be able to deliver value for for grc so this is um this is pretty core stuff but it's also pretty heavy so i think i want to give that the time it deserves i'll give that another session today we just did a little bit on assessment utils but to be honest this is not this is not um i don't feel like i'm learning anything i know i can convert ui actions maybe the ui page we didn't answer that one processing script that's a new one processing scripts called from ui page uh sorry um actions subflows called from processing scripts within a ui page let me type let me type properly there uh so that's a question um on this one and in terms of learnings today i learned that you can call an action directly i thought you needed to have a sub flow but you can call the action directly and when you do so it tells you kind of what the first end point was doesn't tell you all the triggers along the way but for instance a ui action triggered a business rule and the ui action is the is the kind of starting point that's reported in the in the execution so some good learnings there not a total waste of my time i hope it wasn't a waste of your time apologies um for my slightly lackluster um kind of attitude today i am a bit tired i apologize um for that but it's it's been good please join in on the community um in the conversation on the community let me just do this yeah please join in on the conversation on the community join the grc community it's getting very lively in there if you are a customer reach out to your account manager and speak to them about road maps okay there's a lot i'm in from service now speak to your account manager if you're um just learning grc go to the community look at all the content that's available ask questions but before you ask questions on the community just do a little search because it might well have been answered um what else can i say yeah shout to all the team um in the community uh in the servicenow community shout out to all of my team um all of rangoo and um sending some love to all of your families and my family as well so i'm gonna leave it there and i will see you in part nine but thank you very much for watching subscribe like comment etc stay safe thank you you