Question Re: EAM - Best Practices in Additional Q&A

EAM - Best Practices

leos — Thu, 21 May 2015 12:53:08 GMT

G'Day All,

I would like to draw upon your collective knowledge in regards to the best practices that needs to be adhered to while implementing/using firefighter (EAM). I acknowledge that there is already an abundance of information as to the technical side of the things here on SCN, so to be specific I am more interested in:

Identification/Justification of usage of firefighting (what truly qualifies considering this is a form of Mitigation Control)
Firefighter Log Report Review
- Workflow
- Audit trails
- Archiving
Key Tables related to usage, tracking and audit purposes. For example:
- GRACFFLOG
- GRACFFCTRL
- GRACFFREPMAPP
- GRACREQ
- GRACREQOWNER
- GRFNMWRTAPPR
Anything you deem necessary or encountered that is worth sharing

Regards,

Leo..

Re: EAM - Best Practices

alessandr0 — Thu, 21 May 2015 13:03:07 GMT

Hi Leo,

first of all.. welcome back 🙂

Regarding your post... did you check my process documents for firefighters? Maybe they are helpful for an overview.

http://scn.sap.com/community/grc/blog/2014/03/03/firefighter-id-lifecycle

http://scn.sap.com/community/grc/blog/2014/03/07/firefighter-id-user-assignment-lifecycle

Also check the documents regarding mitigating controls and internal controls:

http://scn.sap.com/docs/DOC-53355

http://scn.sap.com/docs/DOC-56548

Looking forward to your feedback.

Cheers,

Ale

Re: EAM - Best Practices

leos — Thu, 21 May 2015 13:27:37 GMT

Thanks Ale. I know its been quite a while 🙂

I did go through all of the documentation under EAM in your useful documents section and I read these last year but I shall go through them again.

Just quickly though, how does the third option (Log display) of Notification method for the Controller work? I know the other two (Email & Workflow) but how do Controller's get/check the logs using this option and can they approve/add comments etc?

Cheers

Leo..

Re: EAM - Best Practices

alessandr0 — Thu, 21 May 2015 15:43:37 GMT

Dear Leo,

log display means that no automated notification is sent to the controller. The log can be seen in the reports in NWBC.

Hope this answers your question in short

Cheers,

Ale

Re: EAM - Best Practices

leos — Fri, 22 May 2015 06:27:48 GMT

Thanks Ale, appreciate it.

Cheers

Leo..

Re: EAM - Best Practices

alessandr0 — Wed, 27 May 2015 07:38:50 GMT

Dear Leo,

I will provide a document regarding the audit trails from a high level perspective in the next days. Therefore I will move your request to the collaboration topic (hope you don't mind).

Cheers,

Alessandro

Re: EAM - Best Practices

leos — Wed, 27 May 2015 16:08:53 GMT

Sure Ale, please go for it.

While you are at it, can you specify what's the ideal/recommended escalation time for FF log reviews please? I mean given the importance of it what do you reckon makes the ideal time. 24-48hrs sounds reasonable but then what happens when someone logs in Friday evening or something?

Also the frequency of the background jobs (log collection and workflow sync)??

This isn't just pointed at you, anyone's free to chip in.

Regards,

Leo..

Re: EAM - Best Practices

alessandr0 — Thu, 28 May 2015 06:18:51 GMT

Dear Leo,

regarding the frequency I would recommend to run the log sync hourly. Escalation time depends pretty much on your definition.. and as far as I have seen in several companies it is different from one company to another. Personally I recommend to set it to 3 days (72 hours) as this should be an acceptable time frame for a controller.

Regards,

Alessandro

Re: EAM - Best Practices

leos — Thu, 28 May 2015 07:17:26 GMT

Thanks Ale. Appreciate your feedback.

Regards,

Leo..

Re: EAM - Best Practices

Former Member — Thu, 28 May 2015 12:40:49 GMT

Leo/ Alessandro,

We have our incremental syncs scheduled for hourly except for the portal sync, which apparently takes several hours to run. (The others are all a minute or less.) If you have to do a portal sync, I suggest scheduling it separately, after you see how long it takes in your landscape.

Gretchen

Re: EAM - Best Practices

leos — Thu, 28 May 2015 13:05:19 GMT

Thanks Gretchen, appreciate your input on this.

Regards,

Leo..