How to clear open rule violations that are not cleared even though the rule has been deleted in RSA Governance & Lifecycle
2 years ago
Article Number
000071664
Applies To
  • SecurID Governance & Lifecycle 7.5.2
  • RSA Governance & Lifecycle 8.0

 

Issue
  • Open rule violations are normally cleared automatically when a rule is deleted but in some instances orphan Rule violations associated with the deleted Rule may remain. 
This is resolved in all current versions but rule violations may exist from a rule deleted on a previous version. 
Resolution

Please contact RSA Customer Support and quote this article number and attach the below query output in the case.

1. Run the below query & check if the deleted rule is available in the record set.

SELECT * FROM T_AV_RULES WHERE IS_DELETED='TRUE';

2. Run below query to check if open rule violation is available in the result.

SELECT * FROM T_AV_VIOLATIONS violations 
left outer join T_AV_RULES rule on violations.rule_id=rule.id 
WHERE (violations.STATE='OP' OR violations.STATE='OE') 
and rule.IS_DELETED='TRUE'; 

or,

select duwv.id,duwv.account_name,duwv.user_ent_id,
duwv.exemption_id,duwv.name,duwv.resource_name,duwv.action_name,duwv.app_name,duwv.app_description,duwv.app_classification,duwv.app_sensitivity,
duwv.app_business_use,duwv.app_ownership,duwv.app_locality,rm.*
from t_av_direct_uents_with_viols duwv
join t_av_duwv_rule_map rm
on  duwv.entitled_id       =rm.entitled_id
and duwv.entitlement_type  =rm.entitlement_type
and duwv.entitlement_id    =rm.entitlement_id
and nvl(duwv.account_id,-1)=nvl(rm.account_id,-1)
join t_av_rules rule on rm.rule_id=rule.id and rule.is_deleted=upper('TRUE');

3. Get the distinct rule_id from any of the above queries where record has been found. Make sure this rule_id is the same as which was verified in step no 1.