Archer Reporting - Reference to same Application
I have the following szenario:
We use the "Security Incident" Application and there exists the possibility to correlate "Security Incidents" (one Security Incident references to an other Security Incident). This field is defined as "cross reference"
The records looks like this:
Now I want to generate a report, which i would use in an Archer2Archer-Feed, where the Security Incident Status is not resolved (this is no problem), AND where the related (Master) Security Incident Status is resolved. I would need the IncidentID of the not resolved Incident and then several fields from the related master Security Incident (see picture below).
But in a report, i can't create the relation from one Security Incident to the related Security Incident, because "Security Incident" is not listed in the "Add New Relationship":
Has someone an idee, how to solve this issue?
- archer reports
- Community Thread
- cross reference
- Forum Thread
- RSA Archer
- RSA Archer Suite
- Security Operations Management
You won't be able to use this with Archer's reporting, as you have discovered that you can't add a relationship between an application and itself. You would be able to use a Data Publication and then some other reporting tool, or the Archer API to accomplish what you are after.
Additionally, if the reference to MASTER Security Incident is single select, you could build calculated fields to pull the data in through the internal reference, and then just report on the one level.