Significance of few attributes in ZAP report alert - security

Could someone explain or provide a reference around understanding of following attributes in ZAP report alert:
Instances
Reference
CWE ID
WASC ID
Source ID

Instances
Depending which output your looking at this is either a count of instances where the alert was identified, or a list of the impacted URLs.
Reference
URLs that point to additional related material.
CWE ID
The relevant "common weakness enumeration" identifier (https://cwe.mitre.org/)
WASC ID
The relevant "web application security consortium" identifier (http://projects.webappsec.org/w/page/13246970/Threat%20Classification%20Enumeration%20View)
Source ID
The identifier of the active or passive scan rule that created the Alert.
1 https://github.com/zaproxy/zaproxy/blob/develop/docs/scanners.md
Further info:
https://www.zaproxy.org/docs/desktop/start/features/alerts/
https://www.zaproxy.org/docs/desktop/ui/dialogs/addalert/

Related

Detect an Invalid User Attribute Field entry in OIM and send email notification based on the user type

I am required to create a Java Script but unable to figure on how to proceed as I don't have that much of coding idea in OIM, can someone assist(below I have mentioned the scenario)
Scenario:
In OIM User Attribute Page, there is a User Field: 'Job Code' now we have experienced that there are some issues we are facing.
From the trusted source we are getting the correct data but as soon as it reaches OIM for few users we are getting random incorrect value. Value should be numbers (123456) which is present in the Database too and valid but for few we are receiving values like E?401#q something like this.
We are required to place a check to find users who are having these invalid Job Code entry.
Once detected, we need to trigger a email to the concerned team based on the User Type (Employee or Contractor) for employee it should trigger an email to a respective team and for Contractor we have to trigger to a different team to take action.
So, I believe we have to place two conditions here, can someone assist.
If you believe it only happens during trusted source reconciliation, then you can create Post-Process Handler on User Create/Modify operation to check the value which was posted into the DB as a result of recon event.
From this handler you can do all the things you need to do: mailing, fixing, etc.
For notification purposes I'd recommend to use built-in NotificationService, though it might be bit daunting, if you have little experience in OIM development. As an alternative you can do java mailing.
If you are not sure about the moment, when this "spoiling" happens, you can create a scheduled task, to be executed periodically, which will check JobCode values, to report invalid ones.

Assignment of legal entity to roles for users via dmf

I m in need to find the data entity which will help to assign legal entity to a role in bulk through dmf. The below link provides information for manual and organization hierarchy for the same process.
https://alexdmeyer.com/2020/01/07/options-for-configuring-user-legal-entity-restrictions-in-d365fo/
Kindly help.
TLDR
You are looking for entity "System security user role organization" (SystemSecurityUserRoleOrganizationEntity).
Note that there is a second entity with the technical name SystemSecurityUserRoleEntity (without Organization) that unfortunately uses the same label. Make sure you use the correct one.
Also note that this entity exists since version 10.0.11.
DIY
To find this information yourself in case you have a similar "What is the entity for x?" question in the future, here is the details of what I did to find the entity:
First, I followed the instructions from the link you provided to the form of the "Assign organizations" function. There, I checked what table is used as the data source for the grid in the lower part of the form where records are created when the "Grant" function is used. This told me that table OMUserRoleOrganization stores the data where legal entities are assigned to the roles of a user.
Next, I opened up Visual Studio, navigated to the table in the application explorer and used the context (right click) menu to find the references of the table. A bit down the list, you will notice that several entries start with dynamics://*. These are metadata references (e.g. a data source in a form) instead of code references. In this case, you are looking for a metadata reference that starts with dynamics://DataEntityView/*. This identifies data entities where the table is used, usually as a data source in the query of the entity. In this case, only one entity is found, SystemSecurityUserRoleOrganizationEntity. If you look at the fields of this entity, they match your requirement of specifying a user, a role and a legal entity.
To test the entity, I assigned an user's role to an organization (Contoso data doesn't seem to have this) and created an export project with the entity. This gives me the following result:

Wondering how I might be able to debug this ACL issue

I'm adding security around some buttons in an app I built long ago. The way I implemented this security feature is that I created a a role in the database's ACL. I do a check in the button's hide-when formula and expose the button if the role is there. That role is assigned to a security group in the Domino Directory. That security group contains a collection of other groups. These 2ndary groups contain people's names. Those names are retrieved from a Postgres database -- I have a LotusScript agent that pulls the names from that database. The problem I'm seeing is that even tho a name is in the 2ndary group, Notes doesn't recognize it. Here's an example. This user are in these groups:
however, he should also be in all of these:
How can I debug where the problem is?
thanks
clem
I think the problem is that for one group in particular, there are 2 copies of the group document. I didn't see that b/c in the main group view it doesn't show up. But when I was in the process of assigning a child group to a parent group, I can see the duplicate listed. I suspect this is the source of the problem. Will confirm.
thanks
clem
Make sure the members of the 2ndary groups contain names in fully qualified format that matches the first entry of their FullName in the person document. EG "John Smith" should be "CN=John Smith/O=LabWare" or something like that.
You can see what groups and roles the system recognizes a user in by double clicking on the security icon on the status bar in the Notes Client (bottom 3rd from the right) after you have opened the database.

SSAS Dynamic Dimension Security based on another dimension attribute

In my project I have to apply security based on a dimension attribute.
I think the best way to explain my scenario is with an example, if you need more info please request me and I'll love to told you if it will help me find a solution.
I have some main dimension, the dimcustomer, dimseller, fact, data and geographic.
The fact table are related with dimseller ids, the dimcustomer is related to the dimseller based on one dimseller specific attribute(CNPJ)(another dimensions that i didnt described are related the same way).
So my goal is to apply a role security based on the dimseller CNPJ, so then when the user related with that seller trys to browse data he will be allowed to view only the data that are related to his seller CNPJ.
Table example:
DIM Seller: DIM Customer FactTable
id name cnpj id name dimseller.cnpj dimseller.id dimcustomerid measure
1 ME 1234 1 guest1 1234 1 1 50,00
2 you 5678 2 guest2 5678 2 2 100,00
So if i login as ME i will be able to se that i have the customer guest1 with one sold product that was sold by 50 bucks.
Got my point?
What is the best way of doing it?
For now I'm considering the following guide: Claim Authentication with dynamic dimension security, but at that way I should define it attribute by attribute.
Is there a way that i can define this security need? I can easy filter the data using sql statements, but i have no ideia how i can apply this kind of security in the ssas.
Thank you guys anyway!
To apply security within a dimension, you need to use roles. For each roles, you can then specify which element in the cubes/dimensions that are available to that role. So, what you got to do is to create a role by CNPJ that will be able to view only their CNPJ.

How to get distinct values of a managed property through SharePoint search?

I am building a phone catalog of my organization (an AJAX application which accesses the search.asmx web service).
I'd like to show a list box where the user could select a department (which is stored in managed property Department). To fill the list box with values, I need to somehow select all the distinct values of that property.
Is it possible through search.asmx web service?
What I've found:
an article, which states that it is possible, but it does not use the web service interface
a Microsoft's white paper which states that "If the protocol client specifies at least one property, it MUST also specify the Path property. If it does not, the protocol server MUST return the status code "ERROR_BAD_QUERY"."
The two findings are somewhat inconsistent. (and, yes the search really returns ERROR_BAD_QUERY).
Why bother to check with the web service or complicate it?
Get all the properties into a DataTable.
Then create a DataView & then you can apply the DISTINCT on required column.
Finally use it to bind to your list box.

Resources