nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

M2DOC reporting for cybersecurity: Goals and Threat Scenarios in one table

medini_1064611722

Hello, I like to generate the following table.

I get this code from the headlamp example. The
security goal gets populated, but the threat scenario doesn't. It gives an
error. I checked, and the same error exists in the headlamp example. Can you
give me a code to populate the threat scenario ID and Description?

Find more posts tagged with

medini

medini legacy

Accepted answers

All comments

medini_1024169437

Ali, can you post the error so we have an idea what the root cause might be?

To confirm: you say that the headlamp example from the support page has that error as well and report cant be generated? Which version of the tool and sample are you using? I vaguely recall that an update with a fix of the report was posted a while back.

Jan

medini_1064611722

Hi Jan,

2024 R1 both for tool and sample. Please provide the code for this
version. This is the error. There seems to be an issue with this command:
asBookMarkRef. What does this do?

medini_1024169437

Frankly speaking I do not understand that error. We need someone else to check.

Jan

medini_1063548292

Hi Ali , Jan,

After a very quick review i see that the goal column is defining bookmarks based on the SafetyGoal.

The second column contains threat scenarios' bookmark-Refences..

First question: Are you sure that you have a Bookmarks for all threat scenarios placed in the document?

=> ThreatScenario.id.asBookmark(ts.mediniIdentifier)

Second question: Are you sure that such generated bookmark reference is really uniue?

PS: I usually use some paranoya prefix with bookmarks just to be sure ... => ts.id.asBookmarkRef('TSCENARIO'+ts,mediniIdentifier)

Marian

medini_1024098885

Hello Marian,

I'm not sure what exact report you refer to? Is the one that we ship with the BestPracticeTemplateISO21434? If so, it would be nice if you could point me to the exact table in that report.

But generally, mediniIdentifier is always unique within a medini project, thus they can be used as a bookmark. Typically it points the respecive tables in the Annexes of the document.

Regards

Mario

medini_1063548292

Hi Mario,

I have not seen particular Ali's modified template but was only commenting on his snapshot.

I also took the headlamp example referred by Ali and try to create a report on that particular project and saw the dangling bookmarks error as weel. However, here it was in the 6.3 Cybersecurity goals table column::

Related Cybersecurity
Controls

Seems that the table with Cyb. measures shall be listing them (6.5 Cybersecurity Controls) , however is empty is empty => as a result bookmark references from 6.4 table pointing to non-existing bookmarks of measures. The AQL statements related to the Measures seems to yield an empty Collection.

This could be because of the project content or because of the AQL statements to obtain those meaures.

I have review the TARA_Report_Template available in the Headlamp/BEstBRactice Cyber) and observed that

HEadlamp project TARA threat event has some securityMechanism (SecM) assigned inside ThreatEvent.measures but the SecM is from the Catalog ( having annotation 'UNECE Catalog')
The Table in the 6.3 Cybersecurity Goals ( column controls) is listing ANY ScM available at ThreatEvent.measures
The Table in the 6.5 Cybersecurity controls is on purpose filter ScM's that ar not coming from the UNECE catalog and are present in any threat Event.measures property

Aas a consequence the 6.3 Cybersecurity goals table is creating BookmarkRefences to the ScM's ( from UNECE Catalog) that are not populated nowhere in the report, because they are explicity excluded in the 6.5 Cybersecurity Controls AQL statement

So either the 6.3 Controls column or table 6.5 AQL need an update to make sure that measures Bookmark's ar paired with their References

Ivam attaching an updated Tara with additional Table of Cybersecurity Controls accepting ScM's fom UNECE Catalog

m:for ctrl | safetyModel::SecurityMechanism->allInstances()
->select(c | 
 c.eAnnotations->exists(a | a.details.key->exists(k | k = 'UNECE Catalog')) 
 and 
 c.mediniGetOpposites('measures')->exists(te|te.oclIsKindOf(tara::ThreatEvent)) 
)->sortedBy(c | c.id)

Marian

medini_1063548292

Mario,

One more thing.

Regarding Bookmarks based and mediniIdentifier.

I noticed that the TARA report template uses objects' id of and not really the mediniIdentifier for a Bookmark definition (all the annex tables) .

And there one can eventually encounter a duplicit bookmark deifnitions because the id of unrelated objects may match (user accesible porperty) while the mediniIdentifier is indeed unique within a project.

Marian

medini_1024098885

Marian,

it seems that you have still an older version of the template because in the latest version all annex tables use mediniIdentifier as bookmark.

Regards

Mario

medini_1063548292

Thanks Mario,

Indeed I got CS tamplate project version back form 2023. I usually place the template revision in the header or footer of the template document

I downloaded the most recent one ( 2024-July) and :

6.2 Overview of Risk Treatment Decisions -> goalLabels collected as asBookmarkReference r.identifier and not sg.mediniIdentifier . While the table 6.3 with CS Goals defines bookmarks from sg.mediniIdentifier => dangling bookmarkRef
6.3 CyberSecurity Goals still listing all ScMechanisms (ctrlLabels) while the 6.5 Cybersecurity Controls is excluding the ScMs from a UNECE catalog -> dangling bookmarkRef for ScMs form UNECE catalog contained in ThreatEvent.measures

Since i do not understand if the second point is intentional (not allowed to use ScM from catalog) I cannot comment if some update is needed, at least it will generate dangling bookmarks error

Marian