nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Report related requirements of CS goals with best practice template

medini_1072437044

Hello,

I am working with Medini Analyze for Cybersecurity 24R2.

I try to export related security requirements via report with Anysy M2Doc script template from best practice project template.

Unfortunalty the requirements are not reported.

The screenshot shows the script. The report works fine for related controls and threat scenarios. But not for the requirements.

Can please some one explain why and how to fix this?

Find more posts tagged with

medini

medini legacy

Accepted answers

All comments

medini_1024169437

Anton, so what you experience is that column 6 is empty?

Jan

medini_1072437044

Hello Jan,

I already fixed that one with a work around. I introduced a new column were I referenced all relevant requirements for the threat evenet, and I was able to call that column (see attachment "Requirements_work_around").

But I am not able to list all the requirements together with thier related goals and control (according to template chapter 6.4, see attachment "Requirements_listing_issue"). Here I get the feedbach "req value is null".

I am able to list the requirements incl. description with the following script:

m:for
req | Reqs.requirements

m:req.identifier

m:req.name

m:req.description

m:endfor

But I am not able to print the related controls and goals. Do you have a solution?

medini_1072437044

Sorry I forgot to attach the other file

medini_1063548292

Hi Anton,

2 things:

Hope you have the latest template
key is what related requirement is

ad 1) not related to your case ... there has been some problems reported for a different reason ( dangling references) that seem to still persist event in the Best Practice 2025R2 mprx -> getting dangling reference error

ad 2) As I read the queries, the template expects that both security goals AND requirement are placed inside of requirements ThreatEvent structural feature.SO here is What I did with the empty Template

Resulting report correctly populated 6.3 and 6. ( after cleanup of the dangling reference error)

Can you clarify what a Sec.Goal "related requirements" is in your case? The workaround you used seem to confirm my suspicion

Marian

medini_1072437044

Hi Marian,

thanks for your reply. In my case the "applied measures" and "additional measures" and "contributing requirements" field. For me it seems wrong to put requirements and goals in the same field, it is not the same. And I can't use that work around it would mess up my whole approach in the threat event table.

I just want to report the requirements (only) incl. name, id and description. In extra colums I want the related goals and controls to be shown.

Do you have another idea how to achieve that?

medini_1063548292

Hi Anton,

Thanks for clarification!

I am not the author of the template, so my comment was not to force you to have req and SG in the same filed just commented what the AQL query is expecting . Frankly it also feels a bit weird t me to have both (SG & req) expected in the same column (requirements), but there might have been a reason for that .

Both things you want can be achieved with a tiny update of the AQL and even without your aux profile property.

I still did not get the answer on how you capture the relation between a security goal and requirement, applied measures and Contribution related columns in the TARA table are derived properties=> you have to capture the relation in the model.

So here is the idea:

Prerequisite: Security goals are configured with contributing requirements using "Contributes" relation ( can be done only through diagram)
HARA table could look like this (only sec goals entered in the Cyber-sec Goals column)
Modification of the m2doc template (6.3)

//...replace just the reqsLabels variable AQL:: threatEvents .requirements ... => threatEvents.user_contributing_requirements ...
m:let reqsLabels = threatEvents.user_contributing_requirements->select(r | r.oclIsKindOf(safetygoals::SafetyRequirement))->sortedBy(r | r.identifier)->asOrderedSet()->collect(r | r.identifier.asBookmarkRef(r.mediniIdentifier))
//...

Modification of the m2doc (6.4)

//...replace just the threatEvents variable AQL:: ->select(te | te.requirements->exists ... to ...->select(te| te.user_contributing_requirements->exists...

{m:let threatEvents = tara::ThreatEvent->allInstances()->select(te | te.user_contributing_requirements->exists(r | r = req)}
//...

That should leave you with report

6.3 -> populated requirements for each sec goal
6.4 -> list of requirements and related sec goals in the TARA

Marian

medini_1024169437

Anton, besides what Marian already said: that property, user_threat_relevant_requirements, was that added by you or was it part of the template before?

If the first, could you provide the code? Is it OCL or JS based and whats the result type?

Jan

medini_1072437044

Jan, user_threat_relevant_requirements was added by me. It is a reference property, referring to arbitary model elements. I used the existing profile when creating it.

medini_1024169437

Thanks Anton, and sorry, maybe I was misreading your question, seems you solve dthe problem and the remaining problem ha snothing to do with that custom prop, right?

Anyway, I dont see any issue just by starring at the screenshot and the script, any possibility to drop the docx here, at least the relevant part of it? Or even a stripped MPRX which allows to reproduce and debug the issue?

Jan

medini_1063548292

Hi Jan ,

I understood that Anton overcame the first issue (not having listed the Sec goal related requirements in section 6.3) => introduction of reference profile property + modification of the m2doc AQL statement to point to his new reference property instead of former requirements.

Anton also wanted to see the list of requirements in another report termplate section (6.4)

There the AQL has the same statement problem so IF Anton wants to keep this approach ( having a new refence property) then my suggestion would be to just modify the AQL in 6.4 to collect the threatEvents and use again the name of the reference property instead of former "requirements" -> user_threat_relevant_requirements"

Note that also other sectins in the template would have to be repointed to correctly "collect" the requirments from a "user_threat_relevant_requirments"

For instance anotherm tmeplate modifcation required in 6.5 Cybersecuirty Claims

m:let reqsLabels =
threatEvents.requirements->select(r |
r.oclIsKindOf(safetygoals::SafetyRequirement))->sortedBy(r |
r.identifier)->asOrderedSet()->collect(r | r.identifier.asBookmarkRef(r.mediniIdentifier))
TO
m:let reqsLabels = threatEvents.user_threat_relevant_requirements->select(r | r.oclIsKindOf(safetygoals::SafetyRequirement))->sortedBy(r | r.identifier)->asOrderedSet()->collect(r | r.identifier.asBookmarkRef(r.mediniIdentifier))

Marian

medini_1072437044

Hi Marian, I edited the m2doc for chapter 6.4 according to your recommendation:

//...replace just the threatEvents variable AQL:: ->select(te | te.requirements->exists ... to ...->select(te| te.user_contributing_requirements->exists...{m:let threatEvents = tara::ThreatEvent->allInstances()->select(te | te.user_contributing_requirements->exists(r | r = req)}
//...

Unfortunatly I get req=null as result, the table is empty.

I found an other solution to this, I just defined the requirements model as variable for the report:

This gave me the possiblity to display everything I wanted, but for the CS controls I still get errors, if there is no control referenced.

Do you have a solution how to solve "Couldn't find the 'aqlFeatureAccess(java.lang.String,java.lang.String)' service"?

The user_derived_from_control is a OCL attribute I added myself with OCL script: self.mediniGetTracedElements(safetyModel::SecurityMechanism)

Thanks in advance

medini_1063548292

Hi Anton ,

now I am confused and seems to be mixture so let me ry to summarize:

Solution to see requirements

proper capturing in project using either

a)goal<-> requirement contribution relation -> digram , then you should use the te.user_contributing_requirements in the 6.3 and 6.4 and 6.5

b) you stick with your threat event defined custom profile property ( Reference property in threat event object ) => use te.user_threat_relevant_requirements

req = nulWhere exactly is the req = null present< that is very strange as the query in 3.4 (safetygoals::SafetyRequirement->allInstances()->sortedBy(r | r.identifier)) shall get all project available requirements and in case ob bestpractitemplate it works perfectly for me !
plase add extra qeuery aabove th 6.4
Total reqs {m: safetygoals::SafetyRequirement->allInstances()->size()}

this should yield to a non zero value

id in string not fond

I think this is case of 24R2 and ocl property returning string in case empty ( fixed in 25R2). so basically notEpmty is false , having an emty string inside , and string does not have an id
i advise you to remove if and update the for with simple

m:for ctrl| req.user_derived_from_control->selectByKind(metaclass)
m ctrl.id

m:endfor

So make sure you use the correct profile property , confirm it just by looking on opened tara ( worked for my trial son on myprevios picture)

Marian

medini_1063548292

Hi,

Correction...
->selectByKind(metaclass) is an OCL and not for AQL , so for AQL(m2doc) you should use

->filter(metaclass)

Mairan

medini_1072437044

Hi Marian,

I get the following feedback for the metaclass approach:

Parsing

Variable [metaclass] is not specified in the configuration.

Let me try to solve your confusion. Instead of useing the m2doc script from the best practice template, I defined a variable in the reporting section of Medini which includes the requirements model. I used the variable to cast the requirements and related goals and sub requirements, it works fine. Only the issue with the controls remains, mentioned above.

medini_1072437044

It works with: m:for crtl | req.user_derived_from_control->filter(safetyModel::SecurityMechanism)

medini_1063548292

Hi Anton,

indeed metaclass was just a hint that the target object class need to be provided ( SecurityMechanism in your case , it also works with collection of classes as an argument ->filter(Sequence{metaclassA,metaclassb,...})

Ok got the point with the mode. Keep in mind that a requirements might reside at different requirements therefore the general project scoped query safetygoals::SafetyRequriement.allInstaces() is used on BP template . Still do not understand why it does not work for you. This is very strange and therefore I asked you to try the query with size to see how many of req are actually seen.

Another possibility would be that there is some corrupted data in on your project so can you execute Check Consistency on the project and look for any issues?

second would be to append ->filter(safetygoals::SafetyRequriment at the 6.4

m: for req|safetygoals::SafetyRequriement.allInstaces()->filter(safetygoals::SafetyRequriement) )

Can you try to test using allInstances() with dot(.) and collection (->)operator ?

m: safetygoals::SafetyRequriement->allInstances()->size()

m: safetygoals::SafetyRequriement.allInstances()->size()

Anyway, that means that in your case multiple requirement model objects might be needed to be placed at as a variable.. so to gather the requirements , goals
You can eventually place there any input objects to use it as a "resource pool" and query individual content in the m2doc

get root requirements, accept any ecore object from the Reqs, reqmodel, safetymech catalog package ,....
{ m: Reqs->filter(ecore::EObject).eContents(safetygoals::SafetyRequirement) }
******
get all requirements (riit + subreqs) , accept any ecore object reqmodel, safetymech catalog, package ,....
{ m: Reqs->filter(ecore::EObject).eAllContents(safetygoals::SafetyRequirement) }
get all saec mechanisms , accept any ecore object from the Reqs, reqmodel, safetymech catalog, package ,....
{ m: Reqs->filter(ecore::EObject).eAllContents(safetyModel::SacurityMechanism)}

Marian

medini_1072437044

Hi Marian,

if I use the following script with your idea of ->filter(safetygoals::SafetyRequriement)

I get the following error message:

Parsing

Expression "safetygoals::SafetyRequirement->allInstances()->filter(safetygoals::SafetyRequriement)" is invalid: invalid type literal safetygoals::SafetyRequriement

If I use "m:for req | safetygoals::SafetyRequirement.allInstances()->sortedBy(r
| r.identifier)" instead I still get the following output: req value is null.

medini_1063548292

Anton,

of course m2doc has an issue as I have typographic error inside of the filter SafetyRequriement =>SafetyRequirement,. Sorry the typos are trademark

USinf filter() should fix the issue because the error indicates it got a null object inside the results and it is reported by sortedBy() which is very strange and it might be linked with some corrupted data in the project.

if you want to replicate it is esy just use m: for x | safetygoals::SafetyRequirement.allInstances()->-including(null)->sortedBy(r | r.identifier)

Did you manage to execute Consistency check on project? Any errors flagged ?

Didi you also to query on requirements and their count as I suggested ?, what numbers did it show?

Can you try
{m:for req | projectmodel::MediniProject.allInstances()->first().eval('finder.findByType(Metamodel.safetygoals.SafetyRequirement).asList()')->sortedBy(r | r.identifier)

and to finally confirm place this testany where in the m2doc :

{m: Sequence{safetygoals::SafetyRequirement.allInstances()->size(),safetygoals::SafetyRequirement.allInstances()->filter(safetygoals::SafetyRequirement)->size()} }

if you see two different numbers then you have a problem
Marian

medini_1072437044

Hi Marian, consitency check is ok, no issues found.

I tested the following, result still the same: "req value is null"

medini_1063548292

OK thanks Anton!

so one last thing do you see a different numbers with and without filter ?
I guess not as the table is not populated because of the null error ,

So move the Sequence{..-> size(),...->filter(..)->size()} query before the table header . if you see lower number of arguments for a filter eed query that it it as indication .As lasst exercise you san use the filter before ->sortedBy() and if this one does not works that I depleted all easy advice list and can only state "This place reeks of evil"

I then would suggest you to have a session with some of the support guys and eventually setup a secure transfer so that they can help you out more effectively and faster this somehow

Marian