Working with Fetchers, Controls, and Requests

Overview

Anyone with rights to create an audit against a control has the ability to associate fetchers with requests. This documentation is to be used after an integration is set up between ZenGRC and an integrated evidence source such as Splunk, Amazon Web Services (AWS), etc.

Adding and Removing Evidence Fetchers on Controls

After a fetcher pulls data into ZenGRC, the information must be attached and mapped to a control prior to adding it to a request. 

To add attachments to a control, complete the following steps:

1. Open the control.
2. Click the blue pencil beside Fetchers to display a new window.
3. Select an option. More than one can be selected. The following screenshot shows a Splunk attachment. But other fetchers, such as AWS, display in the same manner.
   
   
   
   
4. Click Save.

Adding Fetchers to a Request

In order for fetchers to be visible on a request after they are added to a control, the request and the control have to be mapped. Once that's accomplished, you can fetch evidence on the request and have it displayed in the Attachments tab.

Mapping Requests to Controls

Mapping a control and request together is something that can be done directly on the control in the Mapped Objects tab.

Attaching Evidence to a Request

To attach evidence to a request, complete the following steps:

1. Click the Fetchers tab on the applicable request.
   
   
   
   

2. Beside each fetcher, click Fetch. This places the data in the Attachments area.

   
   

   TIP

   If there are no fetchers in the Fetchers tab, this means the control and request are not mapped.

3. Click the Attachments tab to view the evidence.

Multiple Fetches and Errors

A file can be fetched several times. Each time it's fetched, it displays in the Attachments tab along with a time/date stamp for differentiation.

If an error occurs when fetching evidence, a red x displays in the Fetchers tab beside the file being fetched. The file will display in the Attachments tab, however, it will be empty. In addition, an error file with a .json extension is placed along with the empty file. Open the file to assist with troubleshooting.