Black Kite Vendor Cyber Risk

There is no undo function for package installation. Packaging is a powerful feature that can make significant changes to an instance. Archer strongly recommends that you back up the instance database before installing a package. This process enables a full restoration if necessary.

An alternate method for undoing a package installation is to create a package of the affected objects in the target instance before installing the new package. This package provides a snapshot of the instance before the new package is installed, which can be used to help undo the changes made by the package installation. You must manually delete new objects created by the package installation.

1. From the menu bar, click > Application Builder > Install Packages.

2. In the Available Packages section, click Import.

3. Click Add New, then select the package file that you want to import.

4. Click OK.

The Available Packages section displays the package file and is ready for installation.

Important: This step is required only if you are upgrading to a later version of [ODA name].

1. From the menu bar, click > Application Builder > Install Packages.

2. In the Available Packages section, select the package you want to map.

3. In the Actions column, click for that package.

The analyzer runs and examines the information in the package. The analyzer automatically matches the system IDs of the objects in the package with the objects in the target instances and identifies objects from the package that are successfully mapped to objects in the target instance, objects that are new or exist but are not mapped, and objects that do not exist (the object is in the target but not in the source).

Note: This process can take several minutes or more, especially if the package is large, and may time out after 60 minutes. This time-out setting temporarily overrides any IIS time-out settings set to less than 60 minutes.

4. When the analyzer is complete, the Advanced Package Mapping page lists the objects in the package file and corresponding objects in the target instance. The objects are divided into tabs, depending on whether they are found within Applications, Solutions, Access Roles, Groups, Sub- forms, or Questionnaires.

On each tab of the Advanced Mapping Page, review the icons next to each object to determine which objects you must map manually.

5. For each object that requires remediation, do one of the following:

   • To map each item individually, on the Target column, select the object in the target instance to which you want to map the source object. If an object is new or if you do not want to map an object, select Do Not Map from the drop-down list.

     Important: Ensure that you map all objects to their lowest level. When objects have child or related objects, the parent object provides a drill-down link. You must map child objects before parent objects. For more details, see "Mapping Parent/Child Objects" in the Archer Platform Help.

   • To automatically map all objects in a tab that have different system IDs but the same object name as an object in the target instance, do the following:

1. In the toolbar, click Auto Map.

2. Select an option for mapping objects by name.

   Option	Description
   Ignore case	Select this option to match objects with similar names regardless of the case of the characters in the object names.
   Ignore spaces	Select this option to match objects with similar names regardless of whether spaces exist in the object names.

3. Click OK. The Confirmation dialog box opens with the total number of mappings performed. These mappings have not been committed to the database yet and can be modified in the Advanced Package Mapping page.

4. Click OK.

   • To set all objects in the tab to Do Not Map, in the toolbar, click Do Not Map.

     Note: To undo the mapping settings for any individual object, in the Actions column, click Undo.

5. When all objects are mapped, the icon is displayed in the tab title. The icon is displayed next to the object to indicate that the object will not be mapped.

6. Verify that all other objects are mapped correctly.

7. (Optional) To save your mapping settings so that you can resume working later, see "Importing and Exporting Mapping Settings" in the Archer Platform Help.

8. Once you have reviewed and mapped all objects, click Execute.

9. Select I understand the implications of performing this operation and click OK.

The Advanced Package Mapping process updates the system IDs of the objects in the target instance as defined on the Advanced Package Mapping page. When the mapping is complete, the Import and Install Packages page is displayed.

Important: Advanced Package Mapping modifies the system IDs in the target instance. You will need to update any Data Feeds and Web Service APIs that use these objects, with the new system IDs.

All objects from the source instance are installed in the target instance unless the object cannot be found or is flagged to not be installed in the target instance. The Log Messages section provides a list of conditions that may cause objects not to be installed. The Package Installation Log section displays a log entry.

1. From the menu bar, click > Application Builder > Install Packages.

2. In the Available Packages section, locate the package file that you want to install, and click Install.

3. In the Selected Components section, click the Lookup button to open the Package Selector window.

   • To select all components, select the top-level checkbox.

   • To install only specific global reports in an already installed application, select the checkbox associated with each report that you want to install.

Note: Items in the package that do not match an existing item in the target instance are selected by default.

4. Under the Install Method drop-down menu, select an option for each selected component. To use the same Install Method for all selected components, select a method from the top-level drop-down list.

Note: If you have any existing components that you do not want to modify, select Create New Only. You may have to modify those components after installing the package to use the changes made by the package.

5. To deactivate target fields and data-driven events that are not in the package, in the Post-Install Actions section, select the Deactivate target fields and data-driven events that are not in the package checkbox. To rename the deactivated target fields and data-driven events with a user-defined prefix, select the Apply a prefix to all deactivated objects checkbox, and enter a prefix. This can help you identify any fields or data-driven events that you may want to review for cleanup post-install.

6. Click Install.

7. Click OK.

1. From the menu bar, click > Application Builder > Install Packages.

2. In the Package Installation Log tab, click the package that you want to view.

3. In the Package Installation Log page, in the Object Details section, click View All Errors.

   Note: To view individual logs, in the Errors column of the log you want to view, click the Failures link or Warnings link. Clicking View All Errors, Failures, or Warnings opens the specific errors on a different page.
   

4. Click the Export icon to export the log file.

5. Click Close.

   • The Archer_Black_Kite_Risk_Score_2024.11_Installation_Package consists of the following components:

     • Third Party Profile application

     • Black Kite Risk Score Data Feed

Please select ‘Override Layout’ for Third Party Profile application while installing the Black Kite package.

The following data feed is used as part of the Black Kite Integration process:

The data feed must be configured. After setting up the data feed, you can schedule it to run as needed per your organization’s requirements. For more information on scheduling the data feed, see the Scheduling Data Feed section.

Before you upload a JavaScript file, you must configure JavaScript Transporter settings in the Archer Control Panel.

1. On the General tab, go to the JavaScript Transporter section.

   1. Open the Archer Control Panel.

   2. Go to Instance Management and select All Instances.

   3. Select the instance you want to use.

   4. On the General tab, go to the JavaScript Transporter section.

2. In the Max Memory Limit field, set the value to 2048 MB (2 GB).

3. In the Script Timeout field, set the value to 120 minutes (2 hours).

4. (Optional) If you want to allow only digitally signed JavaScript files in the data feed, enable Require Signature.

   1. In the JavaScript Transporter Settings section, select the checkbox Require Signature. A new empty cell appears in the Signing Certificate Thumbprints section.

   2. In the Signing Certificate Thumbprints section, double-click an empty cell.

   3. Enter the digital thumbprint of the trusted certificate used to sign the JavaScript file.

      Note: For information on how to obtain digital thumbprints, see Obtaining Digital Thumbprints.

      Important: If you enable Require Signature and specify no thumbprints, no JavaScript files will be accepted by the system.

   4. (Optional) If you want to add additional thumbprint sources, repeat steps 4b-4c for each thumbprint.

5. On the toolbar, click Save.

When running JavaScript data feed, you can set the Archer instance to only allow digitally signed JavaScript files from trusted sources for security considerations.

For a certificate to be trusted, all the certificates in the chain, including the Root CA certificate and Intermediate CA certificates, must be trusted on both the Web Server and Services Server machines.

Note: Archer Technologies LLC certificate is not present on every machine’s root by default.

1. On the JavaScript file, right-click and select Properties.

   1. Click the Digital Signatures tab.

   2. From the Signature List window, select Archer Technologies LLC.

   3. Click the Details button.

   4. Click View Certificate.

   5. Click Install Certificate.

   6. Select Local Machine.

   7. Click Next.

   8. Select Place all certificates in the following store and click Browse.

      1. Select Trusted Root Certification Authorities and click OK.

      2. Click Next.

      3. Click Finish.

2. Upon successful import, click OK.

1. In the Archer Control Panel environment, open the Manage Computer Certificates program.

   1. Click Start.

   2. Type:  certificate

   3. From the search results, click Manage Computer Certificates.

2. Ensure that your trusted source certificates are in the Certificates subfolder of the Trust Root Certification Authorities folder.

3. In the Certificates subfolder, double-click the Archer Technologies LLC certificate that contains the thumbprint you want to obtain.

4. Verify that the certificate is trusted.

   1. In the Certificate window, click the Certification Path tab.

   2. Ensure that the Certificate Status window displays the following message: This certificate is OK.

   Note: If the Certificate Status window displays something different, follow the on-screen instructions.

5. Obtain the trusted certificate thumbprint.

   1. In the Certificate window, click the Details tab.

   2. Select the Thumbprint field. The certificate's digital thumbprint appears in the window.

Important: Synchronizing the Black Kite monitored company risk numbers with the TPPs on Archer takes time. As a rule of thumb, it takes a minute to synchronize 10 companies. Script Timeout should be adjusted to according to the number of companies monitored under your tenant on Black Kite. So, if you monitor 100 companies under your Black Kite tenant, then script timeout should be no less than 10 minutes. As another example, if you monitor 1000 companies under your Black Kite tenant, then script timeout should be no less than 100 minutes.

Important: Before you upload a JavaScript file, configure the JavaScript Transporter settings in the Archer Control Panel. For more information, see Configure the JavaScript Transporter Settings.

1. Go to the Manage Data Feeds page.

   1. From the menu bar, click .

   2. Under Integration, click Data Feeds.

2. Search and open Black Kite Risk Score Data Feed.

3. In the General Information section, in the Status field, select Active.

4. Click the Transport tab.

5. In the Transport Configuration section, do the following:

   1. Click Upload.

   2. From the Upload JavaScript File dialog, click Add New.

   3. Locate and select the ‘signed-BlackKite_Archer_v6.2.js’ file.

   4. Click Open.

   5. From the Upload JavaScript File dialog, click OK.

6. In the Custom Parameters section, enter key values.  The following table describes the value for each key in Custom Parameters.

Note: The listed values are in place by default. They can be configured to suit your environment.

Important: The keys and values are case-sensitive and cannot include extra spaces at the end of the strings.

For each key type, determine whether you want it to be Protected or Plain Text. Selecting Protected encrypts the key value for the specified key in the log.

9. Click Save.

10. Click the Run Configuration tab.

    1. Go to Tokens section.

    2. Verify token values.

    The following table describes token values to verify.

Note: For more information about tokens, see Data Feed Tokens in the Archer Online Documentation.

11. Click on the Data Map tab and click on the Key Field Definition sub-tab. Here, there are two options. You can either select the existing "Third Party Name" or you can select newly created custom "Black Kite Domain" to be used as a match criterion. By Default, the “Third Party Name” domain is selected.

    • Option 1: The first option means the matching will be done on vendor names, which will obviously be a weak matching criterion. For example, if there's a 3rd party vendor with a name Google in Archer, we can only match and synchronize its related risk scores if there's also a vendor name Google monitored on the Black Kite. A mismatch in the name, for example 'Google Inc' instead of 'Google' will make synchronization fail.

    • Option 2: The second option is more reliable because domain names are unique on Black Kite for classifying the vendors. But when this option is selected a manual job pertains. For a successful match, since Black Kite Domain is a newly created custom field, one should Edit the vendor in question and fill out this field.

      Note: If you will follow the second option, don't map 'Third Party Name' to CompanyName field on the field map tab. Otherwise, your matching vendors' names will be overridden with the ones from the Black Kite.

12. Click Save.

When you schedule a data feed, the Data Feed Manager validates the information. If any information is invalid, an error message will display. You can save the data feed and correct the errors later, but that data feed is not processed until the errors are rectified.

Important: A data feed must be active and valid to successfully run.

1. Go to the Schedule tab of the data feed that you want to modify.

   1. From the menu bar, click .

   2. Under Integration, click Data Feeds.

   3. Select the data feed that you want to modify.

   4. Click the Schedule tab.

2. In the Recurrences section, enter the frequency, start and stop times, and time zone for the data feed.

3. (Optional) In the Run Data Feed Now section, click Start to override the data feed schedule and run the data feed immediately. 

4. Click Save.

               The following table describes the fields in the Recurrences section.

5. Navigate to the Data Map tab and verify the following mapping of the Source and Target fields.

6. Test the application according to your company standards and procedures, to ensure that the use case works with your existing processes. See Testing the Data Feed for complete information.

1. You can click on the Run Data Feed Now button to check that everything works smoothly. Wait to see the Completed message as shown below.

   

2. By clicking the Completed link, you can see the details of the job. If you come across with any failure here, then the Archer XML log files (possibly located under the Archer\Logging\InstanceName directory) that includes JobFramework in their name may shed some lights on the root cause of the problems.

3. Now you can open a Third Party profile, such as below, and see the updated Black Kite ratings if a successful matching occurred.

4. Synchronized ratings on the TPP page

Important: Rarely the ratings presented at the https://app.blackkitetech.com/ portal and the ones here may differ due to the periodic synchronization times and/or mathematical rounding applied at the Archer side by the Data Feed JS code. The latter difference is negligible.