SECU0019 alert being generated out of multiple PEGA activities
Hello everyone, since a month or more now, PDC is throwing an important amount of SECU0019 alerts in production environment. I know what you are thinking, i have tried that resolution to mess with the values related to this page Verify requests at the application layer | Pega to get rid of the alerts, but my aim is to know if it's related to PEGA or it's from my security structure, because from what i see all of the activities which are generating this issue are FINAL/PEGA main activities.
I tired a couple of tests and i figured out that when i login with an operator, the 'ShowDesktop' activity and much more system activities are showing this alert.
Also these are the parameters on most of the activities which are throwing this issue:
And here is an example of some SECU0019 alerts which i am getting:
Hello everyone, since a month or more now, PDC is throwing an important amount of SECU0019 alerts in production environment. I know what you are thinking, i have tried that resolution to mess with the values related to this page Verify requests at the application layer | Pega to get rid of the alerts, but my aim is to know if it's related to PEGA or it's from my security structure, because from what i see all of the activities which are generating this issue are FINAL/PEGA main activities.
I tired a couple of tests and i figured out that when i login with an operator, the 'ShowDesktop' activity and much more system activities are showing this alert.
Also these are the parameters on most of the activities which are throwing this issue:
And here is an example of some SECU0019 alerts which i am getting:
My questions are:
Are these alerts related to PEGA and i can't deal with them? If not, then how can i resolve the issue?
Tell me if there is any more information that i need to provide to simplify the explanation of this problem, thanks!
Blue Rose Technologies
NL
Updated: 7 Jun 2022 6:20 EDT
Capgemini
FR
@Deepthi ChivukulaHey Deepthi thank you for replying,
First of all thank you for your proposed solution i appreciate your help and it actually works i confirm i have tried it before. But as a root fix i assume that is not the proper approach, to set the pyBlockUnregisteredRequests to false isn't my actual aim as it will just prevent you from seeing the alert, so what if you get a third party who wants to hack into your website in a certain way? You will end up by getting no alerts for that.
What i am looking for is to know if it's related to how my security structure is built, or is it a PEGA reated false alert or i need to do something about it.
If it's the case which it's that they are false alerts, then i'll ignore them i suppose.
Thanks again for your interaction!
Cox
IN
We are also having the similar issue post upgrade to 8.7.3 and several of our functionality got blocked due to the SECU0019 alerts. We also had the similar concern as we see that most of the activity names are Pega OOTB and might be final as well. However we were explained by Pega SME that this is an enhanced security feature Pega has brought in and recommends either registering it as described in the documents, or move to Theme-COSMOS. Making no comments we are convinced or not :) . I will suggest you can also raise a Pega SR to get further guidance on this.
@HamdiB90 Hi, Did you find a solution for the same?
we are using 8.6.2 and we have faced this security alert. Also in addition on the UI we faced Unauthorized access 403 error as well where we were not able to load sections which have Run Script in the action set.
As a work around , we have temporarily set pyBlockUnregisteredRequests to false. This is resolving the 403 errors and the blank screen to enable users to accomplish their work
We had to change the condtion pxProcess.pzProductionLevel >=7 as our production level was set to 5.
Check of this works