DbProtect v6.7.1 Installation and Upgrade Guide

​

DbProtect Core System Requirements

​

Component Version Information

​

Install and Upgrade Scenarios

​

Installing DbProtect for The First Time

​

Plan your DbProtect installation

​

Part 1: Installing DbProtect Core

1. Download the DbProtect setup packages from the LevelBlue Support page (scroll down to the Trustwave Support section) and save them into a convenient location (e.g., c:\temp).
2. The setup package is now delivered in a .zip file. Before launching the setup package, the user must first extract the zip file to the location of their choice. There will be an .exe and a resources folder; it’s important to not move these after extraction.
3. Launch the setup .exe. DbProtect setup will detect any missing prerequisites or previously installed components. It will display and disable those components that are up-to-date and highlight those that must be installed or upgraded.

4. Read and accept the license agreement every time you install or upgrade the software.
5. Click Install to begin installation of all components in the order they are listed. The installer may require a system restart and will resume after the system has re-started.
6. When the Welcome to the DbProtect Enterprise Services Host Setup Wizard opens, click Next.

​

Enterprise Services Host setup

1. Select Run service as local or domain user and then enter the account and password.
2. Click Test Credentials.

3. Click Next.
4. When the Ready to install DbProtect Enterprise Services Host page opens, click Install.
5. Click Finish when this install is complete.

​

Scan Engine Manager setup

1. On the Trustwave ScanEngineManager Bundle Prerequisite Setup dialog box, click Install.
2. Click Accept and Install.
3. Click Next. The Port Selection page displays.
4. Enter the port numbers and click Test Ports.
5. Click Next.
6. Click Install.
7. Click Finish once installation is complete.

​

Database component setup

1. Click Next. The DbProtect Schema Component repository page opens. You are prompted to select a database server and/or instance.
2. Enter a server name (SERVERNAME, which assumes a default instance); server name and instance (SERVERNAME\INSTANCE), or server name and port (SERVERNAME:PORT).
3. Click Next. The Database Creation Credentials page opens and prompts for database credentials.
4. Select Windows Authentication to use your current credentials during installation and credentials of the Enterprise Services Host service at runtime. SQL Authentication will be removed from the installer in a future release and will no longer be supported.
5. Click Test Connection.
6. (OPTIONAL) Click Modify Database Properties (after clicking Test Connection) to change the default paths.
7. Click Next. The Ready to install DbProtect Schema Component page opens.
8. Click Install.
9. After the install of the Schema Component is complete, click Finish.

​

Installing the SHATTER Knowledgebase

1. Click Next to continue. The Ready to install Trustwave SHATTER Knowledgebase page opens.
2. Click Install.
3. Click Finish after the install is complete. You are then prompted to install the Data Warehouse.

​

Data Warehouse setup

1. Click Next. The Data Warehouse Repository page opens. You are prompted to select a database server and/or instance.
2. Enter a server name (SERVERNAME, which assumes a default instance); server name and instance (SERVERNAME\INSTANCE), or server name and port (SERVERNAME:PORT).
3. Select the repository and click Next. The Database Creation Credentials page opens.
4. Select Windows Authentication to use your current credentials during installation and credentials of the Enterprise Services Host service at runtime. SQL Authentication will be removed from the installer in a future release and will no longer be supported.
5. Click Test Connection and then click Next. The Database Run Time Credentials page opens.
6. Click Test Connection.
7. Click Next.
8. Click Install when prompted to install the Data Warehouse.

​

Message Collector setup

1. Click Finish when prompted that the Data Warehouse Setup Wizard is complete. The DbProtect Message Collector Setup Wizard displays.
2. Click Next. The Service Logon Credentials page displays.
3. Select Run service as local or domain user, and then enter the account and password.
4. Click Test Credentials.
5. Click Next.
6. Click Install to begin the installation of the DbProtect Message Collector.
7. Click Finish to exit the Message Collector Setup Wizard. The DbProtect Analytics Setup Wizard displays.

​

DbProtect Analytics setup

1. Click Next.
2. Click Windows Authentication to use your current credentials during installation and credentials of the Enterprise Services Host service at runtime.
3. Click Test Connection and then click Next. The Reporting Engine Service Logon Credentials page opens.
4. Select Run service as local or domain user, and then enter the account and password.
5. Click Test Credentials.
6. After a location is chosen, click Next. The Report Store Folder page opens.
7. Click Browse if you want to choose a different location.
8. After a location is chosen, click Next. The Ready to Install DbProtect Analytics page opens.
9. Click Install.
10. Click Finish when prompted that the DbProtect Analytics Setup Wizard is complete. The DbProtect Analytics Content Setup Wizard is displayed.
11. Click Next.
12. Click Finish when prompted that the DbProtect Analytics Content Setup Wizard is complete. The Explorer Installer Wizard is displayed.

​

DbProtect Explorer Setup

1. Read and accept the license agreement, and then click Install to begin installation.
2. Click Next when the Welcome to the DbProtect Explorer Setup wizard opens.

3. Select Run as domain user and then enter the account and password. Using LocalSystem is being removed from the installer in a future release and is not supported.

4. Click Test Credentials.
5. Click Next.
6. Click Finish to complete the install. Accept the final confirmation.
7. Click OK when prompted that you have successfully installed DbProtect. You can now log in to your DbProtect account.

​

Part 2: Installing Scan Engine(s)

​

Scan engine system requirements

​

DbProtect Scan Engine Setup

1. Locate the Scan Engine setup package on the media provided or download it from the LevelBlue Support page (scroll down to the Trustwave Support section) to a convenient location (e.g., c:\temp).
2. Launch the setup package. The Scan Engine Setup will detect any missing prerequisites. This includes the Nmap installation, which will proceed first at this point if required. See Optional: Install Nmap for DbProtect for further details.
3. You must read and accept the license agreement every time you install or upgrade the software.
4. Click Accept and Install to begin the installation of all components in the order they are listed. The installer may require a system restart and will resume after the system has restarted.
5. The Scan Engine Setup installs a service that performs Vulnerability Assessment functions. After clicking Accept and Install you will choose the Destination Folder for the Scan Engine service files.
6. The installer prompts you for a destination folder. By default, the location is: C:\Program Files\Trustwave\ScanEngineServiceHost.
7. Click Next. The Service Log On Credentials page displays.
8. Type in your desired credentials. The Domain/Windows account must have Log On as Service rights. Test the credentials entered.
9. Click Next. The Port Selection page displays. With Scan Engine v3.24 or above, the suggested default listening port is 20010. Pay attention to this change in case any firewall rules changes may be required.
10. Enter the port number and click Test Ports.
11. Click Next. The WebSocket server page displays. This is a new configuration introduced with DbProtect v6.6.15 and Scan Engine v3.23. See Appendix B: Network ports used by DbProtect for further information.
12. Enter the WebSocket URL. This is the URL of your DbProtect console host. For example, if your DbProtect console hostname is myexampledbpconsole.com, then your WebSocket URL would be wss://myexampledbpconsole.com:28080/ws. This must be reachable from your scan engine to proceed.
13. Click Verify, then Next to proceed.
14. Click Install.
15. DbProtect Scan Engine Setup is now complete. Close the final dialog when finished.

​

Optional: Install Nmap for DbProtect

\your\path\to\Scan_Engine_{version}.exe -install IGNORE_NMAP=1

1. On the Trustwave Scan Engine Service Bundle Prerequisite Setup dialog, click Install.
2. On the Nmap Setup dialog, click I Agree.
3. Click Next.
4. Choose the destination folder, and then click Install.

5. Npcap is installed as part of Nmap installation. The Npcap Setup dialog opens. Click I Agree.
6. Select the appropriate options, and then click Install.
7. Click Next.
8. Click Finish to complete the Npcap installation.
9. Click Next. Installation of Nmap resumes.
10. Select the appropriate options, and then click Next.
11. Click Finish.

​

Your Initial DbProtect Login

​

Log into DbProtect Core

1. Enter https://[ConsoleServer]:[Port] in the address line, where:
   • [ConsoleServer] is the fully qualified hostname, hostname, or IP Address of the console server
   • [Port] is the port number where the Console Management Server has been configured to provide service. The default port as installed is 20080. Example: https://DbProtect_server:20080
2. A Security Alert message may be displayed, warning you of an invalid security certificate. You can safely continue past this message. DbProtect uses a self-generated SSL certificate by default to encrypt communications.

3. From the Log In menu, select Use Windows Authentication or Manually.
4. If you select Use Windows Authentication, DbProtect uses your Windows login credentials to log on to DbProtect.
5. If you select Manually, you are prompted to enter your login credentials.
6. In the Username field, enter your DbProtect username. You can also enter the domain information in this field in usual Windows format such as:
   • domain\username
   • username@domain
7. In the Password field, enter the password that matches the username.
8. Use the Domain menu to select the domain for the username or manually enter a domain in this field. If a domain option is specified as above, this field will be grayed out and will not be selectable.
9. Click Log In. If the credentials you entered are valid, DbProtect Core opens.

​

Logging into DbProtect Core using SSO

• Reducing time spent re-entering passwords for the same identity
• Reducing IT costs due to lower number of IT help desk calls about passwords
• Security on all levels of entry/exit/access to systems without the inconvenience of re-prompting users
• Centralized reporting for compliance adherence

1. Open your Chromium-based browser.
2. Enter https://[ConsoleServer]:[Port] in the address line, where:
   • [Server] is the fully qualified hostname, hostname, or IP Address of the console server
   • [Port] is the port number where the Console Management Server has been configured to provide service. The default port as installed is 20080. Example: https://DbProtect_server:20080
3. Accept the Security Alert pop-up that opens to accept the security certificate from LevelBlue.

​

Log in to DbProtect Explorer

1. Open your Chromium-based browser.
2. Enter https://[ConsoleServer]:[Port] in the Address line, where:
   • [ConsoleServer] is the hostname or IP Address of the Console server
   • [Port] is the port number where the Console Management Server has been configured to provide service. The default port as installed is 20083. Example: https://DbProtect_server:20083
3. A Security Alert message may be displayed, warning you of an invalid security certificate. You can safely continue past this message. DbProtect uses a self-generated SSL certificate by default to encrypt communications.

4. Enter the same login credentials you use to access DbProtect Core.
5. Click Sign In. If the credentials you entered are valid, DbProtect Explorer opens.

​

Licensing

1. Log in to DbProtect.
2. Click Settings | Licensing and then click on Add License.
3. Follow the on-screen instructions. All licenses are stored in the following directory on the console server:
   • [Install Directory]\Trustwave\DbProtect\Licenses

​

Integrate CyberArk and DbProtect

1. Prepare CyberArk for integration
2. Create and configure a DbProtect vault
3. Connect a CyberArk asset in DbProtect

​

Prepare CyberArk for Integration

1. Create a new CyberArk Safe that DbProtect will access.
2. Create an Application for DbProtect and grant it access to the safe created above.
3. Create a new database account that you will pull credentials from, and ensure you define the following:
   • Assign a Username and Password.
   • If you choose the Customize account name option, provide a unique account name. If you do not choose this option, the account name will be auto-generated by CyberArk. The name will be used to add an attribute to a DbProtect vault.
4. If DbProtect will use SSH to connect to the CyberArk vault, generate an SSH Certificate, Private Key, and Passphrase, and copy and paste them to Notepad (or a similar application).
5. Gather the following information:
   • Host name (e.g., ussecurityops.mycompany.com)
   • Port number (e.g., 8080)
   • API Endpoint (e.g., /AIMService/api/Accounts)
   • Application ID (found in the Applications list)
   • Safe name (found in the Details tab of the account view)

​

Configure a CyberArk vault in DbProtect

1. Log in to DbProtect Explorer and then go to Settings.
2. Click Vaults. The Vault table opens.
3. Click Add Vault in the upper left corner of the table. The Add Vault panel opens.
4. Type a Vault Title, which will be the name of the vault within DbProtect.
5. Select an existing Organization that the vault will belong to (see DbProtect User Guide, “Getting Started with DbProtect workflows” for guidance on creating a new organization).

6. Enter the Host name, Port number, and source URL required for DbProtect to connect to your company’s CyberArk account.
7. Enter the Application ID and Safe name.
8. If DbProtect will use client certificate authentication, click the Use Client Certificate option and copy and paste the values you saved when preparing CyberArk for integration.
9. If it is not already present in the Asset Identifier field, type IDENTIFIER_KEY.
10. Click Save. The newly-created vault, and its automatically-generated ID is shown in the Vaults table. This ID number will be required for connection to the CyberArk account.

​

Connect a DbProtect asset to a CyberArk account

1. Create a new asset (see the DbProtect User Guide, “Add an asset manually”).
2. On the new asset, add an attribute (name=IDENTIFIER_KEY with the value=[CyberArk Account Name]).

3. Export the organization’s credentials (see the DbProtect User Guide, “Import and export credentials”), select and copy the contents of the Credentials field and then:
   • Select the newly-created asset in the assets list and choose Manage Credentials | Import Organization Credentials.
   • Paste the credential you exported into the Credentials field.
   • Modify the text in the Credentials field by adding the following line immediately after the line type = database:
   vault id = [vault id of the CyberArk vault created in DbProtect Explorer]
   

​

Edit or Delete a DbProtect Vault

1. Log in to DbProtect and then go to Settings.
2. Click Vault. The Vault table opens.
3. Click the pencil icon that corresponds to the vault you want to edit. The Edit Vault panel opens.
4. Click Save when you are done making the necessary changes to the vault’s configuration.

1. Log in to DbProtect and then go to Settings.
2. Click Vault. The Vault table opens.
3. Click the pencil icon that corresponds to the vault you want to delete. The Edit Vault panel opens.
4. Scroll down to the bottom of the Edit Vault panel, and then click Delete Vault. The Confirmation dialog opens.
5. Click Delete Vault.

​

Integrate ServiceNow with DbProtect

1. Prepare ServiceNow for integration
2. Register DbProtect as a data source in ServiceNow
3. Set up the DbProtect to ServiceNow transform
4. Validate the setup and connectivity of ServiceNow

​

Prepare ServiceNow for Integration

1. Identify your corporate ServiceNow instance and associated administrator, or ensure you have administrator privileges to complete the integration.
2. Confirm whether or not the Vulnerability Response Core application is installed in your ServiceNow platform instance. If this is not available, your ServiceNow administrator can view your organization’s entitlements in the ServiceNow Store | ServiceNow Products section and enable the free app. After it is enabled, activate the plug-in and install the application.

3. If your network does not already have an MID server that has connectivity to the DbProtect repository AND the ServiceNow instance, identify and install an instance that can be used for this integration, and ensure the following:
   • Register the MID server with your ServiceNow instance
   • Confirm that the new instance appears in the MID Servers list and is showing as available and validated

​

Register DbProtect as a Data Source

1. Navigate to System Import Sets | Data Sources in ServiceNow and create the DbProtect data source and click New.
2. Provide a Name and Import set table label.

3. For the remaining fields make the following selections or inputs:
   • Type: JDBC
   • Use MID Server: select the MID server you identified and/or installed for this integration
   • Format: SQLServer
   • Instance Name: DBP
   • Database name: dbpdatawarehouse
   • Username and Password: the login credentials that ServiceNow will use to access the DbProtect database.
   • Server: address of the server housing the DbProtect repository
   • Query: Specific SQL
4. In the SQL statement field, copy and paste the following text:

SELECT dw_current_asset_organization_fact.org_key, dw_current_asset_organization_fact.asset_key, dw_current_asset_dim.asset_name, dw_current_asset_dim.default_host_address, dw_current_asset_dim.default_port, dw_current_asset_dim.asset_instance_name, dw_current_asset_dim.asset_generic_type,

dw_current_policy_check_mapping_fact.check_key, dw_check_dim.kb_check_id, dw_check_dim.name as check_name, dw_check_dim.analytics_category as category, dw_check_occ_detail_dim.check_occ_detail, dw_check_result_fact.check_result_status_key, resultstatus.display_value as result_status, risk.display_value as risk, (select sql_date from dw_date_dim where date_key = dw_latest_check_occurrence_cnt_fact.end_date_key) as lastscanend,

dw_check_dim.[summary], dw_check_dim.[overview], dw_check_dim.[reference], dw_check_dim.[fix_desc], dw_check_dim.[supported_db_versions], dw_check_dim.[cve_reference], dw_check_dim.[cce_reference], dw_check_dim.[fix_script]

FROM dw_current_policy_dim inner join dw_current_policy_check_mapping_fact on dw_current_policy_dim.policy_key = dw_current_policy_check_mapping_fact.policy_key inner join dw_current_org_policy_mapping_fact on dw_current_policy_dim.policy_key = dw_current_org_policy_mapping_fact.policy_key inner join dw_current_asset_organization_fact on dw_current_org_policy_mapping_fact.org_key = dw_current_asset_organization_fact.org_key inner join dw_current_asset_dim on dw_current_asset_dim.asset_key = dw_current_asset_organization_fact.asset_key inner join dw_check_result_fact on dw_check_result_fact.check_key = dw_current_policy_check_mapping_fact.check_key and dw_check_result_fact.asset_key = dw_current_asset_organization_fact.asset_key inner join dw_low_cardinal_dim risk on risk.attribute_key = dw_current_policy_check_mapping_fact.risk_key inner join dw_low_cardinal_dim resultstatus on resultstatus.attribute_key = dw_check_result_fact.check_result_status_key inner join dw_low_cardinal_dim checkstatus on checkstatus.attribute_key = dw_check_result_fact.check_status_key inner join dw_check_occurrence_fact on dw_check_result_fact.check_key = dw_check_occurrence_fact.check_key and dw_check_result_fact.asset_key = dw_check_occurrence_fact.asset_key and dw_check_result_fact.instance_key = dw_check_occurrence_fact.instance_key inner join dw_check_occ_detail_dim on dw_check_occ_detail_dim.check_occ_key = dw_check_occurrence_fact.check_occ_key inner join dw_check_dim on dw_check_result_fact.check_key = dw_check_dim.check_key inner join dw_latest_check_occurrence_cnt_fact on dw_check_result_fact.asset_key = dw_latest_check_occurrence_cnt_fact.asset_key and dw_check_result_fact.check_key = dw_latest_check_occurrence_cnt_fact.check_key and dw_check_result_fact.originating_org_key = dw_latest_check_occurrence_cnt_fact.originating_org_key inner join dw_current_organization_dim on dw_current_asset_organization_fact.org_key = dw_current_organization_dim.org_key inner join dw_date_dim on dw_check_result_fact.end_date_key = dw_date_dim.date_key where is_dop = 1 and dw_current_asset_organization_fact.is_direct = 1

/** filters as defined **/

--and dw_current_organization_dim.org_id = 2

--and dw_date_dim.year = 2021 and dw_date_dim.month = 2

--and resultstatus.display_value = 'Finding' and checkstatus.display_value = 'Completed' and risk.display_value in ('High','Medium','Low','Informational') and dw_check_result_fact.check_result_status_key in ( 39 , 40 ) and dw_check_result_fact.check_result_status_key in ( 39 , 40 )

5. Click Submit. The new data source is created.

​

Set up the DbProtect > ServiceNow transform

1. Navigate to System Import Sets | Schedule Data Imports.
2. Open the newly-created data source from the Data Sources list.
3. Scroll down to the Transforms tab, click New, and provide the following information:
   • Name: provide a unique name for this transform map
   • Target table: search for and select the “Vulnerable Item” table
4. Click Submit. You are returned to the data source page, and the new transform map is shown in the Table Transform Maps list at the bottom of the page.
5. Open the transform map you just created, scroll down to the Transform Scripts tab, and click New.
6. Select onBefore from the When drop-down list.
7. Copy and paste the following transform script into the Script code box, overwriting the existing sample text:

var severities = {
  "critical": 1,
  "high": 2,
  "medium": 3,
  "low": 4,
  "none": 5
};
var detail = true;
(function runTransformScript(source, map, log, target /*undefined onStart*/ ) {
  gs.warn("Started loading DbProtect!");
  var vul_item = new GlideRecord("sn_vul_vulnerable_item");
  var vul_id = new GlideRecord("sn_vul_third_party_entry");
  var asset = new GlideRecord("cmdb_ci");
  vul_item.initialize();
  vul_id.initialize();
  asset.initialize();
  ignore = true;
  vul_item.addQuery("external_id", "TW_" + source.u_asset_key + "_" + source.u_kb_check_id + source.u_check_result_status_key);
  if (detail) vul_item.addQuery("description", source.u_check_occ_detail);
  vul_item.query();
  if (vul_item.next()) {
    gs.info("Item is already there");
    if (vul_item.last_found_dt_tm < source.u_lastscanend) {
      vul_item.last_found_dt_tm = source.u_lastscanend;
      vul_item.ip_address = source.u_default_host_address;
      vul_item.port = source.u_default_port;
      vul_item.risk_rating = severities[source.u_risk.toLowerCase()] || 5;
      vul_item.times_found = source.u_numoccurrences;
      if ((source.u_result_status == "Not A Finding") && [1, 2, 10, 11, 12].includes(vul_item.state)) vul_item.state = 101;
      gs.info("Updating item");
      vul_item.update();
    }
    return;
  }

  // No existing ticket.
  if (source.u_result_status == "Not A Finding") return; // No ticket if Not a finding.
  var vul_id_used = false;
  var asset_used = false;
  if (!vul_item.canCreate()) {
    gs.error("Unable to create record in the table: sn_vul_vulnerable_item");
    return;
  }
  gs.warn("New Record: " + "TW_" + source.u_asset_key + "_" + source.u_kb_check_id + source.u_check_result_status_key);
  // if (i > 1) vul_item.newRecord(); // so that the Vulnerability Number is incremented
  vul_item.id = "TW_" + source.u_kb_check_id;
  vul_item.external_id = "TW_" + source.u_asset_key + "_" + source.u_kb_check_id + source.u_check_result_status_key;
  vul_item.description = detail ? source.u_check_occ_detail : source.u_overview;
  vul_item.ip_address = source.u_default_host_address;
  vul_item.port = source.u_default_port;
  vul_item.last_found_dt_tm = source.u_lastscanend;
  vul_item.source = "Trustwave DbProtect";
  vul_item.times_found = detail ? 1 : source.u_numoccurrences;
  if (source.u_result_status == "Finding") vul_item.state = 1;
  else vul_item.state = 101;
  vul_id.addQuery("id", "TW_" + source.u_kb_check_id);
  vul_id.query();
  if (vul_id.next()) {
    gs.debug("Found linked: " + vul_id.u_vulnerability_id + " " + vul_id.u_vulnerability_summary);
    vul_item.vulnerability = vul_id.sys_id;
  } else {
    gs.debug("NOT Found linked");
    if (vul_id_used) vul_id.newRecord();
    vul_id.id = "TW_" + source.u_kb_check_id;
    vul_id.normalized_severity = severities[source.u_risk.toLowerCase()] || 5;
    vul_id.risk_rating = severities[source.u_risk.toLowerCase()] || 5;
    vul_id.source_severity = severities[source.u_risk.toLowerCase()] || 5;
    vul_id.summary = source.u_summary;
    vul_id.solution = source.u_fix_desc;
    vul_id.threat = source.u_overview;
    vul_id.name = source.u_check_name;
    vul_item.vulnerability = vul_id.insert();
    vul_id_used = true;
  }
  vul_item.risk_rating = severities[source.u_risk.toLowerCase()] || 5;
  vul_item.insert();
})(source, map, log, target);

8. Modify the line vul_item.source = "Trustwave DbProtect";, replacing Trustwave DbProtect with [your Source table name].
9. Return to the data source page.

​

Validate setup and connectivity of ServiceNow

1. From the Data Sources list, open your new data source.
2. Scroll down and click Test Load 20 Records to validate the connection and setup. If the setup was completed correctly, you should see a Completion code of “Success”. If you do not, review the inputs you provided in Register DbProtect as a data source and Set up the DbProtect > ServiceNow transform.
3. Optional: When the validation is complete, you can click Load all Records to check the sample. Select the newest set, then select a row to display the finding record from DbProtect.
4. Click Run Transform. If the transform script was correctly modified, you will see a Completion code of “Success”.
5. When the transform is complete, you can review the results under Next steps. The file will open showing the 20 records loaded in the step above, and each can be opened individually to examine the results.
6. Return to the ServiceNow All menu, search for and select Vulnerability Response | Vulnerable Items | All.

​

Upgrade from previous versions

​

Upgrade scenarios

​

Product release history

​

Pre-upgrade tasks

1. Ensure connectivity from each Scan Engine to the Scan Engine Manager port (default port is 28080). This was new as of DbProtect v6.7.0.
2. Unregister any Linux Scan Engines prior to upgrading Core.
3. Confirm the hardware and operating system specifications on the system that has the console installed.
4. Verify backups of the OS were created. If working with a virtual machine, ensure that you take a snapshot or backup of the appliances prior to upgrading.
5. Verify that a backup of the databases was taken.
6. Confirm you are using the same user that ran the original installation or have access to that user.
7. Execute system help check scripts and check for free space on the database host. Free some log file space if necessary.
8. Check for 30GB plus free disk space on the host and drive where the console is being installed.
9. Verify you have an admin user that has sysadmin rights on the database for schema change commands.
10. Check whether you have URR data. This will require extensive transaction log space during the upgrade.
11. Check whether the name of your install directory is less than 27 characters long. If it is, then direct upgrade can occur. If it is not, see Appendix G: Upgrading with pathnames over 27 characters for the steps required to satisfy this condition.
12. Make a full back up or copy of all the DbProtect backend databases: AppDetective, DbPStaging, and DbPDataWarehouse.
13. Prepare to back up your DbProtect licenses, policies, filters, credential profiles, asset lists and custom dictionaries in case problems occur during the upgrade.
14. Make a backup of your License files from the <InstallDir>\DbProtect\Licenses directory.
15. Export your custom Vulnerability Management Policies and exceptions. For further information, please contact Product Support.
16. Download the DbProtect unified installer and DbProtect Scan Engine installer files.
17. Download Analytics Content and Knowledgebase updates if available. After the install is complete, you can then specifically upgrade the Analytics Content and SHATTER Knowledgebase to ensure that you have the latest monthly update.
18. Uninstall Explorer (if present) using the Add or Remove programs option and delete the explorer folder before beginning the upgrade process.

​

Upgrading to v6.7.1

1. Download the DbProtect setup packages from the LevelBlue Support page (scroll down to the Trustwave Support section). Once done, store them in a convenient location (e.g., c:\temp).
2. Launch the setup package. DbProtect Setup will detect any missing prerequisites or previously installed components. It will display and disable those components that are up-to-date and highlight those that must be installed or upgraded. The DbProtect suite installer deploys all components into a common area.

3. Read and accept the license agreement every time you install or upgrade the software.
4. Click Install to begin installation of all components in the order they are listed. The installer may require a system restart and will resume after the system has re-started.

​

Install and runtime privileges

​

DbProtect Scan Engine (for Windows) upgrade steps

1. Right click on the Scan Engine executable and select Run as administrator. The Trustwave Scan Engine installer opens.
2. Proceed through the DbProtect Scan Engine Setup steps outlined in DbProtect Scan Engine setup.

3. Once the scan engine has been upgraded, confirm that you can see it on the DbProtect console.

​

System Finalizer

1. Select the I have read and accept the license agreement checkbox.
2. Click Install.
3. Click OK when you see the Successfully installed prompt.

​

Post upgrade validation tasks

1. Log in to DbProtect.
2. Check that organizations and assets are visible.
3. Restart any scan engines that were stopped prior to the upgrade.
4. Force ETL (extraction, transformation, loading of data into the Data Warehouse).
5. Check that you can access the dashboards and the report library.
6. Run the system diagnostic tool.
7. Create and run test job.
8. Export your check result data.
9. Run a report on the data.
10. Set up your jobs.
11. Install any downloaded monthly updates to the Analytics Content and the SHATTER Knowledgebase.

​

Uninstall the DbProtect components

​

Before you uninstall the DbProtect Suite components

​

Uninstall the DbProtect console components from the Start menu

1. Choose Start | Trustwave | DbProtect | Uninstall DbProtect to display the uninstallation wizard.
2. Follow the prompts. The order of the uninstallation process is the exact opposite of the DbProtect suite component installation process (for more information, see Installing DbProtect for the first time).

3. A message informs you when the uninstallation is complete. Click Finish.

​

Uninstall DbProtect Explorer

1. Navigate to Control Panel | Programs and Features.
2. Select DbProtect Explorer and click Uninstall.

​

Uninstall and unregister a scan engine

​

Unregister a scan engine

1. Log into DbProtect.
2. Click Settings | Scan Engines on the toolbar.
3. Select the scan engine you want to unregister and click Unregister. A message will display asking for confirmation of this action.

​

Uninstall a scan engine

​

Appendix A: Creating your own Microsoft SQL Server AppDetective database

1. Create the AppDetective Microsoft SQL Server database with COLLATE Latin1_General_CI_AI.
2. Set the following AppDetective Microsoft SQL Server database options:

'autoclose'='false'
'bulkcopy'='false'
'trunc. log'='false'
'torn page detection'='true'
'read only'='false'
'dbo use'='false'
'single'='false'
'autoshrink'='false'
'ANSI null default'='false'
'recursive triggers'='false'
'ANSI nulls'='false'
'concat null yields null'='false'
'cursor close on commit'='false'
'default to local cursor'='false'
'quoted identifier'='false'
'ANSI warnings'='false'
'auto create statistics'='true'
'auto update statistics'='true'

​

Appendix B: Network ports used by DbProtect

​

Appendix C: Modifying the Log On As user for DbProtect services

• When you install DbProtect, the Database Runtime Configuration page allows you to configure your DbProtect runtime user account. This is the “log on as” user, i.e., the user whose privileges are used to log into and use DbProtect.
• You can connect to your custom SQL Server instance using Windows Authentication. The latter uses the LocalSystem account as the run-as user for the services installed (i.e., DbProtect and DbProtect Message Collector).

1. Go to Start | Control Panel to display the Control Panel.
2. Double-click the Administrative Tools icon.
3. Double-click the Services icon to display the Services dialog.
4. Highlight a service (e.g., DbProtect Message Collector) to display the DbProtect Message Collector Properties dialog.
5. Click the Log On tab to display the Log on as portion of the DbProtect Message Collector Properties dialog.
6. Select This account and enter the:
   • new “log on as” user’s domain name\user name (or click Browse to display the Select User pop-up and locate a valid user)
   • password for the specified user
7. Click Apply. A message informs you the revised “log on as” account change will not take effect until you reboot your computer.
8. Click OK.

​

Appendix D: DbProtect log files

​

Appendix E: Required Audit Privileges

<InstallDir>\DbProtect\Resources\ShatterKnowledgebase\UserCreationScripts

• CreateUser[Asset].sql: creates a user called ‘aduser’ and will grant read-only permissions needed to run audit policy scans.
• CreateUser[Asset]URR.sql: creates a user called ‘aduserURR’ and will grant read-only permissions needed to run audit policy and user rights review scans.
• CreatePowerUser[Asset].sql: creates a user called ‘aduser_admin’ and will grant elevated privileges (i.e. SYSDBA for Oracle).
• CreateUser[Asset]SA.sql: specific for Microsoft SQL Server and creates a user called ‘aduser’ and will grant sysadmin rights.

<InstallDir>\DbProtect\Resources\ShatterKnowledgebase

​

Appendix F: Auditing SQL Server against a machine on a different or untrusted domain

SQLSTATE: 28000, Native error: 18452, Message: [Microsoft][ODBC SQL Server Driver][SQL Server]Login failed for user ''. The user is not associated with a trusted SQL Server connection.

1. Establish a connection to the target server.
2. Enter the appropriate Net Use syntax. For a remote host that is a:
   • member of domain, enter net use \\ip /user:domain\username
   • workgroup member (standalone computer), enter net use \\ip /user:username or net use \\ip /user:computername\username
3. Use named pipes to connect to an untrusted domain.
4. Select the Properties branch option Connect to Microsoft SQL Servers using Named Pipes. You must check this option when auditing a SQL Server database in an untrusted domain.

5. Confirm the following:
   • Server and Remote Registry services on your remote host are running.
   • Net Use set of credentials file being used is a member of either the domain hosting the target server, or a domain that is trusted by that domain.
   • Login provides remote registry access and read-only file access to the remote machine. To check this:
     • Enter net use \\server with your credentials and expand HKEY_LOCAL_MACHINE on the target server.
     • Enter net use \\server\c$ to verify you can access files on the target server.
   • Access to the remote host can be restricted by firewall, which has been common in many versions of Windows. You can verify this on the remote host by looking into the firewall settings/logs for rejected packets. This means there should be connectivity on port 445 or 139 on the target host.
6. Do the following to create and test a DSN connection to the target host:
   1. Choose Control Panel | Administrative Tools | Data Sources (ODBC).
   2. Open the System DSN tab and click Add.
   3. Choose Microsoft SQL Server from the list.
   4. Click Finish.
   5. Enter a Name and Description for this data source entry.
   6. In the Server field, enter the IP address and listening port of the target server, e.g., 172.27.190.58,1756.
   7. Click Next.
   8. Select SQL Server Authentication and enter your database credentials in the Login ID and Password fields.
   9. Click Next.
   10. Follow the steps in the wizard.

​

Appendix G: Upgrading with pathnames over 27 characters

1. Verify you have backups of the databases and OS.
2. Backup the following directories on the console server:
   • ..\Trustwave\DbProtect\Analytics\content\report_store
   • ..\Trustwave\DbProtect\Licenses
   • ..\Trustwave\DbProtect\Message Collector\conf\runtime_config.xml
3. Uninstall DbProtect by using the Uninstall DbProtect shortcut from Start | Programs.
4. When the uninstall is complete, check Windows’ Programs and Features to confirm that the following components have been uninstalled:
   • SHATTER Knowledgebase
   • DbProtect Analytics Content
5. If either or both of these items are still present in the Programs and Features list, uninstall them manually before proceeding.
6. Delete the directory structure, if any remains.
7. Reboot the server.
8. Proceed to the installation steps of installing v6.7.1.

​

Appendix H: Working product after license overage

​

Appendix I: Installation troubleshooting

​

Are there firewall issues I should consider?

​

”Error Occurred. The DbProtect database is not available at the moment. Please retry your request later.” What should I do?