> ## Documentation Index > Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt > Use this file to discover all available pages before exploring further. # DbProtect v6.7.1 Installation and Upgrade Guide > System requirements, first-time installation, scan engine setup, integrations, upgrade, and uninstall procedures for LevelBlue DbProtect v6.7.1. **Version 6.7.1 ยท July 2026** ## DbProtect Core System Requirements The following provides guidance on the system requirements for the DbProtect Suite. | Requirement | Description | | - | - | | Memory | | | Processor | | | Disk | DbProtect requires approximately 30GB for software installation. The following space allocations are recommended for the application drive, based on anticipated results. | | Operating Systems | | | Install Path | Do not install on the same drive as the operating system. For larger deployments, it is recommended to configure the report store to a location other than the DbProtect installation directory.

The root install path is limited to 27 characters. To install DbProtect v6.7.1, you must install it at the root of a drive (e.g., `D:\Trustwave\DbProtect`).

To calculate the character count, remove the drive (`D:\` in the example provided) and count the rest. In the example provided it would be a character count of 19. | | Networking and Firewall Ports | See [Appendix B: Network ports used by DbProtect](#appendix-b-network-ports-used-by-dbprotect) | | SQL Server Repository Considerations | DbProtect requires a back-end database, which you connect to using Windows domain service account. Using local system or SQL Authentication is not supported.

Supported Databases: | | Console Browser | Using DbProtect requires a modern Chromium-based browser. | | Microsoft .NET | .NET Framework 4.7.2, .NET Framework 8.0 | | Scan Engines | | | Credentials | A Local or Domain Administrative account is required for installation. | | Nmap | A minimum of v7.94 is required for discovery scanning within DbProtect: | ## Component Version Information To determine the current version of any installed DbProtect software components, log into DbProtect, select the **Administration** tab, and click **About DbProtect** in the navigation menu. DbProtect v6.7.1 is only compatible with scan engine versions 3.25, 3.24 and 3.22. It is strongly recommended that you upgrade all scan engines to version 3.25 for optimal performance. DbProtect v6.7.1 is NOT compatible with scan engine versions 3.23, 3.21, or earlier. ## Install and Upgrade Scenarios After ensuring the system requirements for DbProtect v6.7.1 are met, select the appropriate scenario below: | Scenario | Description | | - | - | | First time installation | If you are installing it for the first time, go to [Installing DbProtect for the first time](#installing-dbprotect-for-the-first-time). | | Upgrade | If you are using an older version of DbProtect and wish to upgrade to the latest version, go to [Upgrade from previous versions](#upgrade-from-previous-versions). | | Reinstall | If you have uninstalled this product and are reinstalling, go to [Upgrade scenarios](#upgrade-scenarios). | ## Installing DbProtect for The First Time ### Plan your DbProtect installation Once you have identified the proper environment, you are ready to install and provision DbProtect for first time use. LevelBlue does not support the installation or running of DbProtect in a containerized environment. ### Part 1: Installing DbProtect Core The DbProtect unified installer will detect prerequisites and install the necessary components, including DbProtect Explorer. You must run the DbProtect Core installation and ensure that all the included components have completed successfully before running the DbProtect Explorer installation. 1. Download the DbProtect setup packages from the [LevelBlue Support](https://www.levelblue.com/company/support) page (scroll down to the Trustwave Support section) and save them into a convenient location (e.g., `c:\temp`). 2. The setup package is now delivered in a .zip file. Before launching the setup package, the user must first extract the zip file to the location of their choice. There will be an .exe and a resources folder; it's important to not move these after extraction. 3. Launch the setup .exe. DbProtect setup will detect any missing prerequisites or previously installed components. It will display and disable those components that are up-to-date and highlight those that must be installed or upgraded. The DbProtect unified installer deploys all components into a common area. LevelBlue recommends installing on the root of a drive such as `[Drive]:\LevelBlue\DbProtect`. 4. Read and accept the license agreement every time you install or upgrade the software. 5. Click **Install** to begin installation of all components in the order they are listed. The installer may require a system restart and will resume after the system has re-started. 6. When the **Welcome to the DbProtect Enterprise Services Host Setup Wizard** opens, click **Next**. #### Enterprise Services Host setup The Enterprise Services Host setup prompts for Service Log On Credentials. This step allows you to specify the user DbProtect will use to run the DbProtect Enterprise Services Host service. To set up the Enterprise Services Host: 1. Select **Run service as local or domain user** and then enter the account and password. 2. Click **Test Credentials**. * Ensure the user already has the "Logon as a service" privilege. A user can be granted this privilege in the Windows Administrative Tools Local Security Settings application under **Local Policies | User Rights Assignment**. * The selected user must be allowed to connect to the Active Directory domain (for such operations as checking user credentials during logon to DbProtect Core) and must have access to the DbProtect back-end databases when using Windows Integrated Authentication. 3. Click **Next**. 4. When the **Ready to install DbProtect Enterprise Services Host** page opens, click **Install**. 5. Click **Finish** when this install is complete. #### Scan Engine Manager setup ScanEngineManager is a new service that replaces ScanEngineProxy as of DbProtect v6.6.15. Installer may not show an icon on the Task Bar. Keep all other windows minimized during installation. To set up the ScanEngineManager: 1. On the **Trustwave ScanEngineManager Bundle Prerequisite Setup** dialog box, click **Install**. 2. Click **Accept and Install**. 3. Click **Next**. The Port Selection page displays. 4. Enter the port numbers and click **Test Ports**. 5. Click **Next**. 6. Click **Install**. 7. Click **Finish** once installation is complete. #### Database component setup After the previous install procedure is completed, the DbProtect Schema Component Setup wizard opens. The Schema Component setup creates a Microsoft SQL Server database for DbProtect operational data. The database is called AppDetective. You can manually create your own AppDetective Microsoft SQL Server database when needed, as long as it adheres to the specific requirements (see [Appendix A: Creating your own Microsoft SQL Server AppDetective database](#appendix-a-creating-your-own-microsoft-sql-server-appdetective-database)). To set up the Database Component: 1. Click **Next**. The DbProtect Schema Component repository page opens. You are prompted to select a database server and/or instance. 2. Enter a server name (`SERVERNAME`, which assumes a default instance); server name and instance (`SERVERNAME\INSTANCE`), or server name and port (`SERVERNAME:PORT`). 3. Click **Next**. The Database Creation Credentials page opens and prompts for database credentials. 4. Select **Windows Authentication** to use your current credentials during installation and credentials of the Enterprise Services Host service at runtime. SQL Authentication will be removed from the installer in a future release and will no longer be supported. 5. Click **Test Connection**. 6. (OPTIONAL) Click **Modify Database Properties** (after clicking Test Connection) to change the default paths. 7. Click **Next**. The Ready to install DbProtect Schema Component page opens. 8. Click **Install**. 9. After the install of the Schema Component is complete, click **Finish**. DbProtect does not store the credentials provided in this step unless you select the **Remember the database credentials for upgrades** checkbox. #### Installing the SHATTER Knowledgebase After the installation of the Schema Component, you are prompted to install the SHATTER Knowledgebase. To install the SHATTER Knowledgebase: 1. Click **Next** to continue. The Ready to install Trustwave SHATTER Knowledgebase page opens. 2. Click **Install**. 3. Click **Finish** after the install is complete. You are then prompted to install the Data Warehouse. #### Data Warehouse setup The Data Warehouse setup creates two Microsoft SQL Server databases for DbProtect's reporting data. The databases are called *dbpdatawarehouse* and *dbpstaging*. After the SHATTER Knowledgebase is installed, you are prompted to install the Data Warehouse. The Data Warehouse Setup prompts for a database server and/or instance, as well as database access credentials, similar to the Data Component Setup. To set up the Data Warehouse: 1. Click **Next**. The Data Warehouse Repository page opens. You are prompted to select a database server and/or instance. 2. Enter a server name (`SERVERNAME`, which assumes a default instance); server name and instance (`SERVERNAME\INSTANCE`), or server name and port (`SERVERNAME:PORT`). 3. Select the repository and click **Next**. The Database Creation Credentials page opens. 4. Select **Windows Authentication** to use your current credentials during installation and credentials of the Enterprise Services Host service at runtime. SQL Authentication will be removed from the installer in a future release and will no longer be supported. 5. Click **Test Connection** and then click **Next**. The Database Run Time Credentials page opens. 6. Click **Test Connection**. 7. Click **Next**. 8. Click **Install** when prompted to install the Data Warehouse. #### Message Collector setup To set up and install the Message Collector: 1. Click **Finish** when prompted that the Data Warehouse Setup Wizard is complete. The DbProtect Message Collector Setup Wizard displays. 2. Click **Next**. The Service Logon Credentials page displays. 3. Select **Run service as local or domain user**, and then enter the account and password. 4. Click **Test Credentials**. 5. Click **Next**. 6. Click **Install** to begin the installation of the DbProtect Message Collector. 7. Click **Finish** to exit the Message Collector Setup Wizard. The DbProtect Analytics Setup Wizard displays. #### DbProtect Analytics setup The next step will open the DbProtect Analytics Setup Wizard. To complete the DbProtect Analytics Setup: 1. Click **Next**. 2. Click **Windows Authentication** to use your current credentials during installation and credentials of the Enterprise Services Host service at runtime. 3. Click **Test Connection** and then click **Next**. The Reporting Engine Service Logon Credentials page opens. 4. Select **Run service as local or domain user**, and then enter the account and password. 5. Click **Test Credentials**. 6. After a location is chosen, click **Next**. The Report Store Folder page opens. 7. Click **Browse** if you want to choose a different location. 8. After a location is chosen, click **Next**. The Ready to Install DbProtect Analytics page opens. 9. Click **Install**. 10. Click **Finish** when prompted that the DbProtect Analytics Setup Wizard is complete. The DbProtect Analytics Content Setup Wizard is displayed. 11. Click **Next**. 12. Click **Finish** when prompted that the DbProtect Analytics Content Setup Wizard is complete. The Explorer Installer Wizard is displayed. #### DbProtect Explorer Setup DbProtect Explorer is installed on the same drive as DbProtect Core and does not have additional requirements. To install DbProtect Explorer: 1. Read and accept the license agreement, and then click **Install** to begin installation. 2. Click **Next** when the Welcome to the DbProtect Explorer Setup wizard opens. This installer will use the same directory and database repository server and instance used by the DbProtect Core installer. 3. Select **Run as domain user** and then enter the account and password. Using *LocalSystem* is being removed from the installer in a future release and is not supported. If you are not sure which authentication type to select, see your Database Administrator. 4. Click **Test Credentials**. 5. Click **Next**. 6. Click **Finish** to complete the install. Accept the final confirmation. 7. Click **OK** when prompted that you have successfully installed DbProtect. You can now log in to your DbProtect account. ### Part 2: Installing Scan Engine(s) #### Scan engine system requirements This section provides system requirements for the DbProtect scan engine. * The DbProtect v6.7.1 installer includes a new ScanEngineManager component which is a replacement for the ScanEngineProxy component included with DbProtect v6.6.13 and earlier. ScanEngineManager requires a default port of 28080 to be open. This will be part of the WebSocket URL configured during the installation setup (e.g., `wss://hostname:28080/ws`). * Scan Engine Host v3.25 does not require any inbound ports to be open. However, for the purpose of identifying the scan engine, the default port 20010 is being used. This port does not need to be open. | Requirement | Description | | - | - | | Hardware | 2GHz processor required.

A minimum of two cores is required, 4 or more is recommended as the DbProtect Scan Engine will take advantage of multiple cores. | | Memory | 4GB RAM Minimum, 2GB/core recommended | | Operating System | Windows Server 2016, Windows Server 2019, Windows Server 2022 64-bit Standard Editions | | Disk Space | The installer unpacks installer files to the default temporary folder location. This is usually on your system drive. Therefore, you must have a minimum of 2GB of disk space on your system drive for new installations and upgrades.

DbProtect Scan Engine requires a minimum of 4GB disk space to operate. | | Required Microsoft .NET version | Latest Microsoft Windows Desktop Runtime v8.x.x (x64) | | Account Rights and Privileges | A Local or Domain Administrative account is required for installation | | Additional Driver Requirements | Some databases require additional drivers to be installed | Scan Engine uses the open-source utility Nmap to support its discovery tasks. Installation of Nmap is a prerequisite for this functionality. Scan Engine v3.25 will prompt to install Nmap v7.99 during installation. If the system on which the scan engine will be installed does not have Nmap pre-installed, and it does have internet connectivity, the scan engine installer will detect this and assist with the installation of Nmap before proceeding automatically to the rest of the scan engine install or upgrade. #### DbProtect Scan Engine Setup To install DbProtect Scan Engine: 1. Locate the Scan Engine setup package on the media provided or download it from the [LevelBlue Support](https://www.levelblue.com/company/support) page (scroll down to the Trustwave Support section) to a convenient location (e.g., `c:\temp`). 2. Launch the setup package. The Scan Engine Setup will detect any missing prerequisites. This includes the Nmap installation, which will proceed first at this point if required. See [Optional: Install Nmap for DbProtect](#optional-install-nmap-for-dbprotect) for further details. 3. You must read and accept the license agreement every time you install or upgrade the software. 4. Click **Accept and Install** to begin the installation of all components in the order they are listed. The installer may require a system restart and will resume after the system has restarted. 5. The Scan Engine Setup installs a service that performs Vulnerability Assessment functions. After clicking **Accept and Install** you will choose the Destination Folder for the Scan Engine service files. 6. The installer prompts you for a destination folder. By default, the location is: *C:\Program Files\Trustwave\ScanEngineServiceHost*. 7. Click **Next**. The Service Log On Credentials page displays. 8. Type in your desired credentials. The Domain/Windows account must have Log On as Service rights. Test the credentials entered. 9. Click **Next**. The Port Selection page displays. With Scan Engine v3.24 or above, the suggested default listening port is 20010. Pay attention to this change in case any firewall rules changes may be required. 10. Enter the port number and click **Test Ports**. 11. Click **Next**. The WebSocket server page displays. This is a new configuration introduced with DbProtect v6.6.15 and Scan Engine v3.23. See [Appendix B: Network ports used by DbProtect](#appendix-b-network-ports-used-by-dbprotect) for further information. 12. Enter the WebSocket URL. This is the URL of your DbProtect console host. For example, if your DbProtect console hostname is *myexampledbpconsole.com*, then your WebSocket URL would be `wss://myexampledbpconsole.com:28080/ws`. This must be reachable from your scan engine to proceed. 13. Click **Verify**, then **Next** to proceed. 14. Click **Install**. 15. DbProtect Scan Engine Setup is now complete. Close the final dialog when finished. #### Optional: Install Nmap for DbProtect This procedure only applies if you have not installed Nmap for DbProtect previously. Nmap is required to ensure the Discovery jobs functionality will work. * The Scan Engine installer requires Nmap version of at least 7.94. * If Nmap is already installed on the system, make sure that it is v7.94 or above. Scan Engine v3.25 will prompt to install Nmap v7.99. * If Nmap is NOT already installed, the Scan Engine can download and install it automatically, but internet access and the appropriate system privileges to download and install are required. * If you do not want to install Nmap (without Nmap, the Nmap Discover Service will not detect assets), run the following from a command line: ```bash theme={null} \your\path\to\Scan_Engine_{version}.exe -install IGNORE_NMAP=1 ``` To install Nmap for DbProtect: 1. On the **Trustwave Scan Engine Service Bundle Prerequisite Setup** dialog, click **Install**. 2. On the Nmap Setup dialog, click **I Agree**. 3. Click **Next**. 4. Choose the destination folder, and then click **Install**. Nmap and Npcap MUST be installed on `c:\`. 5. Npcap is installed as part of Nmap installation. The Npcap Setup dialog opens. Click **I Agree**. 6. Select the appropriate options, and then click **Install**. 7. Click **Next**. 8. Click **Finish** to complete the Npcap installation. 9. Click **Next**. Installation of Nmap resumes. 10. Select the appropriate options, and then click **Next**. 11. Click **Finish**. ## Your Initial DbProtect Login There are two login interfaces: DbProtect Core and DbProtect Explorer. ### Log into DbProtect Core To use a browser to connect to DbProtect Core: 1. Enter `https://[ConsoleServer]:[Port]` in the address line, where: * `[ConsoleServer]` is the fully qualified hostname, hostname, or IP Address of the console server * `[Port]` is the port number where the Console Management Server has been configured to provide service. The default port as installed is 20080. Example: `https://DbProtect_server:20080` 2. A Security Alert message may be displayed, warning you of an invalid security certificate. You can safely continue past this message. DbProtect uses a self-generated SSL certificate by default to encrypt communications. DbProtect is designed to use only Secure Sockets Layer (SSL) communication, which encrypts your username and credentials prior to transmission to DbProtect. DbProtect then uses the Windows Authentication subsystem to verify the credentials. For information about how to generate and install a valid certificate, please contact [LevelBlue Support](https://www.levelblue.com/company/support). 3. From the Log In menu, select **Use Windows Authentication** or **Manually**. 4. If you select **Use Windows Authentication**, DbProtect uses your Windows login credentials to log on to DbProtect. 5. If you select **Manually**, you are prompted to enter your login credentials. 6. In the **Username** field, enter your DbProtect username. You can also enter the domain information in this field in usual Windows format such as: * `domain\username` * `username@domain` 7. In the **Password** field, enter the password that matches the username. 8. Use the **Domain** menu to select the domain for the username or manually enter a domain in this field. If a domain option is specified as above, this field will be grayed out and will not be selectable. 9. Click **Log In**. If the credentials you entered are valid, DbProtect Core opens. Select the **Remember my settings** checkbox to store your Username, Password and Domain login values. Click **Reset** to reset the entered Username, Password and Domain login values. Every DbProtect Core page includes global navigation elements. For more information on navigating the console, see the *DbProtect User Guide*. ### Logging into DbProtect Core using SSO DbProtect allows you to use Windows authentication to log into DbProtect Core using a login mechanism known as single sign-on (SSO). SSO capability only works on Microsoft Windows systems. If Windows authentication is properly configured, you can log into DbProtect Core using a modern browser that is configured properly without having to enter a username and password. For security purposes, SSO is ideally combined with strong authentication methods like smart cards or one-time password tokens. There are numerous benefits to implementing SSO. For example, SSO reduces the proliferation of user accounts and passwords and enables a more secure environment. It also eliminates the need for DbProtect users to remember an additional password. Other benefits include: * Reducing time spent re-entering passwords for the same identity * Reducing IT costs due to lower number of IT help desk calls about passwords * Security on all levels of entry/exit/access to systems without the inconvenience of re-prompting users * Centralized reporting for compliance adherence To implement SSO, you (or your administrator) must modify several configuration files. For more information, please contact [LevelBlue Support](https://www.levelblue.com/company/support). To log into DbProtect Core using SSO: 1. Open your Chromium-based browser. 2. Enter `https://[ConsoleServer]:[Port]` in the address line, where: * `[Server]` is the fully qualified hostname, hostname, or IP Address of the console server * `[Port]` is the port number where the Console Management Server has been configured to provide service. The default port as installed is 20080. Example: `https://DbProtect_server:20080` 3. Accept the Security Alert pop-up that opens to accept the security certificate from LevelBlue. DbProtect uses this certificate to communicate with users over a secure channel. If an "access denied" pop-up appears and you are prompted to enter your credentials, this means you do not have access to the DbProtect system despite being a valid Windows user. Should this happen, contact your DbProtect administrator to obtain access to the DbProtect system. DbProtect Core opens. For more information on navigating the console, see the *DbProtect User Guide*. ### Log in to DbProtect Explorer In order to login to Explorer, the Core must first be licensed with at least one organization created. To log in to DbProtect Explorer: 1. Open your Chromium-based browser. 2. Enter `https://[ConsoleServer]:[Port]` in the Address line, where: * `[ConsoleServer]` is the hostname or IP Address of the Console server * `[Port]` is the port number where the Console Management Server has been configured to provide service. The default port as installed is 20083. Example: `https://DbProtect_server:20083` 3. A Security Alert message may be displayed, warning you of an invalid security certificate. You can safely continue past this message. DbProtect uses a self-generated SSL certificate by default to encrypt communications. DbProtect is designed to use only Secure Sockets Layer (SSL) communication, which encrypts your username and credentials prior to transmission to DbProtect. DbProtect then uses the Windows Authentication subsystem to verify the credentials. For information about how to generate and install a valid certificate, please contact [LevelBlue Support](https://www.levelblue.com/company/support). 4. Enter the same login credentials you use to access DbProtect Core. 5. Click **Sign In**. If the credentials you entered are valid, DbProtect Explorer opens. ## Licensing You can install your license files directly from the web interface. To install license files: 1. Log in to DbProtect. 2. Click **Settings | Licensing** and then click on **Add License**. 3. Follow the on-screen instructions. All licenses are stored in the following directory on the console server: * `[Install Directory]\Trustwave\DbProtect\Licenses` ## Integrate CyberArk and DbProtect DbProtect's integration with CyberArk enables users to perform audit scans on their assets and credentials through CyberArk's proprietary identity security and access management tools. These can be done from within DbProtect's interface. The integration workflow is as follows: 1. Prepare CyberArk for integration 2. Create and configure a DbProtect vault 3. Connect a CyberArk asset in DbProtect These steps must be completed in the order above to ensure the systems will connect and communicate, allowing scan jobs to be completed successfully. ### Prepare CyberArk for Integration Before proceeding with the setup of DbProtect, there are tasks that must first be completed in CyberArk by a user with Administrator privileges: 1. Create a new CyberArk Safe that DbProtect will access. 2. Create an Application for DbProtect and grant it access to the safe created above. 3. Create a new database account that you will pull credentials from, and ensure you define the following: * Assign a Username and Password. * If you choose the **Customize account name** option, provide a unique account name. If you do not choose this option, the account name will be auto-generated by CyberArk. The name will be used to add an attribute to a DbProtect vault. 4. If DbProtect will use SSH to connect to the CyberArk vault, generate an SSH Certificate, Private Key, and Passphrase, and copy and paste them to Notepad (or a similar application). 5. Gather the following information: * Host name (e.g., `ussecurityops.mycompany.com`) * Port number (e.g., `8080`) * API Endpoint (e.g., `/AIMService/api/Accounts`) * Application ID (found in the Applications list) * Safe name (found in the Details tab of the account view) When these tasks are completed and you have the required connection information, proceed to [Configure a CyberArk vault in DbProtect](#configure-a-cyberark-vault-in-dbprotect). ### Configure a CyberArk vault in DbProtect In order to perform scan jobs of your organization's databases, a vault must be defined in DbProtect to access the account and pull the necessary credentials. To configure a vault in DbProtect Explorer: 1. Log in to DbProtect Explorer and then go to **Settings**. 2. Click **Vaults**. The Vault table opens. 3. Click **Add Vault** in the upper left corner of the table. The Add Vault panel opens. 4. Type a **Vault Title**, which will be the name of the vault within DbProtect. 5. Select an existing **Organization** that the vault will belong to (see *DbProtect User Guide*, "Getting Started with DbProtect workflows" for guidance on creating a new organization). The following steps require the information gathered in [Prepare CyberArk for integration](#prepare-cyberark-for-integration). 6. Enter the Host name, Port number, and source URL required for DbProtect to connect to your company's CyberArk account. 7. Enter the Application ID and Safe name. 8. If DbProtect will use client certificate authentication, click the **Use Client Certificate** option and copy and paste the values you saved when preparing CyberArk for integration. 9. If it is not already present in the **Asset Identifier** field, type `IDENTIFIER_KEY`. 10. Click **Save**. The newly-created vault, and its automatically-generated ID is shown in the Vaults table. This ID number will be required for connection to the CyberArk account. When the DbProtect vault is configured, proceed to the next section to prepare a CyberArk asset that can be used in scan jobs. ### Connect a DbProtect asset to a CyberArk account When the CyberArk external vault definition is completed in DbProtect, you will need to create a DbProtect asset and specify the CyberArk account that contains the asset's credentials. To connect DbProtect to CyberArk: 1. Create a new asset (see the *DbProtect User Guide*, "Add an asset manually"). 2. On the new asset, add an attribute (name=`IDENTIFIER_KEY` with the value=`[CyberArk Account Name]`). The attribute must use the name above, and the value must match the customized account name you provided when you created the account in CyberArk. 3. Export the organization's credentials (see the *DbProtect User Guide*, "Import and export credentials"), select and copy the contents of the Credentials field and then: * Select the newly-created asset in the assets list and choose **Manage Credentials | Import Organization Credentials**. * Paste the credential you exported into the Credentials field. * Modify the text in the Credentials field by adding the following line immediately after the line `type = database`: ```text theme={null} vault id = [vault id of the CyberArk vault created in DbProtect Explorer] ``` Once the asset has been set up and has the appropriate credentials assigned, you will be able to select this asset for scan jobs. ### Edit or Delete a DbProtect Vault Vaults listed in the table can be edited or deleted. To edit a vault: 1. Log in to DbProtect and then go to **Settings**. 2. Click **Vault**. The Vault table opens. 3. Click the pencil icon that corresponds to the vault you want to edit. The Edit Vault panel opens. 4. Click **Save** when you are done making the necessary changes to the vault's configuration. To delete a vault: 1. Log in to DbProtect and then go to **Settings**. 2. Click **Vault**. The Vault table opens. 3. Click the pencil icon that corresponds to the vault you want to delete. The Edit Vault panel opens. 4. Scroll down to the bottom of the Edit Vault panel, and then click **Delete Vault**. The Confirmation dialog opens. 5. Click **Delete Vault**. ## Integrate ServiceNow with DbProtect DbProtect provides deep visibility into vulnerabilities in databases, as well as confirmation of a successful resolution of those vulnerabilities. Integrating DbProtect with ServiceNow allows security teams and a broader group of stakeholders to have their database security posture enrich the overall security and risk determination. Using ServiceNow's lifecycle management functions, security and compliance teams can review DbProtect's detailed vulnerability findings and remediation information as part of existing and evolving security lifecycle workflows. The integration of ServiceNow and DbProtect will require the following tasks to be completed: 1. Prepare ServiceNow for integration 2. Register DbProtect as a data source in ServiceNow 3. Set up the DbProtect to ServiceNow transform 4. Validate the setup and connectivity of ServiceNow ### Prepare ServiceNow for Integration To prepare ServiceNow for the integration with DbProtect: 1. Identify your corporate ServiceNow instance and associated administrator, or ensure you have administrator privileges to complete the integration. 2. Confirm whether or not the Vulnerability Response Core application is installed in your ServiceNow platform instance. If this is not available, your ServiceNow administrator can view your organization's entitlements in the **ServiceNow Store | ServiceNow Products** section and enable the free app. After it is enabled, activate the plug-in and install the application. Ensure you install the "Vulnerability Response" app and not one of the other similarly-named apps. 3. If your network does not already have an MID server that has connectivity to the DbProtect repository AND the ServiceNow instance, identify and install an instance that can be used for this integration, and ensure the following: * Register the MID server with your ServiceNow instance * Confirm that the new instance appears in the MID Servers list and is showing as available and validated Proceed to [Register DbProtect as a data source](#register-dbprotect-as-a-data-source). ### Register DbProtect as a Data Source To register DbProtect as a data source: 1. Navigate to **System Import Sets | Data Sources** in ServiceNow and create the DbProtect data source and click **New**. 2. Provide a **Name** and **Import set table label**. * The Name and Import set table label must both be unique to the instance of ServiceNow hosting this integration. * The Import set table name field will be auto-generated after the import set table label is provided. 3. For the remaining fields make the following selections or inputs: * **Type**: JDBC * **Use MID Server**: select the MID server you identified and/or installed for this integration * **Format**: SQLServer * **Instance Name**: DBP * **Database name**: dbpdatawarehouse * **Username** and **Password**: the login credentials that ServiceNow will use to access the DbProtect database. * **Server**: address of the server housing the DbProtect repository * **Query**: Specific SQL 4. In the **SQL statement** field, copy and paste the following text: ```sql theme={null} SELECT dw_current_asset_organization_fact.org_key, dw_current_asset_organization_fact.asset_key, dw_current_asset_dim.asset_name, dw_current_asset_dim.default_host_address, dw_current_asset_dim.default_port, dw_current_asset_dim.asset_instance_name, dw_current_asset_dim.asset_generic_type, dw_current_policy_check_mapping_fact.check_key, dw_check_dim.kb_check_id, dw_check_dim.name as check_name, dw_check_dim.analytics_category as category, dw_check_occ_detail_dim.check_occ_detail, dw_check_result_fact.check_result_status_key, resultstatus.display_value as result_status, risk.display_value as risk, (select sql_date from dw_date_dim where date_key = dw_latest_check_occurrence_cnt_fact.end_date_key) as lastscanend, dw_check_dim.[summary], dw_check_dim.[overview], dw_check_dim.[reference], dw_check_dim.[fix_desc], dw_check_dim.[supported_db_versions], dw_check_dim.[cve_reference], dw_check_dim.[cce_reference], dw_check_dim.[fix_script] FROM dw_current_policy_dim inner join dw_current_policy_check_mapping_fact on dw_current_policy_dim.policy_key = dw_current_policy_check_mapping_fact.policy_key inner join dw_current_org_policy_mapping_fact on dw_current_policy_dim.policy_key = dw_current_org_policy_mapping_fact.policy_key inner join dw_current_asset_organization_fact on dw_current_org_policy_mapping_fact.org_key = dw_current_asset_organization_fact.org_key inner join dw_current_asset_dim on dw_current_asset_dim.asset_key = dw_current_asset_organization_fact.asset_key inner join dw_check_result_fact on dw_check_result_fact.check_key = dw_current_policy_check_mapping_fact.check_key and dw_check_result_fact.asset_key = dw_current_asset_organization_fact.asset_key inner join dw_low_cardinal_dim risk on risk.attribute_key = dw_current_policy_check_mapping_fact.risk_key inner join dw_low_cardinal_dim resultstatus on resultstatus.attribute_key = dw_check_result_fact.check_result_status_key inner join dw_low_cardinal_dim checkstatus on checkstatus.attribute_key = dw_check_result_fact.check_status_key inner join dw_check_occurrence_fact on dw_check_result_fact.check_key = dw_check_occurrence_fact.check_key and dw_check_result_fact.asset_key = dw_check_occurrence_fact.asset_key and dw_check_result_fact.instance_key = dw_check_occurrence_fact.instance_key inner join dw_check_occ_detail_dim on dw_check_occ_detail_dim.check_occ_key = dw_check_occurrence_fact.check_occ_key inner join dw_check_dim on dw_check_result_fact.check_key = dw_check_dim.check_key inner join dw_latest_check_occurrence_cnt_fact on dw_check_result_fact.asset_key = dw_latest_check_occurrence_cnt_fact.asset_key and dw_check_result_fact.check_key = dw_latest_check_occurrence_cnt_fact.check_key and dw_check_result_fact.originating_org_key = dw_latest_check_occurrence_cnt_fact.originating_org_key inner join dw_current_organization_dim on dw_current_asset_organization_fact.org_key = dw_current_organization_dim.org_key inner join dw_date_dim on dw_check_result_fact.end_date_key = dw_date_dim.date_key where is_dop = 1 and dw_current_asset_organization_fact.is_direct = 1 /** filters as defined **/ --and dw_current_organization_dim.org_id = 2 --and dw_date_dim.year = 2021 and dw_date_dim.month = 2 --and resultstatus.display_value = 'Finding' and checkstatus.display_value = 'Completed' and risk.display_value in ('High','Medium','Low','Informational') and dw_check_result_fact.check_result_status_key in ( 39 , 40 ) and dw_check_result_fact.check_result_status_key in ( 39 , 40 ) ``` 5. Click **Submit**. The new data source is created. Proceed to [Set up the DbProtect > ServiceNow transform](#set-up-the-dbprotect-servicenow-transform). ### Set up the DbProtect > ServiceNow transform To set up DbProtect > ServiceNow transform: 1. Navigate to **System Import Sets | Schedule Data Imports**. 2. Open the newly-created data source from the Data Sources list. 3. Scroll down to the **Transforms** tab, click **New**, and provide the following information: * **Name**: provide a unique name for this transform map * **Target table**: search for and select the "Vulnerable Item" table 4. Click **Submit**. You are returned to the data source page, and the new transform map is shown in the Table Transform Maps list at the bottom of the page. 5. Open the transform map you just created, scroll down to the **Transform Scripts** tab, and click **New**. 6. Select **onBefore** from the **When** drop-down list. 7. Copy and paste the following transform script into the Script code box, overwriting the existing sample text: ```javascript theme={null} var severities = { "critical": 1, "high": 2, "medium": 3, "low": 4, "none": 5 }; var detail = true; (function runTransformScript(source, map, log, target /*undefined onStart*/ ) { gs.warn("Started loading DbProtect!"); var vul_item = new GlideRecord("sn_vul_vulnerable_item"); var vul_id = new GlideRecord("sn_vul_third_party_entry"); var asset = new GlideRecord("cmdb_ci"); vul_item.initialize(); vul_id.initialize(); asset.initialize(); ignore = true; vul_item.addQuery("external_id", "TW_" + source.u_asset_key + "_" + source.u_kb_check_id + source.u_check_result_status_key); if (detail) vul_item.addQuery("description", source.u_check_occ_detail); vul_item.query(); if (vul_item.next()) { gs.info("Item is already there"); if (vul_item.last_found_dt_tm < source.u_lastscanend) { vul_item.last_found_dt_tm = source.u_lastscanend; vul_item.ip_address = source.u_default_host_address; vul_item.port = source.u_default_port; vul_item.risk_rating = severities[source.u_risk.toLowerCase()] || 5; vul_item.times_found = source.u_numoccurrences; if ((source.u_result_status == "Not A Finding") && [1, 2, 10, 11, 12].includes(vul_item.state)) vul_item.state = 101; gs.info("Updating item"); vul_item.update(); } return; } // No existing ticket. if (source.u_result_status == "Not A Finding") return; // No ticket if Not a finding. var vul_id_used = false; var asset_used = false; if (!vul_item.canCreate()) { gs.error("Unable to create record in the table: sn_vul_vulnerable_item"); return; } gs.warn("New Record: " + "TW_" + source.u_asset_key + "_" + source.u_kb_check_id + source.u_check_result_status_key); // if (i > 1) vul_item.newRecord(); // so that the Vulnerability Number is incremented vul_item.id = "TW_" + source.u_kb_check_id; vul_item.external_id = "TW_" + source.u_asset_key + "_" + source.u_kb_check_id + source.u_check_result_status_key; vul_item.description = detail ? source.u_check_occ_detail : source.u_overview; vul_item.ip_address = source.u_default_host_address; vul_item.port = source.u_default_port; vul_item.last_found_dt_tm = source.u_lastscanend; vul_item.source = "Trustwave DbProtect"; vul_item.times_found = detail ? 1 : source.u_numoccurrences; if (source.u_result_status == "Finding") vul_item.state = 1; else vul_item.state = 101; vul_id.addQuery("id", "TW_" + source.u_kb_check_id); vul_id.query(); if (vul_id.next()) { gs.debug("Found linked: " + vul_id.u_vulnerability_id + " " + vul_id.u_vulnerability_summary); vul_item.vulnerability = vul_id.sys_id; } else { gs.debug("NOT Found linked"); if (vul_id_used) vul_id.newRecord(); vul_id.id = "TW_" + source.u_kb_check_id; vul_id.normalized_severity = severities[source.u_risk.toLowerCase()] || 5; vul_id.risk_rating = severities[source.u_risk.toLowerCase()] || 5; vul_id.source_severity = severities[source.u_risk.toLowerCase()] || 5; vul_id.summary = source.u_summary; vul_id.solution = source.u_fix_desc; vul_id.threat = source.u_overview; vul_id.name = source.u_check_name; vul_item.vulnerability = vul_id.insert(); vul_id_used = true; } vul_item.risk_rating = severities[source.u_risk.toLowerCase()] || 5; vul_item.insert(); })(source, map, log, target); ``` 8. Modify the line `vul_item.source = "Trustwave DbProtect";`, replacing `Trustwave DbProtect` with `[your Source table name]`. 9. Return to the data source page. Proceed to [Validate setup and connectivity of ServiceNow](#validate-setup-and-connectivity-of-servicenow). ### Validate setup and connectivity of ServiceNow After the DbProtect data source has been created, you need to confirm that the connections to the MID server and then to DbProtect are working, and valid data is being retrieved by ServiceNow. To validate the connectivity between ServiceNow and DbProtect: 1. From the Data Sources list, open your new data source. 2. Scroll down and click **Test Load 20 Records** to validate the connection and setup. If the setup was completed correctly, you should see a Completion code of "Success". If you do not, review the inputs you provided in [Register DbProtect as a data source](#register-dbprotect-as-a-data-source) and [Set up the DbProtect > ServiceNow transform](#set-up-the-dbprotect-servicenow-transform). 3. Optional: When the validation is complete, you can click **Load all Records** to check the sample. Select the newest set, then select a row to display the finding record from DbProtect. 4. Click **Run Transform**. If the transform script was correctly modified, you will see a Completion code of "Success". 5. When the transform is complete, you can review the results under **Next steps**. The file will open showing the 20 records loaded in the step above, and each can be opened individually to examine the results. 6. Return to the ServiceNow **All** menu, search for and select **Vulnerability Response | Vulnerable Items | All**. All results from the transform above, as well as any other results brought in from other third-party vendors, will appear in the same Vulnerable Item table. ## Upgrade from previous versions ### Upgrade scenarios Direct upgrade to v6.7.1 is available from v6.7.0, v6.6.15 or v6.6.13. The following table describes the supported upgrade scenarios: | Current DbProtect version | Direct upgrade to v6.7.1 | Details | | - | - | - | | 6.7.0 | Yes | Upgrade directly to v6.7.1 | | 6.6.15 | Yes | Upgrade directly to v6.7.1 | | 6.6.13 | Yes | Upgrade directly to v6.7.1 | | 6.6.12 | No | Upgrade to v6.6.13 first | ### Product release history LevelBlue supports only two versions prior to the current release of DbProtect. Version upgrades are available to all customers that have current support and maintenance contracts. Clients running unsupported software are strongly encouraged to plan for an upgrade or fresh installation of their licensed software. Newer releases of software offer better performance, new features and capabilities, and often resolve issues experienced in older releases of software. | Version | Release date | | - | - | | 6.7.1 | July 2026 | | 6.7.0 | March 2026 | | 6.6.15 | July 2025 | | 6.6.13 | November 2024 | | 6.6.12 | August 2024 | ### Pre-upgrade tasks Some prerequisites may be newer than your current installed version. Check the [requirements section](#dbprotect-core-system-requirements). The following are the tasks that must be completed prior to beginning the upgrade: 1. Ensure connectivity from each Scan Engine to the Scan Engine Manager port (default port is 28080). This was new as of DbProtect v6.7.0. 2. Unregister any Linux Scan Engines prior to upgrading Core. 3. Confirm the hardware and operating system specifications on the system that has the console installed. 4. Verify backups of the OS were created. If working with a virtual machine, ensure that you take a snapshot or backup of the appliances prior to upgrading. 5. Verify that a backup of the databases was taken. 6. Confirm you are using the same user that ran the original installation or have access to that user. 7. Execute system help check scripts and check for free space on the database host. Free some log file space if necessary. 8. Check for 30GB plus free disk space on the host and drive where the console is being installed. 9. Verify you have an admin user that has sysadmin rights on the database for schema change commands. 10. Check whether you have URR data. This will require extensive transaction log space during the upgrade. 11. Check whether the name of your install directory is less than 27 characters long. If it is, then direct upgrade can occur. If it is not, see [Appendix G: Upgrading with pathnames over 27 characters](#appendix-g-upgrading-with-pathnames-over-27-characters) for the steps required to satisfy this condition. 12. Make a full back up or copy of all the DbProtect backend databases: AppDetective, DbPStaging, and DbPDataWarehouse. 13. Prepare to back up your DbProtect licenses, policies, filters, credential profiles, asset lists and custom dictionaries in case problems occur during the upgrade. 14. Make a backup of your License files from the `\DbProtect\Licenses` directory. 15. Export your custom Vulnerability Management Policies and exceptions. For further information, please contact [Product Support](https://www.levelblue.com/company/support). 16. Download the DbProtect unified installer and DbProtect Scan Engine installer files. 17. Download Analytics Content and Knowledgebase updates if available. After the install is complete, you can then specifically upgrade the Analytics Content and SHATTER Knowledgebase to ensure that you have the latest monthly update. 18. Uninstall Explorer (if present) using the Add or Remove programs option and delete the explorer folder before beginning the upgrade process. If DbProtect Explorer is still installed and you run DbProtect.exe, the unified installer will skip the running of the explorer installer. ### Upgrading to v6.7.1 * A direct upgrade is supported from these versions: v6.7.0, v6.6.15 or v6.6.13. * DbProtect v6.7.1 requires that the install directory's path name is fewer than 27 characters (e.g., `D:\Trustwave\DbProtect`). To calculate the character count, remove the drive (`D:\` in the example provided) and count the remainder of the path name. In the example provided it would be a character count of 19. * Existing versions of DbProtect Explorer must be uninstalled before any new version of DbProtect Explorer can be installed. It is suggested that you uninstall your current version of DbProtect Explorer and delete the DbProtect Explorer folder before beginning DbProtect Core upgrade process. * As of DbProtect v6.7.0, the Core and Explorer components have now been unified into a single installation package. There is no longer a separate installer provided for DbProtect Explorer. The Explorer portion of the upgrade will commence after the usual Core components of the upgrade have completed. * DbProtect v6.7.1 is intended to be used with DbProtect Explorer v9.15 only. Adding credentials to an asset may fail if Explorer v9.15 is not installed. To begin the upgrade procedure: 1. Download the DbProtect setup packages from the [LevelBlue Support](https://www.levelblue.com/company/support) page (scroll down to the Trustwave Support section). Once done, store them in a convenient location (e.g., `c:\temp`). 2. Launch the setup package. DbProtect Setup will detect any missing prerequisites or previously installed components. It will display and disable those components that are up-to-date and highlight those that must be installed or upgraded. The DbProtect suite installer deploys all components into a common area. LevelBlue recommends installing on the root of a drive such as `C:\LevelBlue` or `D:\LevelBlue`. 3. Read and accept the license agreement every time you install or upgrade the software. 4. Click **Install** to begin installation of all components in the order they are listed. The installer may require a system restart and will resume after the system has re-started. When the **Welcome to the DbProtect Enterprise Services Host Setup** wizard opens, click **Next**. ### Install and runtime privileges The DbProtect Services can be run either as LocalSystem or a specific Domain Service Account. The services can only be run as a LocalSystem when the DbProtect backend repository is running on the same machine as the DbProtect console or when a SQL Server Authenticated User is used to communicate with the backend repository. If you choose to run services as a specific Domain/Windows Service Account, ensure that it has the "Logon as a service" privilege. The selected user must be allowed to connect to the Active Directory domain (for such operations as checking user credentials during logon to the DbProtect console) and must have access to the DbProtect backend databases when using Windows Integrated Authentication. During the upgrade, the Database account should also have 'sysadmin' rights on the SQL Server Instance. ### DbProtect Scan Engine (for Windows) upgrade steps You must perform these upgrade steps on every host where a scan engine is installed. For Linux Scan Engine, upgrade is not supported. Please uninstall prior to upgrading the Core. 1. Right click on the Scan Engine executable and select **Run as administrator**. The Trustwave Scan Engine installer opens. 2. Proceed through the DbProtect Scan Engine Setup steps outlined in [DbProtect Scan Engine setup](#dbprotect-scan-engine-setup). .NET Framework upgrades may require a system restart. 3. Once the scan engine has been upgraded, confirm that you can see it on the DbProtect console. ### System Finalizer 1. Select the **I have read and accept the license agreement** checkbox. 2. Click **Install**. 3. Click **OK** when you see the Successfully installed prompt. ### Post upgrade validation tasks 1. Log in to DbProtect. 2. Check that organizations and assets are visible. 3. Restart any scan engines that were stopped prior to the upgrade. 4. Force ETL (extraction, transformation, loading of data into the Data Warehouse). 5. Check that you can access the dashboards and the report library. 6. Run the system diagnostic tool. 7. Create and run test job. 8. Export your check result data. 9. Run a report on the data. 10. Set up your jobs. 11. Install any downloaded monthly updates to the Analytics Content and the SHATTER Knowledgebase. ## Uninstall the DbProtect components This section provides the uninstallation steps for the DbProtect suite components. You should uninstall the DbProtect suite components from the Start Menu. ### Before you uninstall the DbProtect Suite components If you are uninstalling the DbProtect console with the intention of re-installing it on a different server, you should back up your SQL Server back-end databases before you begin uninstalling the DbProtect suite components. Then, you can restore the SQL Server back-end databases to whichever instance you select after you re-install the DbProtect suite components elsewhere. For more information on backing up your back-end database, see the *DbProtect Disaster Recovery* document or contact the [LevelBlue Support](https://www.levelblue.com/company/support) page (scroll down to the Trustwave Support section). ### Uninstall the DbProtect console components from the Start menu 1. Choose **Start | Trustwave | DbProtect | Uninstall DbProtect** to display the uninstallation wizard. 2. Follow the prompts. The order of the uninstallation process is the exact opposite of the DbProtect suite component installation process (for more information, see [Installing DbProtect for the first time](#installing-dbprotect-for-the-first-time)). The DbProtect Suite component uninstallation process does not delete your backend database. 3. A message informs you when the uninstallation is complete. Click **Finish**. ### Uninstall DbProtect Explorer To uninstall the DbProtect Explorer: 1. Navigate to **Control Panel | Programs and Features**. 2. Select **DbProtect Explorer** and click **Uninstall**. ### Uninstall and unregister a scan engine #### Unregister a scan engine When you unregister a scan engine, you return the scan engine to its original, unconfigured installation state. However, it is not removed from your system. Unregister your scan engine before you uninstall it. To unregister a scan engine: 1. Log into DbProtect. 2. Click **Settings | Scan Engines** on the toolbar. 3. Select the scan engine you want to unregister and click **Unregister**. A message will display asking for confirmation of this action. #### Uninstall a scan engine You must be logged in to the scan engine host to uninstall a scan engine. To uninstall a scan engine, click **Start | All Programs | Trustwave | Uninstall Trustwave ScanEngineService** and follow the prompts. ## Appendix A: Creating your own Microsoft SQL Server AppDetective database As explained in [Installing DbProtect for the first time](#installing-dbprotect-for-the-first-time), the DbProtect suite installer automatically installs an AppDetective Microsoft SQL Server database as part of the database component installation process. However, you can create your own AppDetective Microsoft SQL Server database, as long as it adheres to the specific requirements outlined below. If your AppDetective Microsoft SQL Server database does not adhere to these requirements, the database component installation will fail and your entire DbProtect suite installation will also fail. To create your own AppDetective Microsoft SQL Server database: 1. Create the AppDetective Microsoft SQL Server database with `COLLATE Latin1_General_CI_AI`. 2. Set the following AppDetective Microsoft SQL Server database options: ```text theme={null} 'autoclose'='false' 'bulkcopy'='false' 'trunc. log'='false' 'torn page detection'='true' 'read only'='false' 'dbo use'='false' 'single'='false' 'autoshrink'='false' 'ANSI null default'='false' 'recursive triggers'='false' 'ANSI nulls'='false' 'concat null yields null'='false' 'cursor close on commit'='false' 'default to local cursor'='false' 'quoted identifier'='false' 'ANSI warnings'='false' 'auto create statistics'='true' 'auto update statistics'='true' ``` ## Appendix B: Network ports used by DbProtect Components of DbProtect communicate using Internet Protocol (IP) connections. To help you configure your firewalls properly, the following table lists each component and describes how they each use the network. | Application | Application protocol | Type | Port | Encrypted | Direction | | - | - | - | - | - | - | | DbProtect Suite | HTTPS | TCP | 20080 | | DbProtect to User | | DbProtect Suite | HTTPS | TCP | 20082 | | Explorer Auth Service (local only) | | DbProtect Suite | HTTPS | TCP | 20083 | | DbProtect Explorer to User | | DbProtect Suite | SQL | As configured | | | Console to Database | | DbProtect Suite | LDAP | | 20389 | | All Services to Naming and Directory Service (local only) | | Scan Engine Manager | SOAP | TCP | 6123 | | Scan Engine Proxy (local only) | | Scan Engine Manager | WSS | TCP | 28080 | Yes | Scan Engine to Console | | Scan Engine Manager | HTTPS | TCP | 28081 | Yes | Scan Engine Manager (local only) | | Scan Engine Manager | HTTPS | TCP | 28082 | Yes | SEM Query Service (local only) | * The Scan Engine Proxy component included with DbProtect v6.6.13 and earlier is no longer required as of DbProtect v6.6.15 and will be removed from your DbProtect Core host upon upgrading to the v6.7.1 release. It has been replaced by the new Scan Engine Manager component. * With the introduction of the Scan Engine Manager component (installed on your DbProtect console host), you do not need to open ports on any Scan Engine Host v3.25 hosts. Internally, it now uses the (default) port of 20010, but it does not need to be open for the scan engine host to function. For the Scan Engine Manager component, your DbProtect console host needs to open a (default) port of 28080 for Scan Engine v3.24 and newer hosts to communicate. When registering a Scan Engine host on the DbProtect v6.7.1 console, you still need to fill in the port number as we are still supporting the previously released Scan Engine host version v3.22 for the time being. We strongly suggest you use Scan Engine host v3.25 with DbProtect v6.7.1. * If you have questions regarding ports, please contact your database administrator in the first instance, or LevelBlue Support. ## Appendix C: Modifying the Log On As user for DbProtect services **What is the "Log On As" user?** * When you install DbProtect, the Database Runtime Configuration page allows you to configure your DbProtect runtime user account. This is the "log on as" user, i.e., the user whose privileges are used to log into and use DbProtect. * You can connect to your custom SQL Server instance using Windows Authentication. The latter uses the LocalSystem account as the run-as user for the services installed (i.e., DbProtect and DbProtect Message Collector). To modify the Windows Authentication LocalSystem account: 1. Go to **Start | Control Panel** to display the Control Panel. 2. Double-click the **Administrative Tools** icon. 3. Double-click the **Services** icon to display the Services dialog. 4. Highlight a service (e.g., DbProtect Message Collector) to display the DbProtect Message Collector Properties dialog. 5. Click the **Log On** tab to display the Log on as portion of the DbProtect Message Collector Properties dialog. 6. Select **This account** and enter the: * new "log on as" user's domain name\user name (or click **Browse** to display the Select User pop-up and locate a valid user) * password for the specified user 7. Click **Apply**. A message informs you the revised "log on as" account change will not take effect until you reboot your computer. 8. Click **OK**. ## Appendix D: DbProtect log files During normal installation of DbProtect suite components, log files are generated and placed in a directory, typically `C:\Program Files\Trustwave\DbProtect\Logs`. Customer Support will ask you to send these files if you contact them for assistance. Credential information may sometimes be recorded in this manually generated log file. Review the contents of this log to remove any sensitive credential information before sending the log to any Customer Support professional. ## Appendix E: Required Audit Privileges Audit policy scans and user rights review scans require read-only access to the asset. While you can use an Administrator account to run the scans, it is not required. To set up the appropriate databases' access on the assets, User Creation Scripts are provided within the product, specifically from the SHATTER Knowledgebase component. To access these files, proceed to the following directory: ```text theme={null} \DbProtect\Resources\ShatterKnowledgebase\UserCreationScripts ``` In this directory, you will see a readme file that provides more information about each script. The basic guidance for each script follows (where `[Asset]` = asset type and version, where needed): * `CreateUser[Asset].sql`: creates a user called 'aduser' and will grant read-only permissions needed to run audit policy scans. * `CreateUser[Asset]URR.sql`: creates a user called 'aduserURR' and will grant read-only permissions needed to run audit policy and user rights review scans. * `CreatePowerUser[Asset].sql`: creates a user called 'aduser\_admin' and will grant elevated privileges (i.e. SYSDBA for Oracle). * `CreateUser[Asset]SA.sql`: specific for Microsoft SQL Server and creates a user called 'aduser' and will grant sysadmin rights. To understand if you should use the PowerUser or SA script, read the `CheckPermissions.txt` file located in the following directory as there are some checks that do require elevated privileges: ```text theme={null} \DbProtect\Resources\ShatterKnowledgebase ``` In addition to setting up database access on the asset, OS access may also be needed if you are running OS integrity checks or checks that do require OS access (i.e. Critical Patch Update checks). Beyond the information in the readme file (see the readme file for complete instructions on setting up WMI and DCOM permissions), here is more guidance on OS access. | Check | Windows permissions needed | | - | - | | Not Using NTFS Partition | Permission to read the installation disk type | | Registry Permissions | Remote registry access | | Services Runs as Local System | Permission to list the system services | | Permissions on Files | Permission to read files in the installation directory of the database | | Check | Unix permissions needed | | - | - | | Permissions on Files | Permission to list files in the installation directories of the database | | Setgid Bit Enabled | See above | | Setuid Bit Enabled | See above | Certain target databases need to have system variables to specify the location of the database instances. | Target database | Unix permissions needed | | - | - | | Oracle | Make sure the `$ORACLE_HOME` variable is correct.

**Note:** The OS account needs to have privileges of Oracle Software Owner. | | Sybase ASE | Make sure the `$SYBASE` variable is correct. | | MySQL | Define a `datadir` or `basedir` variable to point to the database root. | For Microsoft SQL Server, you can also choose to use Windows Authentication for database credentials. You will need to enter the domain or hostname, username, and password. (For example, if your Windows login is `domain\aduser`, you enter `domain` in the **Domain or IP/Hostname** field, and `aduser` in the **User Name** field.) If any fields are encrypted, the account used for the audit policy scan does not have access to those fields, and some checks may not work properly. ## Appendix F: Auditing SQL Server against a machine on a different or untrusted domain If you attempt to audit a SQL Server database (using Windows Authentication) against a machine on a different or untrusted domain, the following error message may appear: ```text theme={null} SQLSTATE: 28000, Native error: 18452, Message: [Microsoft][ODBC SQL Server Driver][SQL Server]Login failed for user ''. The user is not associated with a trusted SQL Server connection. ``` To audit a SQL Server database (using Windows Authentication) against a machine on a different or untrusted domain: 1. Establish a connection to the target server. 2. Enter the appropriate Net Use syntax. For a remote host that is a: * member of domain, enter `net use \\ip /user:domain\username` * workgroup member (standalone computer), enter `net use \\ip /user:username` or `net use \\ip /user:computername\username` 3. Use named pipes to connect to an untrusted domain. 4. Select the Properties branch option **Connect to Microsoft SQL Servers using Named Pipes**. You must check this option when auditing a SQL Server database in an untrusted domain. You must enable the named pipes protocol on both the scan engine host and the SQL Server target server when using this option. 5. Confirm the following: * Server and Remote Registry services on your remote host are running. * Net Use set of credentials file being used is a member of either the domain hosting the target server, or a domain that is trusted by that domain. * Login provides remote registry access and read-only file access to the remote machine. To check this: * Enter `net use \\server` with your credentials and expand `HKEY_LOCAL_MACHINE` on the target server. * Enter `net use \\server\c$` to verify you can access files on the target server. * Access to the remote host can be restricted by firewall, which has been common in many versions of Windows. You can verify this on the remote host by looking into the firewall settings/logs for rejected packets. This means there should be connectivity on port 445 or 139 on the target host. 6. Do the following to create and test a DSN connection to the target host: 1. Choose **Control Panel | Administrative Tools | Data Sources (ODBC)**. 2. Open the **System DSN** tab and click **Add**. 3. Choose **Microsoft SQL Server** from the list. 4. Click **Finish**. 5. Enter a **Name** and **Description** for this data source entry. 6. In the **Server** field, enter the IP address and listening port of the target server, e.g., `172.27.190.58,1756`. 7. Click **Next**. 8. Select **SQL Server Authentication** and enter your database credentials in the **Login ID** and **Password** fields. 9. Click **Next**. 10. Follow the steps in the wizard. You should now be able to test the connection to the data source. If this test is successful, you should also be able to perform the audit with the scan engine. If you are unable to connect, try using the other IP address, or use Windows Authentication rather than the SQL credentials (after connecting with Net Use). ## Appendix G: Upgrading with pathnames over 27 characters If the pathname of your root install directory is longer than 27 characters, you must first uninstall DbProtect before upgrading. To learn how to calculate character count of a pathname, see the table in [DbProtect Core system requirements](#dbprotect-core-system-requirements). To upgrade your DbProtect installation that uses a pathname longer than 27 characters: 1. Verify you have backups of the databases and OS. 2. Backup the following directories on the console server: * `..\Trustwave\DbProtect\Analytics\content\report_store` * `..\Trustwave\DbProtect\Licenses` * `..\Trustwave\DbProtect\Message Collector\conf\runtime_config.xml` 3. Uninstall DbProtect by using the **Uninstall DbProtect** shortcut from **Start | Programs**. 4. When the uninstall is complete, check Windows' Programs and Features to confirm that the following components have been uninstalled: * SHATTER Knowledgebase * DbProtect Analytics Content 5. If either or both of these items are still present in the Programs and Features list, uninstall them manually before proceeding. 6. Delete the directory structure, if any remains. 7. Reboot the server. 8. Proceed to the installation steps of installing v6.7.1. ## Appendix H: Working product after license overage DbProtect will continue to function and allow you to log in even after you have exceeded your license usage. A license overage warning will be displayed after login if this situation occurs. A license usage banner is now visible in the product. Log into our support portal to see our licensing document. ## Appendix I: Installation troubleshooting ### Are there firewall issues I should consider? DbProtect Core is accessible using HTTPS on port 20080. You can allow all machines, certain machines, or no machines to have access from outside your firewall. In the latter case, only machines inside the firewall can access DbProtect Core. This is completely at your discretion, but for convenience LevelBlue recommends you at least allow users to connect from their desktop machines. DbProtect has its own method of authentication and using a firewall is not required to restrict access. For DbProtect Explorer, you need to ensure that ports 20082-20083 are free on the host. For Scan Engine Manager, ensure the inbound port is open (default 28080). For a detailed listing of network port requirements see [Appendix B: Network ports used by DbProtect](#appendix-b-network-ports-used-by-dbprotect). ### "Error Occurred. The DbProtect database is not available at the moment. Please retry your request later." What should I do? Make sure the database instance that DbProtect uses (e.g., MSSQL) is running and make sure the database credentials you specified during installation are correct. For more information on DbProtect component installation, see [Installing DbProtect for the first time](#installing-dbprotect-for-the-first-time).