​

Formatting Conventions

​

Notes, Tips, and Cautions

​

Introduction

​

Document Audience

​

DbProtect Components

​

Scan Engines

​

Sensors

​

DbProtect Core

​

DbProtect Explorer

​

Use Single Sign-on (SSO) to access DbProtect

​

Permissions and Prerequisites

​

Network Access for DbProtect Components

​

User Permissions and Network Access for Target Assets

C:\Trustwave\DbProtect\

..\Resources\ShatterKnowledgebase\UserCreationScripts\

​

Log in to DbProtect Core

1. Enter https://[ConsoleServer]:[Port] in the address line, where:
   • [ConsoleServer] is the hostname or IP Address of DbProtect Core server
   • [Port] is the port number where DbProtect Core Management Server has been configured to provide service. The default port as installed is 20080 (e.g., https://DbProtect_server:20080).
2. A Security Alert message may be displayed, warning you of an invalid security certificate. You can safely continue past this message. DbProtect uses a self-generated SSL certificate by default to encrypt communications.
   Caution: DbProtect is designed to use only Transport Layer Security (TLS) communication, which encrypts your username and credentials prior to transmission to DbProtect. DbProtect then uses the Windows Authentication subsystem to verify the credentials. For information about how to generate and install a valid certificate, please contact LevelBlue Product Support
3. From the Log In menu, select Use Windows Authentication or Manually.
   • If you select Use Windows Authentication, DbProtect uses your Windows login credentials to log on to DbProtect.
   • If you select Manually, you are prompted to enter your login credentials.
4. In the Username field, enter your DbProtect username. You can also enter the domain information in this field in usual Windows formats such as domain\username.
5. In the Password field, enter the password that matches the username.
6. Use the Domain menu to select the domain for the username or manually enter a domain in this field.
7. Click Log In. If the credentials you entered are valid, DbProtect Core opens.

​

DbProtect Explorer

​

Troubleshooting Your DbProtect Core Login

• In Control Panel | Internet Options | Advanced, if Integrated Windows Authentication is enabled the Windows user will be automatically authenticated, if possible, in modern browsers that are configured properly.
• Ensure that JavaScript is enabled in the browser.
• DbProtect Core provides basic functionality in current versions of major browsers. You may see slight variations in the presentation of pages between browsers.
• When there is no activity on your machine for a specified period of time, you will be logged out. You must log in again by returning to the Login screen.

​

Familiarize yourself with DbProtect

​

Navigating DbProtect Core

​

Select an organization

1. Click Change Organization. The Report Viewing Organization Selector dialog opens.
2. Click the expand or collapse controls to expand or collapse the tree view of descendant organizations.
3. Select an Organization. For reports, you can choose to include all descendant organizations of the selected organization.
4. Choose to apply the selection to reporting, or only to the part of DbProtect Core where you opened this window.
5. Click OK to apply your selections.

​

Pages in DbProtect Core

​

Assets

• To scan for database instances and add them to the asset list automatically, use a Discovery Job (see Add assets for more information).

• By default, the asset list only shows scannable assets. Click the View menu at the top right of the Asset Search Results pane to see all assets.
• Sort and filter the list using standard tools (see Navigating DbProtect Core).
• Search for specific assets (see Search assets for more information).

​

Monitoring

• To select the organization you want to work with, click Change Organization (top right of the page).
• The Monitoring page uses a set of navigation tabs that allow you to configure and review monitoring for the various pages of the DbProtect taskbar.

​

Jobs

​

Report DbProtect results

1. Click Reports | Catalog.
2. Select one of the built-in on-demand reports. A new browser window/tab will open where the generated report will be displayed.

1. Click Reports | History.
2. Scroll through the list of reports that have already been generated. These are reports that have been run as part of an executed job, whether set up as a one-time or scheduled job.
3. Select the checkbox next to the report that you want to view.
4. Click the PDF document link for the report (right side) and save the report to your computer.
5. Navigate to the file and double-click to open.

​

Users & Orgs

Organizations tab

• The top pane lists the organizations set up in DbProtect.
• The bottom pane provides details of the organization selected on the top pane, on four tabs:

• Use the paging controls below the list to view more items.
• If an organization has dependents, click the arrow next to the name to expand the dependent list. You can also use the expand and collapse buttons at the top right of the list to view or hide the dependent organizations.

Users tab

• The top pane lists users and groups. If there are many entries, you can view them using the corresponding navigation arrows below the list.
• The bottom pane lists the roles and effective permissions of the selected user or group.

​

Settings

​

Navigating in DbProtect Explorer

​

Organization Selector

​

DbProtect Explorer Dashboard

• Hover over legend items to highlight specific bars.
• Click the Legends slider button to show or hide chart legends.
• Hover over the chart bars or graphs to display data related to the vulnerabilities or alerts.
• Click a bar or graph line to open the item and display the finding’s details and set display and filter options for the chart/graph.

• Vulnerabilities & Alerts by categories: Organized from High to Low risk, these charts allow you to target vulnerability and asset categories that are at highest risk of producing high numbers of findings or alerts. Hover over the bars to see the category name and number of findings or alerts for the category.
• Vulnerabilities and Alerts over time: See the trends of findings and alerts over time to help pinpoint specific events or changes in your system configurations that increased vulnerability internally, or that represent increased external activity against your networks and databases. Slide the shaded Viewer on the bottom graph line to extend the viewable timeframe beyond the last 30 days.
• Asset Categories, Coverage, and Inventory: The number of assets currently registered in DbProtect, and the number of assets currently covered by scanning activity are shown at the top of the screen. The categorization of your asset inventory is shown in a donut chart to provide a snapshot of the percentage of your inventory in each asset type (database types). Click a segment of the chart to see asset tags on the right side; the segment pops out of the donut to highlight that portion of the inventory for presentations or discussion.

​

Filtering and Generating Reports

​

Filtering

​

Report

​

Job

​

Alerts

• Adding archived or acknowledged alerts to the list of active alerts is only a button click; you do not have to view archived and current alerts separately and move between tabs to see them.
• You can quickly adjust the risk level to filter the displayed items to High, Medium, or Low, and see alerts from the last 30, 60, or 90 days.
• Multiple filter conditions can be applied to the list at any given time, allowing you to filter down the results as needed to quickly find alerts for specific assets or of particular types. Filters can be set for “contains” or “does not contain” criteria.
• Initial information about a selected alert is displayed in the bottom pane of the page, and more detailed information is available by double-clicking the alert in the list.
• The Anomalies tab displays specialized alerts generated by the occurrence of anomalous activity (non-standard usage and access patterns).

​

Policies

• The Policies page defaults to the Policies Overview tab, where you can create a new policy or search existing policies and checks.
• Click the Policy List tab to display a list of the policies available, create new policies, edit or duplicate an existing policy, and import or export a policy.
• Double-click the policy you want to view, and a new slider will open from the right-side of the screen, displaying the results of the checks performed by the policy.
• View details of any policy, including Risk Level and Knowledgebase information.
• Click Save As on a built-in policy to save the policy under another name and make it editable.

​

Exploration

​

Exploration page navigation controls

​

Use the Exploration Scratchpad

1. Hold down the shift key while clicking a node with a white halo. The node will appear in the Scratchpad slider at the top right of the Exploration window.
2. Hover over the Scratchpad slider to expand it out into the page and view a list of the nodes you have added.
3. Click either the Exploration Scratchpad header, or an item in the list, to open the Scratchpad in a new browser tab.
4. Click the arrow next to the node Type to expand the individual nodes and view the underlying data.

​

Entitlements Exploration

​

Overview of DbProtect workflows

• Administrative Setup workflow
• Jobs workflow

​

Administrative Setup workflow overview

• Create organizations
• Add users and assign roles
• Manage policies
• Register scan engines

​

Create organizations

​

Add users and assign roles

• Users are accounts that you import from the Windows domain or local machine environment.
• Roles are permission sets that you apply to grant users varying types of permissions within DbProtect. For example, you can allow users permission to:
  • View reports for one or more organizations
  • Manage or run jobs
  • Grant permission to one or more organizations to other users
  • Manage the entire installation

​

View policies

​

Register scan engines

​

Jobs workflow overview

​

Adding assets

• Databases that you scan
• Database related endpoints, such as SQL redirects
• DbProtect scan engines

​

Set up and run jobs

Discovery jobs

Pen test and audit jobs

Rights review jobs

​

Monitor activity

​

Report on results

​

Investigation and Remediation

​

Getting started with DbProtect workflows

​

Administrative Setup workflow

​

Create an organization

1. Click Users & Orgs on the DbProtect taskbar.
2. On the Organizations tab, click New Organization. The Create an Organization dialog opens.
3. Type a Name for the organization.
4. Choose the Parent Organization:
   Note: If you select an organization from the main list before you click New Organization, the parent defaults to the selected organization.
   • Choose No Parent to create a top-level organization that has no parent. Top level organizations are created with all available policies selected.
   • Choose Select a Parent and click the Select button to view the entire organization hierarchy and select the parent for the organization you are creating.
5. (OPTIONAL) If you select a parent, select the Copy all parent organization’s policies option to inherit all policies currently applied to the parent organization.
   Note: This is a one-time action. Future changes to the parent’s policies do not affect descendants.
6. Select at least one Owner for the organization from the drop-down list. The selected owner will have access to all operational and data view functions for the organization.
   Note: Any changes to ownership and other user rights take effect at the next login of a user. This is also true for the administrator making the changes.
7. (OPTIONAL) Enter a Description to help differentiate this organization from others in the hierarchy.
8. Click Create to add the organization.

​

Add users/groups and assign roles

1. Click Users & Orgs on the DbProtect taskbar.
2. Click the Users tab.
3. Click New User. The Create a User dialog opens.
4. In the Grant Access To section, type a User or Group name and select a domain (if any).
5. (OPTIONAL) Enter a Description.
6. Click Add. The new user is added to the box below the Description field.
7. Repeat steps 1 through 6 for any additional users or groups you want to add with identical roles.
8. In the Add Roles section, click Add. The Organization Role Selector dialog opens.
9. Select one or more Organizations that the roles will be associated with.
10. Select one or more Roles to associate with the selected organizations.
11. Click Add. The organization and associated roles are added to the list.
12. Select a System Role from the drop-down list. Repeat as needed to add other system roles.
13. Click Delete for any organization or system role to remove.

​

View a policy

1. On the navigation pane, click Policies. The Policies page opens.
2. Click the Policy List tab.
3. If the policy list is extensive, filter the list using one or all of the following, and click Apply:
   • Search the list for policies using the policy name or part of the name.
   • Filter the list by making selections from the Policy Type, Policy Template, and Status options.
4. Select the policy you want to view to see summary information in the bottom pane, or double-click the policy to open the policy details pane.
5. Choose an Asset type and expand the Checks categories to view individual checks performed in the policy.

​

Register a scan engine

1. Click Settings on the DbProtect taskbar (far right side).
2. Click the Scan Engines tab.
3. Click Register New Scan Engine.
4. Type an easily recognized Scan Engine Name.
5. Enter the Hostname or IP address and the TCP Port.
6. Click Register.

​

Jobs workflow

​

Add assets

Add an asset manually

1. Click Assets on the DbProtect taskbar.
2. Click New. The Create an Asset dialog opens.
   Note: For additional details about expected values for a field, click the help icon next to the field.
3. Enter a unique, easily recognized Name for the asset.
4. Click Select next to the Organization Associations field to choose an organization from the hierarchy.
   Tip: To associate an asset with more than one organization, after creating the asset, click Org Associations and select the additional organizations.
5. Select the Type of database server you are adding from the drop-down list.
6. Enter the name of the Database/Instance/SID for this asset.
7. Enter a Host (or IP address) and Port to be used for this asset and click Add Endpoint Below.
8. Repeat this step to add additional endpoints.
9. (OPTIONAL) Click Add as Preferred next to one of the endpoints. If no endpoint is set as preferred, the system will use the order of the endpoints as they appear in the list.
10. (OPTIONAL) Select a Version from the drop-down list and identify the Platform for this version.
    Tip: Although the Version and Platform selections are optional, the values can affect the results of a scan. You should select both if they are known.
11. (OPTIONAL) Click Add attributes, enter a Name and Value, and then click Set. Attributes can be used to refine searches. Click View system attribute names for a list of attribute names that have special meanings.
    Note: If you have integrated DbProtect with CyberArk, you MUST add an attribute (name="IDENTIFIER_KEY" and value="[nameOfCyberArkAsset]") to the new DbProtect asset. This asset identifier was set up in CyberArk prior to configuring DbProtect for integration (see DbProtect Install and Upgrade Guide, “Integrate CyberArk and DbProtect”).
12. Select the Create another asset checkbox if you want to create additional assets after this one is complete.
13. Click Create. The asset is added to the list.

Import assets

1. Click Assets on the DbProtect taskbar.
2. Click Import. The Import Assets dialog opens.
3. In the Assets pane, paste the CSV-formatted data. For more information about the data format, click View Sample File.
4. (OPTIONAL) In the Asset Identity Descriptors field, enter the list of fields in the imported data that will be treated as part of the unique asset identifier. By default, the required fields host name, port, and instance name are used.
5. In the Organization pane, select the Organization where new assets will be created. You can also include organization information in the CSV input.
6. Click Test Import. If the test is not successful, make the required changes to the data.
7. When the test is successful, click Import.

Add assets through discovery

​

Set up and run a job

1. Click Jobs in the DbProtect taskbar.
2. Click New Job to open the Create a Job wizard and see a description of each type of job that you can create. If you know what type of job you want to create, click the down arrow next to New Job.
3. On the first page of the wizard, select the Audit, Pen Test, or Rights Review template.
4. Enter a Job Name.
5. Click Select to open the Organization Selector.
6. Select the organization to use for this job.
7. (OPTIONAL) Click Add description and provide enough detail to differentiate this job from the others you will create.
8. Click Continue.
9. On the Assets side tab, click Add Assets to select the assets that will be tested in this job. See Add assets to jobs using saved and ad hoc queries for more information.
10. (Audit and Rights Review jobs only) Click the Credentials side tab. The list of assets you have added is displayed showing the credential status for each asset. Each asset should display a green circle or green check mark for one type of credential, indicating adequate permissions. For any asset that shows Needs Attention or Failed:
    1. Click Add Override Credential. The Add Database Credentials dialog opens.
    2. Select an Authentication type from the drop-down list and provide the necessary information for the type you selected.
    3. Click Test to verify that the authentication type and related credentials are valid.
    Note: You can continue to create a job without complete credentials but be aware that jobs without complete credentials may request attention at run time or some steps might fail.
11. Click the Policy side tab and select one or more policies to use. For more information about Policies, see View a policy.
12. Click the Reports side tab.
13. Click Add Report. The Report wizard opens.
14. Select a report from This Job’s Results (recommended) or click Other to view a list of available report templates.
    Note: Other reports give access to all available reports, whether or not they provide output related to the job.
15. Click Next and complete the Input Settings for the type of report you have selected.
16. Click Next and complete the Output Settings for the type of job you are creating.
17. Click Save.
18. Click the Advanced Settings side tab and complete the additional settings that are required to perform the job.
19. Click Create to save the job.
20. To run the job immediately, select the job on the Jobs page and click Run Now.
21. To schedule a job for a future time, select it on the Jobs page and click Schedule, set the Schedule Type, Start Time, and Start Date, and click Save.

​

Set up basic monitoring

​

Register a sensor

1. Click Monitoring | Sensors. The Sensor Manager page opens.
2. Click Register New Sensor. The Registration Manager page opens.
3. Enter the IP Address/Host Name of the sensor machine.
4. Enter the TCP Port where the sensor is listening (by default, port 20000).
5. Click Next.
6. On the summary screen, click Finish to accept the settings, or click Back to adjust settings.

​

Deploy a policy

1. Click Monitoring | Policies. The Policy Manager page opens.
2. Click Deploy next to a named policy in the list that you want to deploy to the sensor you have prepared. The Policy Deployment page opens.
3. Select an available database application from the list of configured sensors and the currently deployed policy for each (if any). You can filter the list in two ways:
   • Type in the Search field to look for specific text in the descriptions of the sensor
   • Select the Only show databases with stale policies to limit the list to sensors that require updated policies.
4. Select one or more items and use the arrows to move the selected items into or out of the Deploy policy to list.
5. Click Deploy to deploy the policy to the selected sensor(s). Deployment success or failure will be confirmed on this page.

​

Sensitive Data Discovery

• Microsoft SQL Server
• Oracle
• MySQL
• PostgreSQL

​

Terms & Scoring

• First Name, Middle Name, Last Name
• Address, PO Box, City, County, State, Country, Zip Code
• Gender, Birth Date
• Telephone Number, Fax Number, Email Address, IP Address
• Social Security Number, Social Insurance Number, Health Card Number
• Fingerprint, Voiceprint, Full Face Photo

• Driver’s License, Passport Number

• Age, Date of Death, Admission Date, Discharge Date
• Race, Ethnicity, Religion
• BMI, Web URL, Medical Record Number
• Health Insurance Provider, Health Insurance Group ID, Health Insurance Member ID
• Certificate/License Number, Vehicle Number, Device Identifier

​

Sensitive Data Discovery reporting

​

Working with Organizations, Users, and Roles

• Manage assets
• Enforce role-based access control for users
• Access, separate and/or filter data
• Manage the availability of policies for vulnerability management
• Impose operational restrictions for scan engines

• displaying a restricted list while setting up pen test or audit jobs
• filtering all reporting and dashboard data through a filter of only the elements enabled in the policy

​

Organizations

​

Edit an organization

1. Open the Users & Orgs page | Organizations tab.
2. Select an organization and click Edit. The Edit Organization dialog opens.
3. Modify the Name, add and delete Owners, and add or modify the Description of the organization.
4. Click Save to apply the changes to the organization.

​

Copy an organization’s features

1. On the Organizations tab, select the source organization that contains the assets you want to copy.
2. Click Copy | Copy Assets to. The Copy Assets to dialog opens.
3. Select the target organization and click Copy.

1. Select the source organization that contains descendants (children) you want to copy.
2. Click Copy | Copy Child Structure to. The Copy Child Structure to dialog opens.
3. Select the target organization and then click Copy.

​

Delete an Organization

• To delete an organization, select it and then click Delete.

​

Apply policies to an organization

1. Click Users & Orgs | Organizations tab.
2. Select the organization and then click Manage Policies. The Manage Policies dialog opens.
3. Select a policy (click and hold Ctrl to multi-select) and use the arrows to add or remove them from the Selected Policies list.
4. Click Save to save changes.

​

Edit and delete users

1. Click Users & Orgs | Users tab.
2. Select the user or group you want to modify and click Edit. The Edit User dialog opens.
3. Add or modify the Description as desired.
4. In the list of Organization Roles, click Delete next to any organization-role combination that is no longer valid for the user.
5. Click Add to add new organization-role combinations to the user.
6. In the System Roles list, click Delete next to any system role that is no longer valid for the user.
7. Select new System Roles for the user from the drop-down list.
8. Click Save to update the user’s roles.

1. Select the user or group.
2. Click Delete.

​

Working with roles

​

Organization roles

​

System roles

​

Working with policies in DbProtect Explorer

​

Create a new policy

1. In DbProtect Explorer, click Management | Policies in the left navigation menu.
2. Click New Policy at the top of the page. The New Policy dialog opens.
3. Provide a Policy Name and Description (both are required fields).
4. Click Create. The User-Defined Audit Policy pane opens.
5. Select the correct Asset type from the drop-down list on the left.
6. Explore the available Checks to determine which ones you would like to add to the new policy:
   • Click the arrow beside each check category to expand it.
   • Click a check name in the list to view a description of the check in the right-side pane.
   • Select each individual check you want to include or select the top-level category name to select all checks within the category.
7. Click Save Changes when you have selected all the checks you want to include in the policy.
8. Click the X button at the top-left to close the page.

​

Rename or edit a policy

1. Click Policies | Policy List.
2. Modify the Search criteria in the left pane to filter the list, or move through the list using the navigation controls at the bottom right of the page.
3. Select the policy you want to modify and click Edit. The User-Defined Audit Policy pane opens.
4. Click the Edit (pencil) icon to modify the policy name (if required).
5. Modify the Asset and Checks selection for the policy as needed.
6. Click Save Changes (or Save As to create a new policy with the modified settings).

​

Search policies

1. Select the organization the policy was assigned to from the OrgSelector drop-down list at the top right of the pane.
2. Select the appropriate filter criteria for Policy Type, Policy Template, and Status for the policy you are searching for.
3. Enter the policy name (or part of the name) into the search here field to look for a specific policy.
4. To save a search, type a Search query name and click Save & Apply.
5. To run an existing search, click Saved Searches and select the search you want to run.

​

Set up policy check report filters

​

Report filter examples

• Oracle Check: Role granted WITH ADMIN option
  Report filter: Role=DBA
  This will result in DbProtect not reporting violations found for the DBA role for this check.
• Oracle Check: Easily-guessed database password
  Report filter: Username=John
  This will result in DbProtect not reporting violations found for username: John for this check.
• Oracle Check: Easily-guessed database password
  Report filter: Username=John
  Report filter: Password=12345
  This will result in DbProtect not reporting violations found for username: John or any username with the password of ‘12345’.

​

Add report filters to a policy

1. In the Policy List tab, select the user-defined policy to which you want to add report filters and click Edit at the top of the list. The policy details slider opens.
   Note: If you double-click on the policy to open it, you will not be in Edit mode and will not be able to select a check until you click Edit in the top-right corner of the slider.
2. Select a check on which you want to filter (checkbox next to the check name must be selected). Once selected, the Report Filters tab is displayed next to the Knowledgebase tab.
3. Click the Report Filters tab, then on New Filter. The New Report Filter slider opens.
4. Select Global or Asset from the Scope drop-down list:
   • Global: Report filters will be applied to all assets included in a report generated based on this user-defined policy, if no individual database assets are defined.
   • Asset: If specific assets are defined, the report filter will be applied only to the database assets defined in the filter.
5. Expand the Condition drop-down list and select one of the parameters available for the check you selected.
6. Provide the Value for the parameter, then click the add icon to add the condition to the filter.
7. Repeat steps 5-6 to add as many conditions as required.
8. If you have selected to define specific assets, select an asset from the Asset Type drop-down list.
9. Select Ipv4 and provide the IP address for the asset.
10. Set the Port number and provide a descriptive Name for the asset.
11. Click the add icon next to the Asset Type you select. The asset is added to the filter.
12. Repeat steps 8-11 for each asset you want define for this filter.
13. If an asset is incorrectly defined, you can modify the details, or click the remove icon to remove it from the filter.
14. Click Save Changes in the top-right corner of the slider before closing the report filter.

​

View report filters

1. Click the enabled check containing the report filter you want to view.
2. Click Report Filters. The Report Filters dialog opens, displaying a list of report filters.
3. Click the + icon to expand the details of each report filter. Any report filter with a + contains risk acceptance information that can be viewed.
4. Click OK to close the Report Filters dialog.

​

Edit report filters

1. Click the enabled check containing the report filter you want to edit.
2. Click Report Filters. The Report Filters dialog opens, displaying a list of report filters.
3. Click on the report filter you want to edit.
4. Click Edit. A dialog opens, displaying editing options for the report filter.
5. Make your desired edits and click OK.
6. Click OK. Your edits are automatically saved.

​

Delete report filters

1. Click the enabled check containing the report filter you want to delete.
2. Click Report Filters.
3. Select the report filter you want to delete.
4. Click Delete.
5. Click Yes to verify the deletion. This will delete the report filter and any risk acceptance information you included for the selected report filter.
6. Click OK to close the Report Filters dialog.

​

Import a policy

1. In the Policy List tab, click Import. The Import Policies slider opens.
2. In the Source drop-down list, select either Load file or Copy & Paste:
   • If you select Load file, click the Load button to navigate to and select the file to import.
   • If you select Copy & Paste, copy valid XML into the editing box. If the XML is invalid, it is indicated above the box. Edit the XML as needed to eliminate the Invalid XML warning.
   Note: Click the copy icon to copy the contents of the XML editing box to another location or application.
3. Click Submit to begin the policy import.

​

Export a policy

1. In the Policy List tab, click Export. The Export Policies slider opens.
2. Select the checkbox next to each policy you want to export, or select the top checkbox to select all policies in the list.
3. Click the Data to Export arrow and choose between exporting all data, or just the exceptions.
4. Click Submit to begin the export.

​

Activate/deactivate a policy

1. On the Policy List tab, select the policy you want to activate/deactivate.
2. Click the appropriate button at the top of the list to change the status of the policy.
3. Click OK to save changes.

​

Working with scan engines

​

Advanced scan engine configuration

​

Additional per Scan Engine configuration

"EnforceStrictVerification":true,
"EnforceTlsVerification":true,

​

Unregister a Scan Engine

1. Click Settings | Scan Engines.
2. Select the scan engine from the list and click Unregister.

​

Configure a scan engine

1. Select a scan engine in the list and click Configure. The Configure Scan Engine dialog opens.
2. On each of the side tabs of the dialog, you can perform the following tasks:
   • Discovery Network Interface: Set the network interface to be used by the scan engine (if more than one is available on the server). This option directs the scanning to a specific subnet.
   • Availability: Set the scan engine as Available or Unavailable (for instance, if the server is overloaded or you do not want to scan specific subnets).
   • Organization Restrictions: Set the organizations that can use this scan engine.
   • Group: Set an asset group so that the scan engine scans only the assets in the group. The restriction is evaluated at runtime along with any other restrictions made in the scanning job.
3. Click Save.

​

Update the SHATTER Knowledgebase

1. When a new Knowledgebase is available, click Settings | Scan Engines.
2. Select the scan engine in the list and then click Update Knowledgebase. When the update is completed, Update Successful will be displayed above the scan engine list.

​

Working with assets

​

Edit or delete an asset

​

View asset details and credentials

• Select the asset from the assets list. The Details and Credentials tabs are displayed in the lower pane of the window. If these tabs are not visible, click Expand at the bottom right of the page.

1. Click View Summary Report. The Summary Report opens in a separate browser window.
2. Generate one of the drill-down reports (displayed as links below each report segment) for more detailed information.

• Click the Credentials tab. The details of the asset’s credentials (whether shared or individual) are displayed.

​

Add/modify/remove attributes for multiple assets

1. Select the checkboxes next to the assets with attributes you want to modify.
2. Click Attributes. The Manage Attributes dialog opens.
3. To add an attribute:
   • Enter a new Attribute Name and Value for all the assets you have selected. System-reserved attribute names are shown on the Pre-Defined Attributes table.
4. To modify an existing attribute:
   • Existing attributes and values for the selected assets are listed. If an attribute has different values for different assets, click the arrow to the left of the attribute name to view all values.
   • Select an attribute to populate the Name and Value fields, edit the fields as needed, and then click Set.
5. To remove an attribute:
   • Click Delete next to an existing attribute to delete it.
   Caution: Deleting an attribute will delete it for all assets you have selected.
6. When you have set all attributes, click Save to apply the changes.

​

Add/modify/remove organization associations

1. Click Assets on the DbProtect taskbar.
2. Select the checkboxes next to the assets you want to associate an organization with.
3. Click Org Associations. The Organization Selector opens.
4. Select the checkbox next to each organization you want to associate the asset(s) with.
5. Click OK.

​

Manage credentials

• Job-based credentials: defined as part of a job (see Set up and run a job)
• Asset-based credentials: defined for a particular asset
• Shared credentials: defined for a group of assets matching a search expression

​

Add credentials to an individual asset

1. Click New Credentials and then select the type, either Database or Windows. The Add Credentials dialog opens.
2. Select an existing Credential Group or click New to create a new group:
   1. Type a name for the group.
   2. Select the organization to add to the new group.
3. Select the Authentication Type.
4. Enter the credential information appropriate for the type, and then click Test.
   Tip: For additional details about expected values for some fields, click the help icon next to the field.
5. If the test is successful, click Save to save the credentials for this asset.

​

Delete asset-based credentials

• To delete the credentials for an asset, select the checkbox next to the item and click Delete.

​

Import and export credentials

1. In the upper right of the Assets page, click Manage Credentials | Import Organization Credentials.
2. Paste the data from a CSV file into the Credentials field. For a sample of the data format, click View sample file.
3. Select an Organization from the hierarchy.
   Caution: If you have integrated CyberArk with DbProtect, you MUST add the following line to the credentials:vault id = [vault id for the DbProtect vault created during setup]
4. Click Test Import.
   • If the test is not successful, edit the CSV data.
   • If the test is successful, click Import.

1. In the upper right of the Assets page, click Manage Credentials | Export Organization Credentials.
2. Select an Organization from the hierarchy and click Export Credentials in CSV Format Below.
3. Copy the resulting CSV data from the Credentials field.

​

Create/modify/delete per-asset credential groups

1. In the upper right of the Assets page, click Manage Credentials | Manage Per Asset Credential Groups.
2. Click New Group to add a group to an organization, type a Credential Group Name, select the organization it should be added to, and click Create.
3. Select the checkbox next to an existing credential group name, click Edit to modify the name of the group, and click Update. The modified group name is displayed.
   Note: You cannot change the organization associated with an existing credential group. To do this, you must delete the existing credential and create a new one with the correct organization selected.
4. Select the checkbox next to any credential group you want to remove and click Delete.

​

Create/modify/delete shared credential groups

1. Click Manage Credentials | Manage Shared Groups.
2. To add a new credential group, click New Group. The Create a Shared Credential Group dialog opens:
   • Type a Credential Group Name.
   • Click in the Organization field, select an organization from the hierarchy, and click OK.
   • Define the group using an asset search query (see Search assets).
   • Click Create to create the group.
3. Edit a credential group’s membership:
   1. Select a group and click Edit.
   2. Modify the name and/or the asset query, and then click Save. You cannot change the organization associated with the group.
4. Add credentials to a group:
   1. Select a group, click Add Credentials and select the credential type from the list. The Add Credentials dialog opens.
   2. Select the Authentication Type from the drop-down list and provide the information required to complete the authentication.
   3. Click Save.
   Note: For additional details about expected values for some fields, click the help icon next to the field.

• To delete a credential group select it in the list and then click Delete.
• To close the shared groups window, click OK.

​

Search assets

• Apply one or more “facets”. Facets are specific attributes of assets that have a limited number of possible values, such as database type and network location.
• Apply a search expression, optionally using Boolean, likeness, string, and arithmetic operators.

​

Filter with facets

• Databases: Database technologies and versions, such as Microsoft SQL Server 2012 Express
• Networks: IPv4 class A or class B networks such as 10.*.*.* or 10.2.*.*
• Platforms: Operating system versions such as SCO Unix or Microsoft Windows x86
• Organizations: Groupings of assets that you have created

​

Set up a search query

1. Select the checkbox next to each facet item you want to include in the search:
   • Click the arrows to expand each facet type
   • Click more to view a full list of items for each facet type
   • Click all next to a facet type to select all items
   • Click clear to remove all selections for a facet type
2. Click Update Search Results to apply the facet and search expression selections to the list on the Asset Search Results page.
3. Click Reset at the bottom of the pane to reset all facet and search expression selections.
4. Click Save Search Query As at the bottom of the pane to save the facet and search expression selections for later use.

​

Use search expressions

1. Type the search expression in the Search field.
2. Select the facets you want to include in your search.
3. Click Update Search Results.
4. Click Reset at the bottom of the pane to reset all facet and search expression selections.
5. Click Save Search Query As at the bottom of the pane to save the facet and search expression selections for later use.

​

Use saved search queries

1. Set up the query (facet and search expression selections) as desired.
2. Click Save Search Query As at the bottom of the pane.
3. Type a Name and select an Organization to associate the query with.
4. Click Save.

1. Click Saved Search Queries at the top of the Search pane and select an item from the list. The Asset Search Results pane will be updated to match the query.
2. Modify the query as desired and click Save above the search expression field.
3. Click Close above the search expression field to return to an unfiltered view in the Asset Search Results pane.

​

Asset groups

• Oracle 12c in multi-tenancy mode: You can create individual assets corresponding to individual Pluggable Databases (PDBs), and the Container Database (CDB), and then mark them as a part of one group representing the entire database instance.
• Oracle RAC: You can create individual assets corresponding to various databases that participate in the high-availability configurations of one RAC and mark them as a part of one group.
• Windows Server Failover Clusters: You can create individual assets corresponding to individual instances that work together to provide the AlwaysOn and High-availability features and then mark them as a part of one group.

​

View the assigned asset group for an asset

1. Click Assets on the DbProtect taskbar.
2. In the Asset Search Results pane, mouse-over any column header and click the down arrow that appears on the right side.
3. Choose Columns | Asset Group. The Asset Group column will be visible, and if the assets have been assigned to an asset group, the group name will be displayed in the column.

​

Set up asset group credentials

1. Add attributes to multiple assets (previously known as Bulk Attribute Management), using “assetGroup” as the Attribute Name and the name you want for the asset group as the Value.
2. Add a shared credential group and use the string assetGroup="[assetGroup Name]" for the asset search query.

​

Use an asset group in a job

1. Add attributes to multiple assets, using “assetGroup” as the Attribute Name and the name you want for the asset group as the Value.
2. Click Jobs page | Jobs tab.
3. Click New Job and select the type of job you want to create.
4. Enter a Job Name and select the Organization the job will be run in.
5. Click Continue. The Edit Job dialog opens to the Assets side tab.
6. Click the Ad Hoc Query option at the top of the Assets list.
7. Type or paste the following string into the Asset Query Search field: assetGroup="[assetGroup Name]" where [assetGroup Name] is the name you gave to the asset group when setting up the attributes.
8. Click Search. The assets you provided asset group attributes for are listed in the Asset Preview pane.
9. Click Create. Continue with the job set up.

​

Working with Jobs

​

Set up a credential test job

1. Click New Job | Credential Test on the Jobs tab. The Create a Job dialog opens.
2. Type a Job Name and select the Organization that contains the job you want the credentials test to be run against.
3. Click Continue. The Edit Job dialog opens.
4. Select the Job containing the assets with credentials you want to test.
5. Click Next on the Advanced Settings side tab.
6. Provide email addresses to be notified at job completion.
7. Select the Treat missing permissions as fatal option to indicate whether the job should report a failure if some credentials are valid for connection but missing required permissions for the job tasks.
8. Click Save. The job is set up and now appears in the Jobs list.
9. Click Run Now to run the job immediately.
10. Click Schedule and select the Schedule Type, Start Time, and Start Date, to run the job in the future (one-time or recurring).

​

Set up a discovery job

1. Click New Job | Discovery on the Jobs tab. The Create a Job dialog opens.
2. Type a Job Name and select the Organization that contains the assets you want to discover.
3. Click Continue. The Edit Job dialog opens.
4. On the Discovery Criteria side tab, click Add Criteria. The Add Discovery Criteria dialog opens.
5. Enter Network Destinations. For examples, see the text and link below the field.
6. Select Port Options.
   1. Select Add defaults to check the default ports for database types.
   2. Select Add specific ports if you know that your organization’s databases listen on nonstandard ports.
   3. Select the Bypass port scanning option if scanning is not possible in the environment.
   Caution: This option can cause discovery to be less efficient.
7. Select the checkbox next to at least one Asset Type, or the checkbox next to Asset Types to select all items.
8. Click Add. Repeat previous steps to add additional criteria to the job.
   • Select an existing criteria and click Edit to change criteria details.
   • Select an existing criteria and click Delete to remove it from the job.
9. Click Next or click the Reports side tab to set up one or more reports to run as part of this job.
   1. Click Add Report.
      Note: For Discovery jobs, only the Other report scope is available.
   2. Select a Report Template (Asset Inventory is commonly selected for discovery jobs), or select the Filter Shortcut option and paste a shortcut string into the field.
   3. Click Change scope organization for this report to run the report on a descendant (child) organization to reduce the scope of data reported on.
   4. Click Next and select an Organization for the report to be run on.
   5. Click Next and set the Input Settings.
   6. Click Next and set the Output Settings.
   7. Click Save.
10. Click Next or click the Advanced Settings side tab and:
    1. Provide email addresses to be notified at job completion, or if credential problems occur.
    2. Add one or more Known database/instance/SID names.
       Note: This option can help to find databases if security restrictions are in place, such as SQL Browser being stopped.
    3. Add one or more Oracle listener passwords.
    4. Select the Scan unresponsive hosts option (hosts that do not respond on closed ports) if you want to ensure full results. This will likely increase the time to complete a Discovery job.
    5. Select the Save additional information option to save any data gathered as asset attributes
    6. Select the Update asset version and platform… option if you want an existing asset to be updated if newer versions are available.
    7. Select the Ignore duplicates and errors option to reduce the time to complete the scan
    8. Select the Replace existing endpoints with discovered ones option to update existing endpoints that have changed since being added to your assets.
11. Click Save. The job is set up and now appears in the Jobs list.
12. Click Run Now to run the job immediately.
13. Click Schedule and select the Schedule Type, Start Time, and Start Date, to run the job in the future (one-time or recurring).

​

Set up a report job

1. Click Jobs page | Jobs | New Job. The Create a Job dialog opens.
2. Select the Report job template in the left pane, type a Job Name, and select an Organization for the job to run on.
3. Click Continue. The Edit Job dialog opens.
4. Click Add Report. The Report Wizard opens.
5. Select a Report Template or select the Filter Shortcut option to create a custom report and paste a shortcut string into the field.
6. Click Change scope organization for this report to run the report on a descendant (child) organization and reduce the scope of data reported on.
7. Click Next and set the Input Settings. Depending on the report template you chose, there may be additional options to complete. For example, in some reports you will need to:
   1. Select an organization for the report. You can choose the organization specified in the job, or an available descendant (child). Click the Include descendants option if you want all child organizations to be included.
   2. Select an asset to report on and a specific user to report on.
   3. Choose to include non-scannable assets. Non-scannable assets may include Oracle Listeners and SQL Redirects.
   4. Specify the results filtering and scope of the report.
   Note: When reports are generated at the scope of an organization, all check results for all assets in the organization are considered. These results are first filtered by checks that are available to policies associated with the organization. If different policies include different report filters on the same check, all report filters on each check will be applied.It can be useful to limit the report to specific assets, or to report on check results based on a specific policy or even a specific audit job. When reports are filtered through a specific policy (“Policy Lens”), only the checks from that policy are included and the report filters specified in that policy are applied.
8. Select a type of filtering, and then select the detailed values. For example:
   • In the Check Results Summary, you can choose to filter by assets, attributes, or a specific job, or an organization.
   • You can also choose to filter through a specific Audit or Pen Test policy (“Policy Lens”).
   • You can choose to include SHATTER Knowledgebase articles in the report.
9. Click Next and set the Output Settings for the report.
   1. Enter a Report Name and select an output Format.
   2. (OPTIONAL) Enter the email addresses of users who should receive a link to the completed report.
   3. Click Save to add the report to the list.
10. Click Next or click the Advanced Settings side tab.
11. Add the email addresses of users who should receive a notification when the job is complete.
12. Click Save. The job is set up and now appears in the Jobs list.
13. Click Run Now to run the job immediately.
14. Click Schedule and select the Schedule Type, Start Time, and Start Date, to run the job in the future (one-time or recurring).

​

Add assets to jobs using saved and ad hoc queries

1. Create the job (see Set up and run a job), and when you are ready to add assets select one of the two following selections:
   • Saved query:
     1. Click the Saved Query option.
     2. Choose a saved query from the list on the left side of the Assets side tab. Assets matching the query display in the right pane. You cannot modify the query within the wizard.
     3. To modify saved queries, see Use saved search queries.
   • Ad Hoc Query:
     1. Click the Ad Hoc Query option.
     2. Select facets and/or enter a search expression in the left pane.
     3. Click Search. Assets matching the query display in the right pane.
2. Click Next to continue, or click the Policy side tab.
3. Continue with the job setup as per Set up and run a job.

​

Edit a Job

• To edit a job, select it and then click Edit in the toolbar. For help with the available settings see the sections on creating a job, above.

​

Clone a Job

• To make a copy of a job, select it and then click Clone in the toolbar. Cloning does not copy the job schedule. After cloning a job, edit it as required and schedule it if required.

​

Delete a Job

• To delete a job, select it and then click Delete in the toolbar.

​

Monitor job progress

​

Advanced Monitoring

​

Alerts tab

• Click any column heading to sort the list.
• Click the Alert ID number to view details of an alert.
• Select the checkboxes of one or more alerts to perform the actions on the buttons at the bottom of the list.

​

Refresh alerts

• Click the Refresh button to manually refresh the alert list.
• To refresh automatically, set a time in seconds and click Start. To stop refreshing, click Stop.
• To change the auto-refresh interval while it is running, enter a time in seconds and then click Update.

​

Filter alerts

• To filter the alerts shown in the list, make selections from the menus and/or enter parameters in the fields and click Apply Criteria.
• Type a number in the Count field to view only a set number of alerts at a time.
• Type in the Search in SQL Text field to search for the specific SQL query that executed and triggered the alert.

​

Viewing alert details

• Click the Alert ID number for an alert to view its information. The details will be displayed in a separate browser window and provide a full listing of all available information about the alert.
• Click Archive or Acknowledge to process this alert from the detail window or close the window to return to the full list of alerts.

​

Acknowledge and archive alerts

• Click the Hide Acknowledged option if you want acknowledged alerts to be automatically hidden from the active list of alerts.
• Archiving an alert moves the alert to the Archive tab and acknowledges the alert if it has not yet been acknowledged.

1. Filter the alerts as desired.
2. Click Archive All Alerts or Acknowledge All Alerts to archive or acknowledge all alerts shown. All displayed alerts will be removed from the list, and if you chose to archive the alerts, they will be moved to the Archive tab. OR Select the checkboxes next to one or more alerts that you want to acknowledge or archive and click Archive Selected Alerts or Acknowledge Selected Alerts. The selected alerts will be removed from the list and if you choose to archive the alerts, they will be moved to the Archive tab.

​

View archived alerts

• Click the Archive tab on the Alerts page to view the list of alerts that have been archived.

​

Un-archiving alerts

1. Click the Alert ID next to an archived alert. The Details window opens.
2. Click Un-archive to restore the selected alert(s) from the archive to the active list.

​

Delete alerts

1. Filter the alerts as desired.
2. Click Delete All Archived Alerts. All alerts displayed will be permanently deleted from DbProtect. OR Select the checkboxes next to one or more alerts and click Delete Selected Archived Alerts. The selected alerts will be deleted from DbProtect.

​

Monitoring Dashboard tab

​

Monitoring Reports tab

​

Monitoring Policies tab

​

Create a policy

1. Click Create New Policy. The DbProtect Activity Monitoring Policies page opens in a new browser window and displays a hierarchy view of available policy rules.
2. Expand the tree to see available rules for each server type and category.
3. Click the rule name to view details of the threats or behaviors covered in the right pane.
   Note: Exceptions that you have created are displayed in the hierarchy as branches below (within) the rule that you created an exception to. See Create exceptions for information about creating exceptions.
4. Select the checkboxes next to each rule that you want to include in your policy.
5. Set the Risk Level for each rule using the menu for that rule (displayed at the end of the rule name).
6. When you have completed your selections, enter a name for the policy at the top of the rules list and click Save. The new policy is displayed in the list on the Monitoring | Policies tab and is available for deployment.

​

Edit a policy

1. Click the Edit button next to a named policy in the list. The DbProtect Activity Monitoring Policies page opens in a new browser window.
2. Expand the tree to see available rules for each server type and category.
3. Click the rule name to view details of the threats or behaviors covered in the right pane.
4. Select the checkbox next to each rule that you want to include in your policy.
5. Set the Risk Level for each rule using the menu for that rule (displayed at the end of the rule name).
6. When you have completed your selections:
   • If you edited a custom policy that you had previously created, click Save to save changes, or enter a new name and click Save As to save a new policy and keep the existing policy.
   • If you edited a built-in policy, you can only Save As (you cannot change built-in policies). The new policy is displayed in the list on the Monitoring | Policies tab and is available for deployment.

​

Delete a policy

• Click Delete next to a policy that you created to delete it. Built-in policies cannot be deleted.

​

Export and import a policy

1. Click the Export button for the policy in the list.
2. Navigate to the location where you want the resulting XML file to be located and click Save.

1. Click Import Policy.
2. Click Choose File and navigate to the location where you have previously saved a valid policy XML file.
3. Select the file and click Open. The file name is displayed next to the Choose File button.
4. If you want to overwrite an existing policy with the same name as the one you’ve selected, select the Import with overwrite option.
   Note: The file name is not the policy name. The policy name is found within the file.
5. Click Import.

​

Re-deploy multiple policies

1. Click Deploy Policies in Bulk. The Policy Deployment page opens and displays a list of sensors and the policies that have been deployed to them.
2. On the Policy Deployment page, the list of available database applications shows configured Sensors and the currently deployed policy for each (if any).
   • Type in the Search field to look for specific text in the descriptions of the sensor
   • Select the Only show databases with stale policies to limit the list to sensors that require updated policies.
3. Select one or more items and use the arrows to move the selected items into or out of the Re-deploy policies to list.
4. Click Deploy to re-deploy selected policies to the sensor(s). Deployment success or failure will be confirmed on this page.

​

Filters

​

Create audit filters

1. Under Audit Filter Wizard, click Create. The Filter Manager page opens.
2. Select the database type and click Next. The Audit Filter Wizard opens.
3. Select one or more types of actions to audit, and then click Next. Available actions include:
   • SELECT, INSERT, UPDATE, and DELETE actions on user and system tables and views
   • EXECUTION of Stored Procedures and Functions
4. Select the Database Instance to audit from the drop-down list and click Next.
5. Select the Database to audit from the drop-down list and click Next.
6. Select the object(s) to audit. To select multiple items, press Ctrl while selecting the items, or click and drag your mouse down the entire list to select all items.
   • For any tables selected in the list, select Yes or No to indicate whether to audit on the column level.
   • Select one or more stored procedures and functions that you would like to audit.
7. Click Next. The following page of the Audit Filter Wizard may take a few moments to load, depending on the number of items selected on the previous page.
8. If you choose to audit on the column level, select the columns to audit (for each table you selected) and click Next.
9. Type a Title and other descriptive information for the audit.
10. Select a Risk Level from the drop-down list and click Next.
    Note: Items with Info-[#] selected for Risk Level do not display in detail in the console.
11. Review the details of your audit filter. Click Back to make changes or Save to create the filter.
12. Click Add filter to policy to go to the Policy Manager page.
13. Click Edit next to the policy you want to add the newly created filter to. The DbProtect Activity Monitoring Policies page opens in a new window.
14. Expand the tree for the database type you selected when creating the filter, then expand Audit Events.
15. Scroll down the list and expand the User [action or function] item that matches the selection you made when creating the filter (e.g., “User Table – Select” or “User defined function”)
16. Select the checkbox next to the filter you created and:
    • If you edited a custom policy that you had previously created, click Save to save changes, or enter a new name and click Save As to save a new policy and keep the existing policy.
    • If you edited a built-in policy, you can only Save As (you cannot change built-in policies).

​

Create exceptions

1. Under Exception Wizard, click Create. The Filter Manager opens.
2. Select the database type and click Next. The Exception Wizard opens.
3. From the Create an exception for the rule drop-down list, select a rule. If you want to create a Global Exception (not limited to specific rules), select All [database type] Activity.
4. Click Next.
5. Add one or more conditions that define the situations where the parent rule should not fire.
   Notes: If you add more than one condition, the exception will only apply when ALL conditions are true.

   • To make exceptions for several different single conditions, the preferred method for readability is to create an exception for each condition.
   • You can also edit the expression using the Advanced Filter and Exception Editor and change the <and> condition to <or>.
6. Type a Title and other descriptive information for the audit and click Next.
7. Review the details of your exception filter. Click Back to make changes or Save to create the filter.
8. Click Add to policy to open the Policy Manager page.
9. Expand the tree for the database type you selected when creating the filter, then expand the tree further to find the parent rule that you created the exception for.
   Note: Some rules, such as “All Microsoft SQL Server 2005/2008/2012/2014 Activity” will result in your exception being placed in the User-defined Global Exceptions folder.
10. Select the checkbox next to the filter you created and:
    • If you edited a custom policy that you had previously created, click Save to save changes, or enter a new name and click Save As to save a new policy and keep the existing policy.
    • If you edited a built-in policy, you can only Save As (you cannot change built-in policies).

​

Create advanced filters and exceptions

1. Under Advanced Filter and Exception Wizard, click Create. The Filter Manager opens.
2. Choose the database type and click Next. The Advanced Filter Editor opens.
3. Select the rule that you want to create the filter or exception for. If you want to create a global exception or filter (not limited to specific activity types), select All [database type] Activity.
4. Click Next.
5. Select whether to trigger ONLY when the conditions are met or EXCEPT when the conditions are met.
6. Enter expressions and conditions that define the filter. The filter is saved in an XML document and must be valid XML
   • Each expression consists of a name, an operator, and a value. The Legend shows available operators and some common names.
   • For a full list of names, see Appendix A: Monitoring Filter Name Attributes.
   • Expressions can be combined using the operators AND and OR.
   Note: The expression editor performs some basic checking of the XML format and the contents of the expressions. The editor does not check for valid tag names.A good way to understand the format of filters is to create some filters or exceptions using the wizards, and then edit them in the Advanced Filter and Exception Editor to see how the information is saved
7. Click Next.
8. Type a Title and other descriptive information for the audit.
9. Select a Risk Level from the drop-down list and click Next.
   Note: Items with Info-[#] selected for Risk Level do not display in detail in the console.
10. Review the details of your filter. Click Back to make changes or Save to create the filter.
11. Click Add to policy to open the Policy Manager page.
12. Expand the tree for the database type you selected when creating the filter, then expand the tree further to find the parent rule that you created the filter for.
    Note: Some rules, such as “All Microsoft SQL Server 2005/2008/2012/2014 Activity” will result in your exception being placed in the User-defined Global Filters folder.
13. Select the checkbox next to the filter you created and:
    • If you edited a custom policy that you had previously created, click Save to save changes, or enter a new name and click Save As to save a new policy and keep the existing policy.
    • If you edited a built-in policy, you can only Save As (you cannot change built-in policies).

​

Edit a filter

• Click Edit next to the filter you want to modify. The item will be opened for editing in the Advanced Editor Wizard. Make changes as required and click Save.

​

Delete a filter

• Click Delete next to the filter or exception you want to remove. You will be asked for confirmation.

​

Import a filter

1. Under Import Filters, click Import.
2. Click Choose File and navigate to the location where you have previously saved a valid policy XML file.
3. If you want to overwrite existing filters with the same names as filters found in the file, select the Import with overwrite option.
   Note: The file name is not the filter name. The filter name(s) is found within the file.
4. Click Import.

​

Export a filter

1. Select one or more checkboxes beside the filter you want to export from the My Filters list. To select all items, select the checkbox under the Export button.
2. Click Export.
3. Navigate to the location where you want to save the resulting XML file and click Save.

​

Sensors tab

​

View sensor details

1. Select a sensor name in the left pane to view details in the right pane. Sensors that cannot be contacted or that have a configuration issue display a warning icon.
2. If many sensors are configured, type text in the Filter field and click Apply.
3. Click Refresh Status to make sure you are looking at an accurate list of available sensors.

​

View sensor configuration details

1. Click View Sensor Configuration Details to view a summary of configuration for all sensors. The Configuration Summary page lists the availability, network location, version, database instance monitored, and policy deployed for each sensor alias.
2. Click Download CSV to download the information to file you can save.
3. Click Back to return to the main page.

​

Configure or reconfigure a sensor

1. Select the sensor in the left pane to view details in the right pane.
   Note: You cannot reconfigure a sensor that cannot be contacted.
2. Click Reconfigure to display the details of the configured instances on the sensor.
   • Click Reconfigure next to a defined instance. For detailed procedures, see the DbProtect Sensor Installation and Configuration Guide.
   • Click X next to a defined instance to remove it from the list of configured sensors.
   • Click Configure New Instance to configure a new instance of the sensor. For detailed procedures, see the DbProtect Sensor Installation and Configuration Guide.
3. Under Advanced Settings, click Modify to change the logging level for the sensor.
4. Select a different logging level from the drop-down list and click OK.
5. When you have completed all required changes, click Deploy to Sensor.

​

Unregister a sensor

1. Select the sensor in the left pane to view details in the right pane.
2. Click Unregister. You will be asked for confirmation.

​

Deploy multiple policies

​

Monitoring Settings

• Email forwarding rules
• Forwarding settings
• Email server settings

​

Email Forwarding Rules

Create or modify an email forwarding rule

1. Click Create a new Email Forwarding Rule (below the existing rules list, if any). OR Click Modify next to an existing rule that you want to change.
2. On the first page of the Email Forwarding Rules Wizard, type or modify Template Name for the rule and type (or paste) a list of email addresses to send activity notifications to. Addresses should be comma-separated; the entire list cannot exceed 256 characters.
3. Click Next.
4. On the criteria page of the wizard, select:
   • One or more server aliases (Ctrl-click to select more than one; click ALL to select all)
   • One or more alert titles (Ctrl-click to select more than one; click ALL to select all)
   • A time range (any time, or a start and end time in 24-hour format)
   • One or more risk levels
5. Click Next.
6. On the fields page of the wizard, select one or more fields to include in the message, and use the arrow buttons to move them between the Possible Fields and Fields to Send boxes.
7. Click Next.
8. On the summary page of the wizard, review the rule.
9. Click Back to make changes or Save to save the rule. New rules are active by default.

​

Forwarding settings

• Polling Frequency: Enter the number of minutes between checks by DbProtect for new alerts that match the forwarding rules. The default polling frequency is 5 minutes.
• Maximum Alerts to Handle: Enter the maximum number of alerts you want DbProtect Activity Monitoring to send in each email.

​

Email server settings

​

Working with DbProtect Explorer Alerts

1. Select a timeframe from the drop-down list at the top of the filter pane.
2. Indicate whether you want to show Archived or Acknowledged alerts in the list.
3. Select the level(s) of Risk you would like to filter the list with.
4. Click Update Search. The list is updated.
5. Select an alert to view its initial details in the bottom pane or double-click to view full information.

​

Archive or Acknowledge alerts

1. Select the checkbox next to each alert you want to archive or acknowledge, or select the checkbox at the top of the column to select all items.
2. Click the Archive or Acknowledge button, as required.

​

Filter Anomalies (Preview)

• Anomaly
• First-seen anomaly (reverts to the Anomaly icon if the same alert is raised more than once)

1. Select a timeframe from the drop-down list at the top of the filter pane.
2. (OPTIONAL) Click the add condition icon to apply further conditions to the list using either “contains” or “does not contain” criteria.
3. Click Update Search. The list is updated.
4. Select an alert to view initial details in the bottom pane, or double-click for full information.

​

Working with Reports

​

Filter a report

​

Difference between On Demand reports and Job reports

• On Demand reports are generated from the Explorer Dashboard and can be filtered based on various criteria. DbProtect calculates an effective policy based on all policies available to the organization. The report output shows the results based on date and other criteria specified.
• When a report is generated as part of a specific audit job, the report output shows only the results from that run of the job. These results will usually have a much more focused, effective policy.

​

Modify System Settings

​

About DbProtect

​

Scan Engines settings

​

Email

1. Click Edit. The Outgoing Email Server Settings dialog opens.
2. Enter the IP address or resolvable name of the SMTP Server.
3. Enter the Port number where mail is accepted (normally port 25).
4. If a login is required to send mail, enter the User Name and Password.
5. (OPTIONAL) Select the Set a limit for email attachments option and type a maximum size in MB to limit the size of email attachments (such as PDF report files).
6. (OPTIONAL) Enter addresses in the From and Reply-To fields. If these fields are left blank, the messages will be sent with a blank From Address.
7. If you want to send a test email (recommended):
   1. Click Send test email.
   2. Type the address in the Test Email Address field.
   3. Click Send Test Email. The dialog that opens shows whether the message was sent. If the message could not be sent, a new window displays the error.
8. To save the configuration, click OK.

​

Diagnostics

​

Warehousing

• Click Update Now to push stored updates to your assets, organizations, and policies, without waiting until the scheduled warehousing window starts.
• Click Get data warehouse statistics report to generate a statistical report on the job activities run on your network.
• Click Show Advanced Options | Start Window Now to manually start a warehousing window. All updates to the system from the point forward are published as they occur. If you want to end the window before the updates are complete, click End Current Window.

​

Licensing

1. Click Add License to open the Add A License dialog.
2. Type or paste the contents of the ARxx.lic or ADxx.lic file in the field, and then click Add.
3. Click Get license utilization report to see a report of license utilization by asset, organization, and usage details.

​

Appendix A: Monitoring Filter Name Attributes

​

Name Attributes

​

SQL Server Name Attributes

​

DB2 Name Attributes

​

Sybase Name Attributes

​

Oracle Name Attributes

​

Appendix B: User Account Privileges Needed for Audit and User Rights Review Scans

<InstallDir>\Trustwave\DbProtect\Resources\ShatterKnowledgebase\UserCreationScripts

• CreateUser[Asset].sql: Creates a user called aduser and grants read-only permissions needed to run Audit policy scans
• CreateUser[Asset]URR.sql: Creates a user called aduserURR and grants read-only permissions needed to run Audit policy and User Rights Review scans
• CreatePowerUser[Asset].sql: Creates a user called aduser_admin and grants elevated privileges (for example, SYSDBA for Oracle)
• CreateUser[Asset]SA.sql: Specific to Microsoft SQL Server. Creates a user called aduser and grants sysadmin rights

<InstallDir>\Trustwave\DbProtect\Resources\ShatterKnowledgebase

​

Appendix C: Sensitive Data Discovery (SDD)

​

Analyzing Logic

​

Confidence level analysis

• Very Low: when data has multiple types and has no data to verify.
• Low: when data has one type and has no data to verify.
• Medium: when data has only one type and not all values are verified (null or value has both negative and positive matching)
• High: when data has both name and value matches. Most values validated > 50% positive, has no negative matching
• Very High: when data has both name and value matches, and has other related data in the same table or related tables by foreign keys

​

Sensitivity level analysis

​

SDD reporting

​

Appendix D: Maintenance and Disaster Recovery

​

Maintenance Topics

​

Backup and Disaster Recovery

​

Bulk Data Management

• ExportResults.bat
• ImportResults.bat
• PurgeResults.bat

​

Appendix E: Asset Import Example CSV Information

• host
• port
• instanceName
• assetType

host,port,instanceName,assetType
oracle11gdev,1521,ORCL,Oracle
172.16.32.133,5000,PREPROD,Sybase
172.16.32.57,49396,DOCS,Microsoft SQL Server
172.16.32.79,5000,RHL64SYBASE15,Sybase
172.16.32.87,1521,ORCLWS,Oracle
172.16.32.97,1433,MSSQLSERVER,Microsoft SQL Server
172.16.33.1,3701,db2inst1,IBM DB2

host,port,instanceName,assetType,assetVersion,platform
oracle11gdev,1521,ORCL,Oracle,Oracle11gR2 Database,Microsoft Windows
172.16.32.133,5000,PREPROD,Sybase,Sybase 12.5 Database,Linux
172.16.32.57,49396,DOCS,Microsoft SQL Server,Microsoft SQL Server 2008 R2,Microsoft Windows
172.16.32.79,5000,RHL64SYBASE15,Sybase,Sybase 15.0 Database,Unknown Platform
172.16.32.87,1521,ORCLWS,Oracle,Oracle11gR2 Database,Solaris
172.16.32.97,1433,MSSQLSERVER,Microsoft SQL Server,Microsoft SQL Server 2008,Microsoft Windows
172.16.33.1,3701,db2inst1,IBM DB2,DB2 Database,Linux

host,port,instanceName,Primary Application,assetType,assetVersion,platform,Organization,Owner
oracle11gdev,1521,ORCL,Oracle Dev Box NYC,Oracle,Oracle11gR2 Database,Microsoft Windows,America,John Doe
172.16.32.133,5000,PREPROD,Pre Production Staging Syb 12.5,Sybase,Sybase 12.5 Database,Linux,China,Jane Doe
172.16.32.57,49396,DOCS,Documentation Repository,Microsoft SQL Server,Microsoft SQL Server 2008 R2,Microsoft Windows,,
172.16.32.79,5000,RHL64SYBASE15,,Sybase,Sybase 15.0 Database,Unknown Platform,Latin America,none
172.16.32.87,1521,ORCLWS,Web Server,Oracle,Oracle11gR2 Database,Solaris,Europe,John Doe
172.16.32.97,1433,MSSQLSERVER,,Microsoft SQL Server,Microsoft SQL Server 2008,Microsoft Windows,Europe,
172.16.33.1,3701,db2inst1,,IBM DB2,DB2 Database,Linux,America, John Doe

• pipeName: overrides the default pipe name for Microsoft SQL Server connections. This credential type should specify ‘Named Pipe’ as the network protocol.
• oracleServiceName: specifies a service name to be used for connecting to an Oracle asset.
• scanGroup: specifies a scan group for this asset. Only scanners belonging to the specified scan group will be used for scanning this asset. This only applies if scan groups have been configured under Set Up | System Settings | Scan Engines.
• assetGroup: Specifies a group for this asset.

host,port,instanceName,assetType,assetVersion,platform,pipeName,oracleServiceName,scanGroup,assetGroup
oracle11gdev,1521,ORCL,Oracle,Oracle11gR2 Database,Microsoft Windows,,oracle11gservicename,Oracle Group,Oracle 11G Asset Group
172.16.32.133,5000,PREPROD,Sybase,Sybase 12.5 Database,Linux,,,Sybase Scan Group, Sybase Asset Group
172.16.32.57,49396,DOCS,Microsoft SQL Server,Microsoft SQL Server 2008 R2,Microsoft Windows,docspipename,,SQL Server, SQLServer Asset Group
172.16.32.79,5000,RHL64SYBASE15,Sybase,Sybase 15.0 Database,Unknown Platform,,,Sybase Scan Group, Sybase Asset Group
172.16.32.87,1521,ORCLWS,Oracle,Oracle11gR2 Database,Solaris,,orclwsservicename,Oracle Group,Oracle 11G Asset Group
172.16.32.97,1433,MSSQLSERVER,Microsoft SQL Server,Microsoft SQL Server 2008,Microsoft Windows,,,SQL Server, SQLServer Asset Group
172.16.33.1,3701,db2inst1,IBM DB2,DB2 Database,Linux,,,IBM DB2, DB2 Asset Group

​

Appendix F: Report Mapping