Fortinet FortiDB manual

www.fortinet.com FortiDB Ve r s i o n 3 . 2 Utilities User Guide[...]

FortiDB Utilities User Guide V ersion 3.2 December 19, 2008 15-32000-81 369-20081219 © Copyright 2008 Fortine t, Inc. All rights reserved. No part of this publication including text, examples, diagrams or illustrations may be re produced, transmitted, or translate d in any form or by any means, electronic, mechanical, manual , optical or otherwise[...]

T able of Contents FortiDB V ersion 3.2 Utilities User Gui de 15-32000-81369-2008 1219 1 Table of Contents FortiDB MA Utilities .... .................................................................................... ......... 3 Auto Discovery ........................................... ..................................................... .......[...]

FortiDB V ersion 3.2 Util ities User Guide 2 15-32000-81369-200812 19 T able of Contents Report Body Columns .................. ................ .................... ................ ................ ........... 44 Abnormal or Unauthoriz ed Changes to Data Report (AUC) ..... ................... ................... .. 45 COBIT Objectives and Setup R[...]

FortiDB MA Utilities FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 3 FortiDB MA Utilities FortiDB MA provides several utilitie s to help you use other modules: • Auto Discovery to ease the burden of manually setting up database connections • Connection Summary to show which database connections are Open or are Open and Run[...]

FortiDB V ersi on 3.2 Utilities User Guide 4 15-32000-81369-200812 19 Auto Discovery Auto Discovery FortiDB MA provides the ability to sear ch for , and establish connections to, databases on your n etwork. Rather than manually enterin g all of the connection information, you can have FortiDB MA a utomatically disc over it for y ou. Selecting Add r[...]

Auto Discovery FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 5 Selecting Non-Standar d Ports for Auto-Disco very 5 Click the Begin Discovery button. Results from Auto-Discove ry[...]

FortiDB V ersi on 3.2 Utilities User Guide 6 15-32000-81369-200812 19 DB2 Auto Discovery Discovered Database Info rmation Populating Connection Form The proces s will automatically return: • Database T ype and version • IP address (with port if applicable) • Database nam e/instance Once the Auto Discovery list is return ed, you can create, by[...]

Auto Discovery MS-SQL FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 7 • Destined for port 1 434 • Originating from the port whos e nu mber is specified in the dss.udpport property in dssConfig.prop erties . Note: FortiDB MA sends a packet to port 1434, which MSSQL uses in order to return info rmation ab out itself such as [...]

FortiDB V ersi on 3.2 Utilities User Guide 8 15-32000-81369-200812 19 MS-SQL Connection Summary Connection Summary The Connection Summary utility allows you to see, by FortiDB MA module and in one place, a dashboard view of a ll of your database connections. Connection Summary Button Connection Summary Output[...]

Rule Chaining MS-SQL FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 9 Rule Chaining The Rule Chaining module allo ws you to associate rules so that one, the sour ce 1 rule, can influence the execution of another , the target 2 rule. Both ru les are established with the same target dat abase. Rule Chaining Setting Screen FortiDB[...]

FortiDB V ersi on 3.2 Utilities User Guide 10 15-32000-81369-200812 19 MS-SQL Rule Chaining Configuring a Rule Chain for a Specific Targ et Database Connection Y ou can perform th e following: • Choose the t arget database (th e database you want to run the rules a gainst) • Add item (new chain) • Delete item • View/Modify item (m ake chang[...]

Rule Chaining Chaining with Pa rameterized User-Defined Ru les FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 11 After the dat abase has been specified and you have clicked on [Add Item] , you will be presented with the Create Rule Chaining Settings page. Here, you need to: • Name the Rule Chain • Select the policy you want[...]

FortiDB V ersi on 3.2 Utilities User Guide 12 15-32000-81369-200812 19 Chaining with Parameterized User-Defined Rules Rule Chaining General PUDR Steps The general step for creating a chain that uses a PUDR are: 1 In UBM, define an Object, User , or Sessio n policy that will be your Source Rule. 2 In UBM, define a PUDR that will be your T arget Rule[...]

Rule Chaining Chaining with Pa rameterized User-Defined Ru les FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 13 PUDR Eligible Rules Disabled Parameter Checkboxes If the chosen target rule cannot acce pt parameters , they will be grayed out. Validating the PU DR before Saving If one or more variables selected do not ap pear in [...]

FortiDB V ersi on 3.2 Utilities User Guide 14 15-32000-81369-200812 19 Chaining with Parameterized User-Defined Rules Rule Chaining Chaining the UBM Poli cy and PUDR Together Associating a Source Rule That Can Pas s parameters with a PUDR Example of Chaining to a PL/SQL-based PUDR In this Oracle PL/SQL kill-session example, we: 1 Create a DB user ,[...]

Rule Chaining Chaining with Pa rameterized User-Defined Ru les FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 15 Policy Settings for Suspicious Login Time 2 Create a UBM Session Policy , our Source rule, in order to monitor BAD_ GUY and generate an alert to trigge r our T arget rule, a PUDR. We will pass the Session ID from the[...]

FortiDB V ersi on 3.2 Utilities User Guide 16 15-32000-81369-200812 19 Chaining with Parameterized User-Defined Rules Rule Chaining 4 Login as BAD_GUY at an "abnormal" tim e (Here, that is anytime except between 3 and 4 AM ) DECLARE v_str VARCHAR2(80) := 'ALTER SYSTEM KILL SESSION '||chr(39); v_statementVARCHAR2(80); sesid NUMBE[...]

Rule Chaining Chaining with Pa rameterized User-Defined Ru les FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 17 Chained-Rule Alerts: (UBM Sess ion Policy and PUDR) 5 Get an alert when the (the Session Policy) Source rule is violated. 6 Get another alert when the chained PUDR executes and, in th is case kills the session of BAD[...]

FortiDB V ersi on 3.2 Utilities User Guide 18 15-32000-81369-200812 19 Chaining with Parameterized User-Defined Rules Rule Chaining SELECT username, osuser, terminal FROM v$ session WHERE osuser = '$osusername' Multiple Source-Rule -Violation Behavior When using the Rule Chai ning feature wi th PUDRs, you might expect a t arget- policy al[...]

Rule Chaining Chaining with Pa rameterized User-Defined Ru les FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 19 In this case, the alert will be generated on ly for first object in the SELECT list; namely: vje.test.[...]

FortiDB V ersi on 3.2 Utilities User Guide 20 15-32000-81369-200812 19 Alert Report Manager Report Manager Report Manager In order to access the F o rtiDB MA Report Mana ger module, click on the Report Manager link on the left-side navigator on th e main FortiDB MA screen. The FortiDB MA Report Manager module of fers: • Alert Report s to summariz[...]

Report Manager Alert Report Manager FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 21 Setting a Timer-Based Schedule Deleting a Previously Set Timer Schedule Y ou can delete a previou s ly set T imer schedule by clicking on the Delete Timer button. Deleting a Timer Schedule Setting a Calendar-based Schedule For a Calendar-base [...]

FortiDB V ersi on 3.2 Utilities User Guide 22 15-32000-81369-200812 19 Alert Report Manager Report Manager Setting a Calendar-Based Sched u le Setting a Combined Schedule Y ou can also specify a comb ined schedul e which consists of both a timer- and a calendar-based schedule. Setting a Randomized Interval In order to make it dif ficult to predict [...]

Report Manager Alert Report Manager FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 23 Reporting by Time The Alert Report Manag er module generat es rep orts based on alert s generated by the various other modules. ARM: Reporting by Time ARM: Reporting by Time: Calendar Pop- up In order to reduce the number of alert s on your re[...]

FortiDB V ersi on 3.2 Utilities User Guide 24 15-32000-81369-200812 19 Alert Report Manager Report Manager New Reports Menu In the New Reports page, fill in the nece ssary dat a information that you want to show in the report. New Report Setting Scre en (top)[...]

Report Manager Alert Report Manager FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 25 New Report Setting Screen (botto m) Y ou may specify these p arameters for your new report: • Report Name (name you choose; this is required) • ID (Alarm ID(s); each ala rm 1 has a unique ID) • Alert S tatus (handled, acknowledged, or no[...]

FortiDB V ersi on 3.2 Utilities User Guide 26 15-32000-81369-200812 19 Alert Report Manager Report Manager • Alert Generated T ime (day or time interval that the alert s occurred) • Report Generate Schedule: • One T ime Only (snapshot of curren t alerts typically used for ar chiving purposes) • Schedule (run according to the sc hedule speci[...]

Report Manager Alert Report Manager FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 27 Activating ARM In order to begin running sch edu led report s, you should use the Report s->St atus menu. Check the Ye s checkbox and click the Save button. Status Me nu Status Dialog Running and Analyzing Reports Y ou may e lect to see all[...]

FortiDB V ersi on 3.2 Utilities User Guide 28 15-32000-81369-200812 19 Alert Report Manager Report Manager Current Report Configurat ion In the row corresponding to your rep o rt of interest, you can choose which report version to preview via the Repor t History dropdown and you can specify report- specific email recipient s by clicking on the Emai[...]

Report Manager Alert Report Manager FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 29 Report Detailed Action By clicking the [Det ailed] Action] button, you can get to a screen provides detaile d information for each alert. The Detailed Report gives specific information about each alert. The Id is a hyperlink that you can click[...]

FortiDB V ersi on 3.2 Utilities User Guide 30 15-32000-81369-200812 19 Custom Reports Report Manager Custom Reports Custom Reports Using the open -source Jasp erReports library 1 , the Quartz scheduling librar 2 y , the chart generatin g Kavachart libra 3 ry , and the open-s ource iReport design too 4 l, you can produce yo ur own custom reports to [...]

Report Manager Custom Reports FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 31 Y ou can select: • T ime only schedule • Daily schedule • Weekly sch edule • Monthly schedule Time-only Sched ule Settings Daily Schedule Settings Y ou can have your r eports run on a daily basis at a certain time.[...]

FortiDB V ersi on 3.2 Utilities User Guide 32 15-32000-81369-200812 19 Custom Reports Report Manager Weekly Schedule Settings Y ou can have your repo rts run on a weekly basis on day(s). Monthly Schedule Settings Y ou can have your repo rts run on a monthly basis. Customer and Company Information Y ou can have a custom logo and address (or other de[...]

Report Manager Custom Reports FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 33 Company Information Dialog Report and Template Ge neration and Management Custom Reports Main Page From the Custom Report s main page, you can: • Add a repo rt • Modify a repo rt • Delete a re port • Modify a repor t's template Note: Th[...]

FortiDB V ersi on 3.2 Utilities User Guide 34 15-32000-81369-200812 19 Custom Reports Report Manager • Generate a Report Adding Reports T o ad d a new report, take the following steps: 1 Click on the Custom Report s Manager link on the left -side navigator or select from the top ba r menu, Reports -> Custom Report s Manager . 2 Click the Add R[...]

Report Manager Custom Reports FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 35 Modifying a Report Deleting Reports 1 Select the report you want to delete. 2 Click the Delete Report button. The confirmation window displays. 3 Click the OK. Deleting a Report[...]

FortiDB V ersi on 3.2 Utilities User Guide 36 15-32000-81369-200812 19 Custom Reports Report Manager Modifying Report Templates Y ou can import yo ur template ( *.jrxml) file and save it in the inte rnal reports databa se. Y ou can also e xport the template from the interna l report s database and store it as a ( *.jrxml) ) file on local file syste[...]

Report Manager Custom Reports FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 37 Templates Manage r: Modifying a Template Page Generating Reports T o generate a report, take the fo llowing steps: 1 From the Custom Reports Ma nager page, click the Generate Report button. 2 In the T emplate parameters page, select the template you[...]

FortiDB V ersi on 3.2 Utilities User Guide 38 15-32000-81369-200812 19 Custom Reports Report Manager Generated HTML Re port Example 1 Open Control Panel, and open Interne t Options. 2 In the Internet Propertie s window , click the Security t a b. 3 Select T r usted sites. 4 Click the Sites button. The T rusted sites dialog displays. 5 Enter URL of [...]

Report Manager Custom Reports FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 39 Report History Report History Report History allows you to: • View a list of previou s ly generated report s • Regenerate a particular report • Delete re ports or your entire report history[...]

FortiDB V ersi on 3.2 Utilities User Guide 40 15-32000-81369-200812 19 Licensing and Administrati on Report Manager Licensing and Administration User Administration for Custom Re ports and SOX Reports In order to enable a user to utilize the Custom Repo rts feature, select the Cu stom Report s radio button on the User Administ ration screen. The Fo[...]

Report Manager Licensing and Administrati on FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 41 Limitations The Custom Report s feature has this limitation: • The maximum number of bar-cha rt columns for each report is 15. If the data being presented requires more than 15 columns, no bar chart is generated for that data. • Y[...]

FortiDB V ersi on 3.2 Utilities User Guide 42 15-32000-81369-200812 19 SOX Compliance Reports Report Manager Description of Shipped Sample Report SOX Compliance Reports SOX Reports within Custom Reports M anager Page One type of Custom Reports is the Sarba nes-Oxley (SOX) Compliance report s. Alert Statstics Report Contains det ailed information ab[...]

Report Manager SOX Compliance Reports FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 43 Reports and Acronyms This release in cludes these S OX reports: Common Report Header Fields Here are the common report-h eader fields for the current SOX report s. General Setup Instructions See the FortiDB MA Administrati on Guide Report Na[...]

FortiDB V ersi on 3.2 Utilities User Guide 44 15-32000-81369-200812 19 History of Privilege Changes Repo rt (HPC) SOX Report Specifics SOX Report Specifics This section lists the COBIT objectives and description s, the FortiDB M A module-setup re quirements, and individual-column det ail for each report in this release. History of Privilege Changes[...]

SOX Report Specifics Abnormal or Unaut horized C hanges to Data Report (AUC) FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 45 Abnormal or Unauthorized Ch anges to Data Report (AUC) AUC Report Sample COBIT Objectives and Setup Requirements Report Body Columns The following columns are disp layed in the report body: Objectiv e N[...]

FortiDB V ersi on 3.2 Utilities User Guide 46 15-32000-81369-200812 19 Abnormal Use of Service Accounts Re port (AUS) SOX Report Specifics Abnormal Use of Service Accounts Report (AUS) AUS Report Sample COBIT Objectives and Setup Requirements Report Body Columns The following columns are displayed in the repor t body: Objectiv e Number(s) Objective[...]

SOX Report Specifics Abnormal T erminatio n of Data base Activity Report (A TD) FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 47 Abnormal Termination of Database Activity Report (ATD) ATD Report Sample COBIT Objectives and Setup Requirements Report Body Columns The following columns are displa yed in the report body: Objectiv [...]

FortiDB V ersi on 3.2 Utilities User Guide 48 15-32000-81369-200812 19 End of Period Adjustments Repor t (EP A) SOX Report Specifics End of Period Adjustments Report (EPA) EPA Report Sample COBIT Objectives and Setup Requirements Settings Dialog for the EPA Report Report Body Columns The following colu mns are disp layed in the report body: Error C[...]

SOX Report Specifics End of Period Adjustments Report (EP A) FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 49 Determining Your Reporting Period Reporting Period is the time fr ame surrounding a user-defined period-en d day (PED). The reporting pe riod extends a user-defined number of days before (UDDB) and a user-defined numbe[...]

FortiDB V ersi on 3.2 Utilities User Guide 50 15-32000-81369-200812 19 V erification of Audit Settings Report (V AS) SOX Report Specifics The resulting re port period is July 24 until August 16, inclusive. Verification of Audit Settings Report (VAS) VAS Report Sample COBIT Objectives and Setup Requirements Report Body Columns The following colu mns[...]

SOX Report Specifics V erification o f Audit Settings Repo rt (V AS) FortiDB V ersio n 3.2 Utilities User Guide 15-32000-81369-2008 1219 51 Licensing and Administration For SOX Report s licensing and administration info rmation, please refer to the FortiDB MA Administra tion Guide Limitations Report Size The reporting functionality has been teste d[...]

FortiDB V ersi on 3.2 Utilities User Guide 52 15-32000-81369-200812 19 V erification of Audit Settings Report (V AS) SOX Report Specifics[...]

Index FortiDB V ersion 3.2 Utilities User Guide 15-32000-81369-2008 1219 53 Index A activate 20 Alert Behavior 17 Alert Report Manager 2 0 ARM 20 activating 27 Auto Discovery DB2 6 MS-SQL 6 Auto Discovery 4 C Calendar-based Schedule 21 compliance 20 Connection Summary 8 Custom Report Properties 40 Custom Reports 30 D DB2 6 dssConfig.properties 7, 4[...]

FortiDB V ersion 3.2 Util ities User Guide 54 15-32000-81369-200812 19 Index[...]