Groups

Creating a New Group

One useful group might be a list of trusted database users. This group can include applications that use the database. You can use this list to write a policy that ignores sessions that are created by these users, which reduces the processing load on the network and the Guardium server. Lets create a new group within the Guardium Data Protection.

1. To open the Create new group window, click New

2. In the General tab, complete the following fields:

– Description: -Custom Trusted Users

– Application type: Public

– Group type: USERS

– Category and Classification: leave blank

– Hierarchical: not selected

It is a good practice to identify the groups that you create with a prefix to distinguish user-added groups from the built-in groups. This example uses -Custom. The “-” shows that it is a user-created group. If you sort the groups by name, alphabetically ascending, the custom group is near the beginning of the list in Group Builder.

3. To add the new group, click Save and then close the confirmation message.

The new group is created but it contains no members.

4. To add members to the group, click the Members tab.

5. To examine the options, click the Import menu.

When you add new members, the options include:

– From CSV: You can import group members from a simple file. The file can be a single column with a header, or multiple columns with a header for Tuple groups.

– From group: This option adds members from another group.

– From external datasource: This option adds members from an external database table.

– From query: This option adds members based on a Guardium query.

– From LDAP

In this section of the lab, we add users from another group.

6. From the Import menu, select From group.

7. From the Group menu, select Lab Trusted Users.

8. Click OK

Verify that KESHA and OMAR are added to the new group.

9. Scroll down and click Save.

10. To close the confirmation message, click OK, then click Close.

You see the new group in the Group Builder window.

If you do not see the group, click the Name header twice to sort by name, ascending. The “-” proceeding the group name places it at the top of the list.

Use a query to populate a group

In this part of the lab, you want to create a group of users who have a high level of privilege on databases that contain sensitive data. You might want to monitor actions by these users more closely to ensure that these privileges are not abused.

For this task use the web browser tab that connects to the collector (C200).

1. In this task, you create a group and use a query to populate

Create a group with the following characteristics:

– Description: -Custom Privileged Users

– Application type: Public

– Group type: USERS

– Category and Classification: leave blank

– Hierarchical: not selected

2. On the Members tab, from the Import menu, select From query.

A new tab, Import by query, opens.

3. From the Query menu, select Detailed Sessions List.

Notice more fields are added to the Import by query tab.

4. In the Enter Period From field, click the Calendar icon.

5. Set the values in the calendar window to 1 January 2022 and the Remote Date Source to C200.example.com.

6. Leave all the other fields at their default settings and click Save.

7. To close the confirmation message, click OK.

You set up the query, but you did not run it yet, so NO members are added to the group.

8. On the left side of the window, click the Schedule tab

9. You can set up a schedule to run the query periodically; however, for this exercise, you run the query once. Scroll to the bottom of the window and click Run Once Now.

10. To close the informational message, click OK.

11. Click the Members tab.

You see that the import was successful.

12. Save and Close the group.

Your new group is added to the Group Builder window.

You might have to click Refresh to show that the group has one member.

View Groups

In this part of the lab, we view the details of groups we created.

Return to the web browser tab that connects to the central manager (MA170) for the rest of the exercises in this unit.

1. To view an existing group, search for and select the Sensitive Objects group.

You can narrow the list of groups by typing the name into the filter field.

You see that the Sensitive Objects group has five members and is used in one or more policies, and in queries.

2. From the Actions pull-down menu, select View DetailsZ

The Sensitive Objects group is associated with several security policies. There is a link to Go to policy builder.

3. Select the Queries tab.

The Sensitive Objects group is associated with six queries and six reports.

4. Close the Sensitive Objects window.

5. To open the Edit group window, click Edit and then click the Members tab.

Some of these group members contain regular expression wildcards (%).

6. Close the group

In this lab, we learned how to use the following functionality from Guardium Data Protection:

• Use Group Builder
• Create a new group
• Use a query to populate a group

Continue onward to Lab 203