Fortidb 5.1.13 Admin Guide 00-400-000000-20181031 TABLE of CONTENTS
Total Page:16
File Type:pdf, Size:1020Kb
FortiDB - Admin Guide Version 5.1.13 FORTINET DOCUMENT LIBRARY https://docs.fortinet.com FORTINET VIDEO GUIDE https://video.fortinet.com FORTINET BLOG https://blog.fortinet.com CUSTOMER SERVICE & SUPPORT https://support.fortinet.com FORTINET TRAINING & CERTIFICATION PROGRAM https://www.fortinet.com/support-and-training/training.html NSE INSTITUTE https://training.fortinet.com FORTIGUARD CENTER https://fortiguard.com/ END USER LICENSE AGREEMENT https://www.fortinet.com/doc/legal/EULA.pdf FEEDBACK Email: [email protected] October 31, 2018 FortiDB 5.1.13 Admin Guide 00-400-000000-20181031 TABLE OF CONTENTS What’s new 11 Introduction 15 FortiDB tutorials 16 Tutorial: Generating a vulnerability assessment (VA) report 16 Tutorial: Monitoring a database table using the TCP/IP sniffer 19 Tutorial: Monitoring a database table using the native auditing feature 23 Tutorial: Monitoring changes to metadata 26 Tutorial: Generating PCI, SOX, and HIPAA compliance reports 28 Installation (software-only) 31 System requirements 31 Preparing to install 32 Configuring the FortiDB repository database 33 Configuring a PostgreSQL repository 33 Configuring an Oracle repository 34 Configuring an Microsoft SQL Server repository 35 UNIX/Linux installation 36 Windows installation 37 Confirming the installation 37 Starting or stopping FortiDB 38 Installing a new license 38 Managing disk space 39 Useful directories, files, and folders 39 Log files for troubleshooting 40 General logs 40 Tomcat logs 41 Upgrading FortiDB 41 How to set up your FortiDB 42 Registering your FortiDB 42 Planning the network topology for database activity monitoring (DAM) 42 Connecting to the web UI and CLI 43 Updating the firmware 43 Upgrading the firmware 44 Installing FortiDB firmware 45 Changing the "admin" account password 46 Setting the system time 47 Configuring the network settings 49 Configuring network settings using the web UI 49 Configuring network settings using the CLI 51 Backups 52 Administrators 53 Configuring permissions 54 FortiDB 5.1.13 Admin Guide 3 Fortinet Inc. Privileges by license type (software-only FortiDB) 55 Viewing and exporting an administrator report 56 FortiMonitor administrator 58 Advanced/optional system settings 59 System information and settings 59 Changing the FortiDB host name 60 Global configuration 60 Assessment properties 61 Notification properties 63 Reporting properties 65 User Profile/Security properties 65 Target properties 66 LDAP Server properties 67 Monitor properties 68 Connecting to target databases 69 Pre-configuration for monitoring target databases 69 Network requirements for monitoring using the TCP/IP sniffer 69 Oracle target database pre-configuration 70 MySQL target database pre-configuration 74 Sybase target database pre-configurations 75 DB2 target database pre-configuration 80 Microsoft SQL Server target database pre-configuration 83 Privileges required by the database user 83 Privileges for VA assessments, privilege summaries, and penetration tests 83 Privileges for monitoring data 88 Privileges for monitoring privileges 89 Privileges for monitoring metadata 90 Managing targets 91 Columns 91 Buttons and fields 91 Searching or filtering the target list 92 Adding (or modifying) a target connection 93 Configuring DB2 options 94 Configuring SSH connections to Oracle and DB2 databases 94 SSH environment requirements (software-only version) 95 Enabling operating system vulnerability assessment (OSVA) for Solaris and AIX 96 Exporting target information 97 Importing targets 97 Managing target groups 99 Pre-defined target groups 99 Adding or modifying a target group 99 Auto-discovery 100 How to discover DB2 databases 100 How to discover Microsoft SQL Server 100 Running auto-discovery 101 Adding targets from auto-discovery 101 FortiDB 5.1.13 Admin Guide 4 Fortinet Inc. Vulnerability assessment (VA) policies 103 Types of VA policies 103 Updates to VA policies 103 Exporting and importing VA policies 104 VA policy version 104 VA policy groups 104 VA policy states 105 Keywords and user keywords for VA policies 105 Managing VA pre-defined policies 106 Importing pre-defined policies (appliance) 107 Importing pre-defined policies (software-only FortiDB) 108 OS-Level pre-defined policies 108 VA user-defined policies 114 Adding user-defined policies 115 Deleting user-defined policies 116 Exporting user-defined policies 117 Importing user-defined policies 117 VA policy groups 118 Adding VA policy groups 118 Modifying VA policy groups 119 Deleting VA policy groups 120 Penetration tests 120 Connection options for penetration tests 121 Files used for penetration tests 121 Configuring and running penetration test assessments 122 Data discovery policies and policy groups 124 Managing data discovery policies 124 Data discovery policy groups 125 Database Activity Monitoring (DAM) policies 126 Types of DAM policies 126 Managing DAM policies 127 Configuring policy information for a policy 128 Automatically generating alert policies 129 Data policies 130 Configuring a table policy 130 Configuring a table and column policy 135 Configuring a session policy 136 Configuring a user policy 139 Configuring a database policy 144 Configuring a database query policy 144 Privilege policies 146 Oracle privilege policies 147 Microsoft SQL Server privilege policies 148 Sybase privilege policies 148 DB2 privilege policies 149 MySQL privilege policies 150 Metadata policies 150 FortiDB 5.1.13 Admin Guide 5 Fortinet Inc. Oracle metadata policies 151 Microsoft SQL Server metadata policies 152 Sybase metadata policies 152 DB2 metadata policies 153 MySQL metadata policies 153 PCI, SOX, and HIPAA alert policies 154 Configuring PCI, SOX and HIPAA policies 154 Selecting which tables tracks for PCI, SOX and HIPAA reports (Object Audit Options) 155 Select users to audit for PCI and SOX reports (User Audit Options) 156 Alert and audit policy groups 156 Creating or modifying an alert or audit policy group 157 Adding policy groups to target database monitoring 158 Deleting a policy group 158 Vulnerability assessment 159 Adding or modifying assessments 159 Running assessments 160 Configuring assessment notifications 161 Selecting the type of report an assessment generates 164 Reviewing, deleting, and aborting assessment results 165 View VA global summary information 166 Assessment history 167 Assessments History tab 167 Scheduled Reports tab 167 Import or export assessment history 167 Viewing and exporting a privilege summary 168 DB-Type Distinctions 169 Sensitive data discovery 170 Manage sensitive data discovery 170 Running sensitive data discovery 171 Viewing sensitive data discovery reports 171 Viewing VA and sensitive data discovery event logs 171 Database activity monitoring (DAM) 173 Managing target monitoring 173 Target monitoring configuration tabs and options 174 Configuring target database monitoring 176 Configuring monitoring using the TCP/IP sniffer (all database types) 177 Configuring Microsoft SQL Server monitoring 178 Configuring DB2 monitoring 179 Configuring Sybase monitoring 179 Configuring MySQL monitoring 180 Configuring Oracle monitoring 181 Adding alert and audit policies to monitoring 182 Adding policy groups to target monitoring 183 Sending alert notifications 183 FortiDB event to ArcSight data field mapping 185 Blocking invalid access while monitoring 185 Excluding policies from the Alert Policy settings (whitelist) 186 FortiDB 5.1.13 Admin Guide 6 Fortinet Inc. Displaying the history of issued audit commands 188 Oracle audit management 189 Microsoft SQL Server audit management 190 DB2 audit management 190 Viewing alerts 191 Changing the status of and annotating alerts 193 Exporting the alert list as a report 193 Filtering and searching alerts 193 Alert details 194 Alert group 195 Add, edit, or delete an alert group 195 Pre-defined alert groups 195 Data filter for an alert group 196 Alerts summary 196 Alerts analysis 197 Viewing audit records (activity auditing results) 198 Filtering and searching the audit record list 199 Viewing audit record details 199 Audit group 200 Add, edit, or delete an audit group 200 Pre-defined audit groups 200 Data filter for an audit group 201 Activity profiling 201 Viewing status and summary information for activity profiling 201 Viewing and exporting activity profiling results 202 SOX audit 204 Logs 205 Local monitoring log 205 Local audit trail 205 Viewing and managing the audit trail records 206 Examples of audit trail records 207 Reports 208 Vulnerability assessment (VA) reports 208 DAM reports 208 Report files that saves to disk 209 Other reports you can export 209 Pre-defined VA reports 209 Assessment reports 210 Policy reports 211 Sensitive data discovery reports 211 User-defined VA reports 211 Managing user-defined reports 212 Viewing scheduled VA reports 213 Pre-defined DAM reports 213 User-defined DAM reports 214 Report management 214 Filtering report data 215 FortiDB 5.1.13 Admin Guide 7 Fortinet Inc. Configuring data displays 216 Schedule and notification 216 PCI, SOX, and HIPAA reports 218 General steps for generating PCI, SOX, and HIPAA reports 220 Report: Abnormal Termination of Database Activity 221 Report: Abnormal or Unauthorized Changes to Data 221 Report: Abnormal Use of Service Accounts 222 Report: End of Period Adjustments 223 Report: History of Privilege Changes 224 Report: Verification of Audit Settings 225 Activity Profiling Reports 226 Archiving audit data 228 Archiving example 228 Archiving strategy 229 Archiving data 229 Using the command line interface (CLI) 231 Connecting to the CLI 231