Configure an action to be taken per DBMS when the conditions of a specific vPatch rule are met.
Alerts are enabled per rule; You can define only how the alert is handled for the selected DBMS.
Note
Actions that are not enabled in the system properties are not available for selection.
On the Rules page, click the vPatch Rules tab.
In the rules list, click the Properties icon
.png)
in the required row.The properties of the selected vPatch rule are displayed.
In the DBMS and Groups area, click Change Actions in the row for the DBMS for which you want to define a specific action.
The vPatch Rule Action Per DBMS page is displayed.
To send an alert, select Send Alert, then select the relevant actions:
Trellix Database Security Console — Generates an alert on the alert screen, according to the selected alert priority, such as, LOW, MEDIUM, or HIGH.
SNMP Trap — Sends an alert as an SNMP trap when the rule is matched.
To Archive — Sends the alert only to the archive (without displaying it in the console or any other location). This option is suitable for auditing information that does not require monitoring on a day-to-day basis.
Syslog — Sends an alert to the Syslog when the rule is matched.
Windows event log — Sends an alert to the Windows event log when the rule is matched.
Log to file — Sends the alert to a log file.
Send alert to email — Sends the alert to the specified email addresses.
To terminate a session if the rule is matched, select Terminate user session.
Note
This option should be used with caution because terminating sessions can disrupt legitimate business transactions. Depending on environmental variables (such as command type and table size), session termination might not stop the current SQL command. Stronger termination capability is provided for DCL and DDL commands that use a before trigger (see DDL triggers).
If you select Terminate user session, the Quarantine user for option is displayed. To quarantine a user, select Quarantine, then enter the number of minutes the user is prevented from reconnecting. For the purposes of quarantine, "user" represents the database user, OS user, host name, IP address, or a combination of these parameters. The user definition for quarantine purposes is defined in System → Quarantine → Settings area.
To run an action script if the rule is matched, set the script to run on the host DBMS. You can use all parameters that Database Security monitors within the script, by using $ as a prefix. For example, if you want to use the user parameter in a script, enter
$user.For example,
revoke dba from $useras part of a script revokes the DBA permissions of the database user who executed the SQL command.Note
This option is intended for advanced users only.
(Optional) Configure limitations on the frequency of alerts as follows:
From the Limit alerts per second drop-down list, select the maximum number of alerts to generate per second.
From the Limit alerts per session drop-down list, select the maximum number of alerts to generate per session or select Unlimited.
Note
The session is uniquely identified by the Session ID and Serial fields in Oracle, and by the Serial ID and Logon time in MSSQL.
Select Apply action when rule triggers for which the selected action in the rule is not executed unless the alert happens the specified number of time in the specified period.
Select Automatically resolve to automatically resolve an alert when triggered.
To prevent the triggering of alerts by signed scripts, select the Ignore Signed Scripts checkbox.
(Optional) To prevent the display of sensitive data in alerts, select Mask Sensitive Data and enter a regular expression in the Regular Expressions text box using standard regular expression syntax.
Note
For more information about standard regular syntax, see http://java.sun.com/javase/6/docs/api/java/util/regex/Pattern.html.
Click Save.