Create a database list file

To bootstrap the integration, a list of databases along with events is sent to Database Security sensor.

The list of databases is read from a directory of known databases (/etc/mfe.dbs/dbs-list.d). Each file in the directory contains the configuration details of a DB instance. File names are free form but must end with the extension “.conf”. The sensor scans the directory and listens on the specified “activitysocket” for databases with the ‘ACTIVE’ monitor-state.

Note

The external data source constantly tries to connect to the “activity-socket.” The sensor starts listening on the specified socket once the database has been “approved” in the Database Security console.

The database configuration details are encoded in the following JSON format:

                     {
                     msg-type: "db-conf",
                     data-source-version: <string>, //version of providing data source
                     socket-protocol-version: "1.0", //if protocol version is different from 1.0 Trellix Sensor will not listen on the socket. Possibly can be used for upgrade scenarios.
                     db-type: <string>, //type of database reported
                     update-date: <date>,//last date status was updated
                     ip: <string>, //db instance ip
                     host: <string>, //db instance hostname
                     lpar: <string>, //db lpar name (relevant for MF)
                     version: <string>, //db version
                     instance-name: <string>, //db instance name
                     unique-id: <string>, //constant instance unique id (example md5)
                     monitor-state: <string: ACTIVE|STOPPED>,
                     activity-socket: <string> //socket to communicate with Trellix Sensor
                     }
                  

Sample configuration record (DB2/zOS):

                     {msg-type":"db-conf","data-source-version":"1.0.0-b172","socket-protocol-version":"1.0","db- type":"DB2-MF","update-date":1335169871087,"ip":"127.0.0.1","host":"test.test.com","lpar":"test-lpar","version":"9.1.6","instance-name":"test-instance","unique-id":"66064bac07c2b3966a0b65df2ad4c708","monitor-state":"ACTIVE", "activity-socket":"0.0.0.0:2020"}
                  

Sample configuration record (DB2/iSeries):

                     {msg-type":"db-conf","data-source-version":"1.0.0-b172","socket-protocol-version":"1.0","db-type":"AS400","update-date":1335169871087,"ip":"127.0.0.1","host":"qatest1","lpar":"test-lpar","version":"9.1.6","instance-name":"test-instance","unique-id":"66064bac07c2b3966a0b65df2ad4c708","monitor-state":"ACTIVE", "activity-socket":"0.0.0.0:2020"}