ibm / universal-connectors

A collection of Universal connector plug-ins for IBM Guardium Data Protection and IBM Guardium Insights. A universal connector allows Guardium customers to digest data activity events from various data sources and to quickly develop such a plug-in, if required.

Table of contents

• Guardium universal connector
• Product versions
• Supported data sources
• Contributing
• Contact us
• Licensing

Guardium universal connector

The Guardium universal connector enables Guardium Data Protection and Guardium Insights to get data from potentially any data source's native activity logs without using software taps (S-TAPs- the software agent usually used in Guardium). The universal connector includes support for various plug-in packages, requiring minimal configuration. You can easily develop plug-ins for other data sources and install them in Guardium.

Product versions

The process for working with the universal connector differs for Guardium Data Protection, Guardium Insights, and Guardium Insights SaaS. We provide documentation for each, adapted to our latest product version.

See documentation specific to Guardium Data Protection.

See documentation specific to Guardium Insights.

See documentation specific to Guardium Insights SaaS

See general documentation about the universal connector for all versions here

Supported data sources

Guardium can collect events using a variety of input and filter plug-in combinations.

Please refer to available plugins to see the full list.

Contact Us

If you find any problems or want to make suggestions for future features, please create issues and suggestions on GitHub.

Licensing

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

universal-connectors's Issues

MariaDB plug-in always shows "mariadb" as source program

Describe the bug
When using MariaDB plug-in within Guardium, the reports show the source program as "MARIADB", no matter what, instead of defaulting to empty field, when no info exists in the MariaDB audit logs.

To Reproduce
Steps to reproduce the behavior on developer machine:

1. Download the plug-in zip and Install it in Logstash (follow README > setup dev environment, first)
2. Run Logstash with this plugin and the test configuration that resides within the plug-in's folder (see README > Run on local Logstash). This will generate an event you can test. Alternatively, run the Java code and add a unit test.
3. Check the source program field within the POJO of the Logstash dummy output plugin
4. sourceProgram contains "mariadb", instead of being empty.

Expected behavior
Correct source program, or if not available in audit log, empty field, as source program is not a mandatory field within the Guardium Record object.

Environment (please complete the following information):

• Product: Guardium Data Protection
• Version 11.4

Additional context
Looks like a minor fix could solve this by not filling the source program parameter here, instead of putting a constant

No access enrollmentID universal connector guardium

For configuring the universal connector in the guardian. https://github.com/IBM/universal-connectors/tree/main/filter-plugin/logstash-filter-azure-sql-guardium
step 5 requires an enrollment id from azure portal enterprise. where it is later used in step 7 configuring th input information from https://github.com/IBM/universal-connectors/blob/main/filter-plugin/logstash-filter-azure-sql-guardium/azureSQLJDBC.conf line 23 No one in my group including my administrator/owner for the azure account has an enrollment id for the account. as it is not an enterprise azure account. is it possible to include instructions for subscription id or tenant id?

Oracle Unified Audit Plugin

Is your feature request related to a problem? Please describe.
Supporting monitoring of Oracle databases using Oracle Unified Audit.

Describe the solution you'd like
A plugin that reads OUA data from an Oracle DB.

Describe alternatives you've considered

Additional context