ibm / universal-connectors Goto Github PK

Describe the bug
When using MariaDB plug-in within Guardium, the reports show the source program as "MARIADB", no matter what, instead of defaulting to empty field, when no info exists in the MariaDB audit logs.

To Reproduce
Steps to reproduce the behavior on developer machine:

1. Download the plug-in zip and Install it in Logstash (follow README > setup dev environment, first)
2. Run Logstash with this plugin and the test configuration that resides within the plug-in's folder (see README > Run on local Logstash). This will generate an event you can test. Alternatively, run the Java code and add a unit test.
3. Check the source program field within the POJO of the Logstash dummy output plugin
4. sourceProgram contains "mariadb", instead of being empty.

Expected behavior
Correct source program, or if not available in audit log, empty field, as source program is not a mandatory field within the Guardium Record object.

Environment (please complete the following information):

• Product: Guardium Data Protection
• Version 11.4

Additional context
Looks like a minor fix could solve this by not filling the source program parameter here, instead of putting a constant

Is your feature request related to a problem? Please describe.
Supporting monitoring of Oracle databases using Oracle Unified Audit.

Describe the solution you'd like
A plugin that reads OUA data from an Oracle DB.

Describe alternatives you've considered

Additional context

For configuring the universal connector in the guardian. https://github.com/IBM/universal-connectors/tree/main/filter-plugin/logstash-filter-azure-sql-guardium
step 5 requires an enrollment id from azure portal enterprise. where it is later used in step 7 configuring th input information from https://github.com/IBM/universal-connectors/blob/main/filter-plugin/logstash-filter-azure-sql-guardium/azureSQLJDBC.conf line 23 No one in my group including my administrator/owner for the azure account has an enrollment id for the account. as it is not an enterprise azure account. is it possible to include instructions for subscription id or tenant id?