Does anyone know how to translate the ALLOWED_ROLE.APP_OBJECT_ID  value from a Guardium user activity report into an actual value?

As an example, I have a report with the main entity  of "Guardium User Activity Audit" which returns all activities by my users.  As I test, I modified the permissions on one of my audit processes and ran the report, which returns the following(formatted for posting)

User Name={username removed}
Timestamp=2019-05-23 15:54:15
Modified Entity=ALLOWED_ROLE
Entity Key Used=ALLOWED_ROLE.ALLOWED_ROLE_ID
Key Value=37247
All Values=
	ALLOWED_ROLE.APP_OBJECT_ID = 20033
	ALLOWED_ROLE.APP_OBJECT_TYPE_ID = 5
	ALLOWED_ROLE.ROLE_ID = 20007
	ALLOWED_ROLE.TIMESTAMP = Thu May 23 15:54:14 UTC 2019

Object Description=Policy
Global Id=5074693666869134433
Host Name={hostname removed}
Activity Type Description=INSERT​

Which shows I messed with a role, but the "All Values" section is a bit cryptic.

I can run a report against the "Guardium Applications" entity to get the APP_OBJECT_TYPE_ID(5 = Audit Process Builder) and I can run another report against the "Guardium Roles" entity to the ROLE_ID(20007 = The role I added).

However, I can't find any entity that has the APP_OBJECT_ID value that will tell me the name of what was edited.  I'm assuming that's the specific audit process that I updated, but I can't find any way to translate 20033 in an actual audit process name.

Does anyone know how that data can be extracted?


------------------------------
Nick Sandmann
------------------------------

Hi Nick, I have asked the development team how to decipher APP_OBJECT_ID value. I'll update.

------------------------------
TAL DANIEL
------------------------------

I've asked the development team how to decipher APP_OBJECT_ID. I'll update.

------------------------------
TAL DANIEL
------------------------------

Nick, it seems that  ALLOWED_ROLE.APP_OBJECT_ID works in conjunction with APP_OBJECT_TYPE_ID, to create a tuple of an object o of type t. For example:

ALLOWED_ROLE.APP_OBJECT_TYPE_ID = 5 (type is Policy)
ALLOWED_ROLE.APP_OBJECT_ID = 20033 (Policy ID)

Note that "Object description=Policy" on your report (it's not stemming from Guardium_Applications entity, but from APP Object type, which I'm not sure you have access to), which tries to hint on the type of object that was changed. The missing link though, is finding the exact name of the object o of type t (Policy name, in your example). Let me know if you succeeded, and how, or if not possible. 

------------------------------
Tal Daniel
IBM Security Guardium
------------------------------

That makes sense, and I don't see any way to get that information that doesn't involve hacking the database behind Guardium.

Is this a bug or is this something that would need to be added in a future release?

------------------------------
Nick Sandmann
------------------------------

Original Message:
Sent: Tue May 28, 2019 10:14 AM
From: TAL DANIEL
Subject: Auditing Guardium User Activity

Nick, it seems that  ALLOWED_ROLE.APP_OBJECT_ID works in conjunction with APP_OBJECT_TYPE_ID, to create a tuple of an object o of type t. For example:

ALLOWED_ROLE.APP_OBJECT_TYPE_ID = 5 (type is Policy)
ALLOWED_ROLE.APP_OBJECT_ID = 20033 (Policy ID)

Note that "Object description=Policy" on your report (it's not stemming from Guardium_Applications entity, but from APP Object type, which I'm not sure you have access to), which tries to hint on the type of object that was changed. The missing link though, is finding the exact name of the object o of type t (Policy name, in your example). Let me know if you succeeded, and how, or if not possible. 

------------------------------
Tal Daniel
IBM Security Guardium
------------------------------