IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  External S-TAP deploy

    Posted 01/31/25 08:42 AM

    Dears, 

    We are going on to deploy an external S-TAP. I read the guide more than once and opened a case with IBM support, but I am very confused. What are the prerequisites, and how can I deploy it?

    So please, we need your help if you can help me with any external videos that explain that topic.

    Thanks a lot.



    ------------------------------
    fathy houd
    ------------------------------


  • 2.  RE: External S-TAP deploy

    Posted 02/15/25 05:57 PM

    Hi there, hope this helps deploy IBM Guardium External S-TAP:


    Prerequisites


    1. System Requirements:

    x86_64 processor.

    • Linux kernel version 3.10+.
    • Docker (CE/EE) 1.12.16+.
    • Iptables 1.4+.
    • UNIX domain socket support

    2. Licensing and Version:

    • Ensure you have a Guardium collector appliance license and are using Guardium version 10.6 or later 

    1. Networking:
      Ensure proper VPC setup for
      communication between the database, External S-TAP, and Guardium Collector. Use public IPs or VPC peering if they are in different VPCs
    1. AWS CLI & Kubernetes:
      Install AWS CLI and Kubernetes tools ('kubectl', 'eksct]') if deploying on Amazon EKS
    2. Certificates: • For SSL connections, prepare a certificate signed by a CA


    Deployment Steps


    3. Create Kubernetes Cluster (if using

    Kubernetes):

    • Use 'eksctl create cluster' to set up the cluster.
    • Verify cluster and node creation using
      'kubectl get sve and 'kubectl get nodes commands 


    2. Set Up External S-TAP:

    • Log in to the IBM Guardium admin console.
    • Navigate to Manage > Activity
      Monitoring > External S-TAP Control.
    • Configure Docker Hub details to retrieve the container image 
    • Enter database details (endpoint, port) and Guardium Collector IP in the configuration 

    3. Deploy External S-TAP:

    • Click "Apply" to deploy the External S-TAP.
    • Verify deployment using 'kubectl get pod command.

    4. Modify Database Connection:


    • Update client connections to use the load balancer's external IP, which forwards traffic to the database and Guardium Collector 


    5. Test Traffic Monitoring:

    • Generate test traffic and verify it is reported in the Guardium Collector logs



    That is.... If your IBM Support ticket hasn't resolved it yet. ���� cheers! 






  • 3.  RE: External S-TAP deploy

    Posted 02/16/25 03:10 AM

    Hi Nika,

    Thanks a lot for your help.

    We are using the Oracle Cloud Interface (OCI). I tried to configure it, but unfortunately it is not working, so I opened a case with IBM and am waiting for their response.



    ------------------------------
    fathy houd
    ------------------------------

    Original Message


  • 4.  RE: External S-TAP deploy

    Posted 03/01/25 07:54 AM

    What is the communication matrix between the E-STAP, collector, database, and the client that connects to the databases?



    ------------------------------
    fathy houd
    ------------------------------

    Original Message


  • 5.  RE: External S-TAP deploy

    Posted 03/01/25 08:11 AM
    With IBM Guardium, the communication matrix between the E-STAP (which is the software agent), collector, your database stuff and for the client connecting to the database involves this:
    1. The E-STAP to Collector:

    • The E-STAP captures database activity in real-time and forwards this data to the Guardium collector over a secure channel. Communication typically uses TCP/IP with encryption to ensure data security.


    2. Collector to Database:

    • The collector may directly query the database for additional metadata or perform compliance checks. This communication uses database-specific protocols such as SQL over TCP/IP.



    3. Client to Database:

    • The client interacts with the database using standard protocols like JDBC, ODBC, or native drivers (e.g., DB2 client). The E-STAP intercepts these communications transparently without altering client-database interactions.


    4. Collector to Client (Optional):

    • If configured, the collector can alert clients or administrators via dashboards, email notifications, or SNMP traps about policy violations or suspicious activities.
    This architecture ensures centralized monitoring and control of database activity while maintaining minimal impact on performance.


    Was the ticket unresolved from earlier?
    I'm not usually on here much, given I have some other responsibilities to attend to most days. This forum is great though and there's a lot of good people who are better at this than I am. (With love, Nike)



    Original Message


  • 6.  RE: External S-TAP deploy

    Posted 03/02/25 04:16 AM

    Can we use the same cluster for all the databases that we have or one cluster for one database?



    ------------------------------
    fathy houd
    ------------------------------

    Original Message


  • 7.  RE: External S-TAP deploy

    Posted 03/02/25 06:32 AM
    Try using a single Multi-Master cluster to manage multiple databases rather than creating one cluster per database.




    Original Message


Related Content