IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Grant Policy Rules - Permission Entity

    Posted 08/07/24 09:04 AM

    In Grant SQL syntax, it is typically broken out into 'GRANT <permission> ON <object> TO <principal>'. While there are some additional options that may be thrown in, the general structure is the same.

    I have a need to be able to generate a real-time alert on Grants that are performed and giving a certain permission. For example, to alert on any execution of granting delete privilege:
    GRANT delete ON table1 TO user55

    Reviewing how the parsing works, it seems both the object and principal are parsed as SQL objects, but I do not see anywhere a place to identify the permission. Is this something that is possible to build a real-time policy for? Thank you!



    ------------------------------
    Chase Walkup
    ------------------------------


  • 2.  RE: Grant Policy Rules - Permission Entity
    Best Answer

    Posted 08/07/24 10:14 AM

    Hi @Chase Walkup,

    I'm not aware of the <permission> value in your string being parsed in out in the Guardium database tables. Suggest using a SQL criteria rule with 'Pattern =' and develop a regular expression that matches on your criteria.



    ------------------------------
    Wendy Zemba
    Sr. Consultant, Data Protection
    Converge Technology Solutions
    wendy.zemba@convergetp.com

    Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.
    ------------------------------



  • 3.  RE: Grant Policy Rules - Permission Entity

    Posted 08/07/24 10:48 AM

    Thanks, Wendy! That should work for what I need.



    ------------------------------
    Chase Walkup
    ------------------------------

    Original Message


  • 4.  RE: Grant Policy Rules - Permission Entity

    Posted 08/24/24 06:09 AM

    Hi,
    You can do this using correlation alert
    In this case you must configure report which will look for mentioned by you conditions. Then correlation alert definition will generate alert based on output from report.
    Be aware that report query will consume a lot of resource because it will require to use regexp filter probably.



    ------------------------------
    Zbigniew (Zibi) Szmigiero
    IBM
    Międzyrzecz
    ------------------------------



Related Content