IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Redact action is not working .

    Posted 06/27/22 05:06 PM
    Hi all,

    I WANT to mask the  column "Card" content data type  NVARCHAR2(150) of credit card number whenever any user other then sys user try to capture the data of perticular column. It is oracle 19 os aix 7.2
    I have created  extrusion rule with redact action.

    ------------------------------
    ajay rawat
    ------------------------------


  • 2.  RE: Redact action is not working .

    Posted 06/28/22 12:49 AM
    Hi Ajay,

    Have you installed below parameter with S-TAP installation?

    STAP_FIREWALL_INSTALLED - 1

    Have you verified that the blocking is working?
    Check the regular expression you use in the redact policy and let us know.

    Thanks,
    Panendar Rao.C

    ------------------------------
    PHANENDRA RAO CHAVANA
    ------------------------------



  • 3.  RE: Redact action is not working .

    Posted 06/29/22 01:34 AM
    Hi,
    Yes,STAP_FIREWALL_INSTALLED - 1 is enable. I have tested the sample in  regex simulation it showing pass (green). 
    In access policy when i am configuring the action S-GATE terminate it is working fine.
    In extrustion rule when am setting full LOG FULL DETAILS action i am able to see the hit are comming for that rule. Whenever i execute command but when i am setting  S-TAP TERMINATE action  it is not working. 



    ------------------------------
    ajay rawat
    ------------------------------

    Original Message


  • 4.  RE: Redact action is not working .

    Posted 06/30/22 12:41 AM
    Hi Ajay Rawat,

    In the Extrusion Rule, Rule actions should be (Redact) for masking the data not S-TAP Terminate.

    Thanks,
    Panendar Rao.C

    ------------------------------
    PHANENDRA RAO CHAVANA
    ------------------------------

    Original Message


  • 5.  RE: Redact action is not working .

    Posted 07/01/22 04:24 PM
    Hi,

    As per your last mail, For testing purspose i had kept S-tap Terminate action, but it is not working. After setting Rule actions as Redact still it is not working.
    Kindly let us know we have to make given rule in session or access level. Also let us know if any other setting required. 

    Thanks,
    .......AR

    ------------------------------
    ajay rawat
    ------------------------------

    Original Message


  • 6.  RE: Redact action is not working .

    Posted 05/16/23 07:56 AM

    Hey,
    I would love to know if you managed to mask the data?
    If so, I would like to understand how it worked out and what necessary actions you performed?

    Thanks,

    Ariel 



    ------------------------------
    Ariel Oz
    ------------------------------

    Original Message


  • 7.  RE: Redact action is not working .

    Posted 06/01/23 08:55 AM

    Hi Ajay,

    I manage to Redact data in my environment (after many days of looking for a solution) unfortunately there is no official guide\documentation provided by IBM :(.

    What i have done is:

    1. Installing firewall for Linux S-tap (default state 2)

    2. Enabling Inspect Returned Data on the Collector and Restarting Inspection Engines.

    3. The solution was eventually found by creating the correct Data Pattern in the Extrusion Rule.

    I used this template ([0-9]{4})[0-9]{2} to create corresponding Regex for my masking needs, found it here:

    https://www.ibm.com/support/pages/ibm-security-guardium-redact-action-does-not-work-regular-expressions-include-curly-braces-y-when-applied-database-servers-microsoft-windows

    Also you may find what you need in this guide in the Data Pattern section:

    https://www.ibm.com/docs/en/guardium/11.4?topic=actions-rule-definition-fields

    Hope it helps.

    Regards,

    Roman.



    ------------------------------
    Roman Streshinsky
    ------------------------------



Related Content