IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Send Object Name in Sys Log Template

    Posted 05/07/20 02:10 PM
    Edited by Brian Greenwood 11/19/24 04:03 PM

    Hello,

     

    I have a Policy built under the Access Type of Policy.  I have a  Rule where I am matching on traffic that meets certain parameter. I am sending those alerts through Sys Log to our SIEM tool (Qradar).  I have created a template with the below fields in the Global Profile.  The only field I am having trouble with is the "Object Name" field.  I have it set up like this:  "Object Name=%%ObjectName"   It does not work.  I am being told that Object Name can't be sent in a template to Syslog.  Has anyone had any luck sending the Object Name field to the Sys Log in a template?  Not sure why it would be the only field that does not work??

     

     

    LEEF:1.0|IBM|Guardium|10.0|%%ruleDescription|ruleID=%%ruleID|ruleDesc=%%ruleDescription|severity=%%severity|devTime=%%receiptTime|serverType=%%serverType|classification=%%classification|category=%%category|dbProtocolVersion=%%DBProtocolVersion|usrName=%%AppUserName|sourceProgram=%%SourceProgram|start=%%sessionStartMills|dbUser=%%DBUser|dst=%%serverIP|dstPort=%%serverPort|src=%%clientIP|srcPort=%%clientPort|protocol=%%netProtocol|type=%%requestType|violationID=%%violationID|sql=%%SQLString|error=%%lastError|Database name=%%DBName|Object Name=%%ObjectName

     

    Brian Greenwood CPC HCISSP-A

    Information Security Analyst II

     

     


    Privacy Information: http://privacynotice.net (data rate charges may apply) or 800-524-2621.


  • 2.  RE: Send Object Name in Sys Log Template

    Posted 05/08/20 01:50 AM

    List of fields available in alerts are defined here:

    https://cmp.guardium.notes:8443/guardhelp_kc/SSMPHH_11.1.0/com.ibm.guardium.doc.admin/config/configuring_global_profile.html

    There is no ObjectName on the list.

    It make sense because SQL can contain the vary number of objects.



    ------------------------------
    Zbigniew (Zibi) Szmigiero
    IBM
    Warsaw
    ------------------------------



  • 3.  RE: Send Object Name in Sys Log Template

    Posted 05/18/20 08:04 AM
    Hi Brian:

    You can get creative with this on the QRadar side.  They can create a custom parameter and parse it out of the SQLString using regular expressions.  It does get quite complex as multiple ObjectNames can be contained within one SQLString and you have to be comfortable accepting some level of error.

    ------------------------------
    Wendy Zemba
    ------------------------------