IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Universal Connector deployment on MongoDB container based platform

    Posted Mon February 22, 2021 10:35 AM
    Looking for information if someone has done POC with Universal Connector on MongoDB Container based platform.
    Read IBM documentation avaiable about  MongoDB implementation using Universal Connector but it does not talk about if database is deployed on container based platform whether the solution will work the same way or not?

    We have MongoDB deployed in our environment using docker image on Kubernetes platform and looking to start POC with Universal Connector.
    Does anyone has similar setup and have started POC with Universal Connector?

    ------------------------------
    Rohit Goyal
    ------------------------------


  • 2.  RE: Universal Connector deployment on MongoDB container based platform

    Posted Tue February 23, 2021 11:36 AM

    Firstly, here's an excellent video demo (from Information Insights) showing Universal Connector end to end for MongoDB Atlas:

    https://www.youtube.com/watch?v=LAYhVoYMb28

    You need a method to get the events out of MongoDB and into the Logstash pipeline.  The video demo shows how you can save the events to files and then push them to the Logstash pipeline (Universal Connector). This might work for your POC.  You could mount a shared folder to the docker container (dockerfile ADD) and in this way, have access to the events/files outside the container and then push the events (using Filebeat) to the Universal Connector.

    I hope this makes sense.



    ------------------------------
    JOSHUA KLAHN
    ------------------------------

    Original Message


  • 3.  RE: Universal Connector deployment on MongoDB container based platform

    Posted Tue February 23, 2021 11:55 AM
    Thanks a lot for your reply Joshua.
    Does this method works for Kubernetes Cluster as well?

    ------------------------------
    Rohit Goyal
    ------------------------------

    Original Message


  • 4.  RE: Universal Connector deployment on MongoDB container based platform

    Posted Tue February 23, 2021 12:38 PM
    Should work the same in a Kubernetes cluster.  But if the database is in a Kub cluster, you should really take a look at the External STAP used in a "side-car" approach.  The External STAP is design for kubernetes environments.

    ------------------------------
    JOSHUA KLAHN
    ------------------------------

    Original Message


  • 5.  RE: Universal Connector deployment on MongoDB container based platform

    Posted Wed February 24, 2021 08:53 AM
    Tanks Joshua. We'd a demo with external STAP in past but it was big no from management side because that is proxy based model and acts as a single point of failure and hence since Universal Connector is now available in 11.3 we are looking to implement this rather than ETAP.

    ------------------------------
    Rohit Goyal
    ------------------------------

    Original Message


  • 6.  RE: Universal Connector deployment on MongoDB container based platform

    Posted Thu February 25, 2021 02:03 PM
    One more thing Joshua. We dont have MongoDB Atlas. We have MongoDB on Kubernetes cluster. 
    Could you please check Universal Connector solution would work and if not what are the other alternate solution available other than ETAP

    ------------------------------
    Rohit Goyal
    ------------------------------

    Original Message