InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report...

52
© 2014 IBM Corporation InfoSphere Guardium Tech Talk: Using InfoSphere Guardium APIs to speed deployments and automate repetitive tasks John Haldeman, Practice Lead, Information Insights LLC Joe DiPietro, Data Governance COE, IBM For questions about this presentation contact [email protected]

Transcript of InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report...

Page 1: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

© 2014 IBM Corporation

InfoSphere Guardium Tech Talk:Using InfoSphere Guardium APIs to speeddeployments and automate repetitive tasks

John Haldeman, Practice Lead, Information Insights LLCJoe DiPietro, Data Governance COE, IBM

For questions about this presentation contact [email protected]

Page 2: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

2 © 2014 IBM Corporation2

Logistics This tech talk is being recorded. If you object, please hang up and

leave the webcast now.

We’ll post a copy of slides and link to recording on the Guardiumcommunity tech talk wiki page: http://ibm.co/Wh9x0o

You can listen to the tech talk using audiocast and ask questions inthe chat to the Q and A group.

We’ll try to answer questions in the chat or address them atspeaker’s discretion.

– If we cannot answer your question, please do include your emailso we can get back to you.

When speaker pauses for questions:– We’ll go through existing questions in the chat

Page 3: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

3 © 2014 IBM Corporation

Reminder: Guardium Tech Talks

Link to more information about this and upcoming tech talks can be found on the InfoSpereGuardium developerWorks community: http://ibm.co/Wh9x0o

Please submit a comment on this page for ideas for tech talk topics.

Next tech talk: Take a RESTful look at InfoSphere Guardium APIs

Speakers: Joe DiPietro and Guy Galil

Date &Time: Tuesday, April 29th, 2014

11:30 AM Eastern Standard Time (90 minutes)

Register here: http://bit.ly/1qqVub5

Page 4: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

4 © 2014 IBM Corporation

New!!! Regional user groups this year

Sao Paulo, Brazil on April 8th

For registration links, askyour IBM rep or visit theEvents Calendar on theInfoSphere Guardiumcommunity ondeveloperWorks.

Page 5: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

5 © 2014 IBM Corporation

Agenda

grdAPIs – An Introduction

Use Cases and Examples

–Datasource Creation and RoleAssignment

–Mass Group Population and GroupMember Manipulation

–GIM Module and Inspection EngineDeployment

The REST API – An Introduction

Page 6: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

6 © 2014 IBM Corporation

grdAPIs - Introduction

Set of Guardium functions that can be executed programmatically

Functions are exposed through the SSH CLI and in GUI Reports (They alsohave a new HTTP+REST interface we’ll talk about a little later)

Helps speed up repetitive tasks

Things you can dousing only the

standard interface

Things you can doonly with a grdAPIcall

Most things youcan do with either

the standardInterfaces or with

grdAPI calls

Page 7: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

7 © 2014 IBM Corporation

How to Find Out What Commands are Available

Formal documentation on the Knowledge Centerhttp://www-

01.ibm.com/support/knowledgecenter/SSMPHH_9.1.0/com.ibm.guardium91.doc/appendices/topics/guardapi_reference.html

You can discover what commands are available in the CLI:grdapi commands <search_string>

Page 8: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

8 © 2014 IBM Corporation

How to Find Out What Commands Take for Parameters

Discover required parameters with the --help=true option in a grdAPIcall

Page 9: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

9 © 2014 IBM Corporation

How to Find Out Values are Allowed for Certain Parameters

Discover allowable values using --get_param_values=<param-name>

Page 10: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

10 © 2014 IBM Corporation

Quiz!! Question 1:

What method(s) can be used to fire a grdAPIcall?

1. Through the CLI (ssh)

2. Through an interactive GUI report

3. Through scheduled reports in Audit Processes

4. Both 1 and 2

5. All of the Above

Page 11: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

11 © 2014 IBM Corporation

Question 1:

Answer: All of the above

Really? Through scheduled reports in Audit Processes?

Example – Take a look at the how-to on blocking (quarantine) using thresholds:

http://www-01.ibm.com/support/knowledgecenter/SSMPHH_9.1.0/com.ibm.guardium91.doc/how_to/topics/how_to_terminate_connections_via_threshold_alerts.html?lang=en

Page 12: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

12 © 2014 IBM Corporation

Use Case – Datasource Creation and Role Assignment

Datasources define databases that Guardium can connect to

Data source creation has to occur for customer environments implementingVulnerability Assessments or Entitlement Reports

Assignment of roles to those data sources so that other users can use them

You cannot assign a role to a vulnerability assessment definition if that roledoesn’t already have access to all of the datasources in that VA definition

We use (at least some) of these calls on almost every project involvingvulnerability assessments and entitlement reports – It saves quite a bit oftime during implementation

grdapi calls:create_datasourceencrypt_valuegrant_role_to_object_by_Name

Page 13: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

13 © 2014 IBM Corporation

Use Case – Datasource Creation and Role Assignment

grdapi create_datasource owner=adminapplication="Security Assessment" serviceName=SALEShost=db2luwhost1 password=0W37lThZibRebsSsDvhvport=50000 user=svc_guard type=DB2name=DB2_db2luwhost1_SALES

Key for this Presentation:grdAPI Calls in blueParameter names in greenParameter values in black

Page 14: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

14 © 2014 IBM Corporation

Use Case – Datasource Creation and Role Assignment

Normally you will get your connection properties as some kind of tabularexport from the DBA group

Building a large number of API calls is easy using your favorite spreadsheettools or with some simple scripting:

Page 15: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

15 © 2014 IBM Corporation

Alternative: New Delimited File Import Feature

Administration Console Customer Uploads

Page 16: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

16 © 2014 IBM Corporation

Datasource Creation – Cringing at the Clear TextPasswords?

grdapi encrypt_valuevalueToEncrypt=0W37lThZibRebsSsDvhvkey="SharedSecret"

Page 17: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

17 © 2014 IBM Corporation

Datasource Creation – Cringing at the Clear TextPasswords? (continued)grdapi create_datasource owner=admin application="SecurityAssessment" serviceName=SALES host=db2luwhost1 port=50000user=svc_guard type=DB2 name=DB2_db2luwhost1_SALES2encryptedParam=password-----BEGIN PGP MESSAGE-----Version: GnuPG v1.4.5(GNU/Linux)jA0EAgMCLgFxqrR47jhgyUiRVaTTlyDiBD2eHxWLIIwLwvA/dTuX8MNdPfTGLxgZ8mRpaiXrGLLrsEoGNkhrBarEXRkwGRo5vtSJpQQKZH88CpTty0wmAWk==m2j4-----END PGP MESSAGE-----

Page 18: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

18 © 2014 IBM Corporation

What If I don’t know my Shared Secret (and don’t wantto know)?

Occasionally (hopefully often) the personcreating the Datasources, the person thatknows the Guardium shared secret, and theperson that knows the database password aredifferent

It’s not a great practice for them to startsharing keys and passwords with eachother….but then you can’t encrypt the passwords usingthe CLI (it takes the shared secret as input)

Instead you can have someone enter thepassword through the GUI, hidden from view,and not have to know what the shared secret isfor Guardium – You would then copy theresulting PGP block

Daily Monitor DataSources Invokecreate_datasource

Page 19: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

19 © 2014 IBM Corporation

Assigning Roles to the New Datasources The grdapi call for role assignment is:

grant_role_to_object_by_Name

This particular grdapi call is not visible to most CLI users– You must reauthenticate as a GUI user that has theaccessmgr and cli roles

Use one of the guardcli1-5 users and execute “setguiuser” to a user with both accessmgr and cli roles

More info on guardcli1-5 and “set guiuser”:http://www-

01.ibm.com/support/knowledgecenter/SSMPHH_9.1.0/com.ibm.guardium91.doc/appendices/topics/guardapi_reference.html

Page 20: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

20 © 2014 IBM Corporation

Assigning Roles to the New Datasources

grdapi grant_role_to_object_by_Name objectType=Datasourcerole=all_roles objectName=DB2_db2luwhost10_LUWDB05

If you need a list of your datasources you can export it from Daily MonitorDatasources

Page 21: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

21 © 2014 IBM Corporation

Quiz!!! Question 2:

True or False: You can assign data sources to vulnerabilityassessment test sets using the grdAPI?

1. True

2. False

Page 22: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

22 © 2014 IBM Corporation

Question 2:

Answer: True

But I don’t use it much anymore: you can do that in bulk now insidethe Guardium user interface by (shift click) selecting multiple datasources in the vulnerability assessment editor

That wasn’t always available (pre late-V8 or so). Sometimes its thelittle things that help a lot :)

Page 23: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

23 © 2014 IBM Corporation

Use Case – Application DB User Group Population

Groups in Guardium can grow quite large, and if you have to populate them manually,that’s an awful lot of clicking

Automated group population has a lot of benefits:– Keep your groups up-to-date automatically– Save time during initial population

There are quite a few methods for bulk group population:– Imports from CSV files using the enterprise integrator– Imports from LDAP– Population based on Guardium’s captured audit history– Importing of DPS updates– grdAPI calls: What we’re talking about today

Our Example: We want to import a list of users that application and batch processesuse to access the databases in order to:

– Help to start building reports of session profiles to ignore– Alert when those accounts are used in an unusual way (eg: logging in from an IP other than an

application server)

grdapi calls:create_member_to_group_by_desccreate_computed_attribute

Page 24: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

24 © 2014 IBM Corporation

Use Case – Datasource Creation and Role Assignment

grdapi create_member_to_group_by_descdesc="Application DB Users" member=APP10

Initial Population: Running grdAPIs through the command line

Page 25: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

25 © 2014 IBM Corporation

Use Case – Datasource Creation and Role Assignment

To help with running many grdAPI calls from a file as input, you canuse a provided expect script to perform the execution:

The script can be found here with some additional instructionshttp://www-

01.ibm.com/support/knowledgecenter/SSMPHH_9.1.0/com.ibm.guardium91.doc/how_to/topics/how_to_automate_execution_of_guardapi_commands.html?lang=en

Usage:./guardcli.exp <g-machine> <cli-usr> <cli-pwd> <gui-usr> <gui-pwd> <file>

You can get really complicated with expect if you would like

Don’t have Linux/UNIX with Expect? Consider using ActiveState TCL withthe expect package installed and spawning Open SSH for Windows

Some tips on Expect:–Using the option “exp_internal 1” is good for debugging–This is a good introduction that shows execution with FTP which is analogous:http://oreilly.com/catalog/expect/chapter/ch03.html

Page 26: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

26 © 2014 IBM Corporation

Use Case – Application DB User Group Population Maintenance: Setting it up an API call to to add members through a report:http://www-

01.ibm.com/support/knowledgecenter/SSMPHH_9.1.0/com.ibm.guardium91.doc/how_to/topics/how_to_generate_api_call_from_reports.html?lang=en

Page 27: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

27 © 2014 IBM Corporation

Use Case – Application DB User Group Population

Group Member Manipulation Example: Prepending “EXCLUDE/” for IMSCollection Profile Policy Rules:

– Guardium Monitor Query Entities and Attributes Group Member Entity Invoke

Page 28: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

28 © 2014 IBM Corporation

Use Case – Application DB User Group Population

Group Member Manipulation Example with grdAPI calls: Prepending“EXCLUDE/” for IMS Collection Profile Policy Rules:

– Guardium Monitor Query Entities and Attributes Group Member Entity Invoke

Page 29: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

29 © 2014 IBM Corporation

Use Case – Application DB User Group Population

Clone “Guardium Monitor Guardium Group Details”, add the new column

Page 30: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

30 © 2014 IBM Corporation

Use Case – Application DB User Group Population

Automatically populate a new group with the new column

Page 31: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

31 © 2014 IBM Corporation

Quiz!! Question 3

If you do update a group in an automated way, which of thefollowing should you also be sure take care of?

1. Updating any required scheduled reports in your audit processes that use that group

2. Reinstalling any policies that use that group

3. Refreshing any hierarchical groups that use that updated group

4. Both 2 and 3

5. All of the above

Page 32: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

32 © 2014 IBM Corporation

Question 3

Answer: 4 (both 2 and 3)

Reports will incorporate the updates automatically

Hierarchical Groups: Run Group Flattening (can be scheduled)

Policies that use the group: Reinstall Policy (can be scheduled)

You can also do this in your grdAPI scripts:– grdapi reinstall_policy– grdapi flatten_hierarchical_groups

Page 33: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

33 © 2014 IBM Corporation

Use Case – GIM and Inspection Engine Deployment through grdAPIs

Client Situation:– A couple of hundred STAPs to deploy in short time period– Change windows difficult to come by and get approval for (organization, not technology, critical path)– Time limits in change windows with complicated constraints during the window (only do X after 11pm)– Organization sensitive to any kind of failed change and trying again

Deployment Planning– Because change windows were so tough to get – decided to deploy GIM and STAP at the same time

in one window– Attempt to deploy Several GIM and STAP agents in one night– Occasionally Instance Discovery Agents either didn’t work or Java was not available (and could not be

made available) in production

Early Troubles– Copying and pasting IPs and other parameters from large spreadsheets into GIM consoles had the

occasional error. For example:• Chose wrong host by mistake• Put the wrong IP in the wrong parameter

– These issues only occurred rarely, but in situations under tight constraints, that can make a bigdifference: Compensated by Performing on-line QA During the Changes

Move to grdAPIs for everything:– Speeds Thing Up– Allows QA to happen before the night of the change– Automated generation improves quality– Allowed us to keep a record of what parameters we used on what nights

Page 34: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

34 © 2014 IBM Corporation

Use Case – GIM Deployment through grdAPIs

Linux/UNIX example:

grdapi gim_assign_latest_bundle_or_module_to_client clientIP=172.16.100.166module=BUNDLE-STAP

grdapi gim_update_client_params clientIP=172.16.100.166paramName=KTAP_ALLOW_MODULE_COMBOS paramValue=Y

grdapi gim_update_client_params clientIP=172.16.100.166paramName=STAP_SQLGUARD_IP paramValue=172.16.100.157

grdapi gim_update_client_params clientIP=172.16.100.166 paramName=STAP_TAP_IPparamValue=172.16.100.166

grdapi gim_update_client_params clientIP=172.16.100.166paramName=KTAP_LIVE_UPDATE paramValue=Y

grdapi gim_schedule_install clientIP=172.16.100.166 module=BUNDLE-STAPdate=NOW

Page 35: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

35 © 2014 IBM Corporation

Use Case – Inspection Engine Deploymentthrough grdAPIs

Linux/UNIX example:

grdapi create_stap_inspection_engine protocol=Oracleclient=1.1.1.1/0.0.0.0 stapHost=172.16.100.166 portMin=1521portMax=1521 ktapDbPort=1521dbInstallDir=/opt/app/oracle/product/10.2.0.4 procName=/opt/app/oracle/product/10.2.0.4/bin/oracle

Page 36: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

36 © 2014 IBM Corporation

REST API

Page 37: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

37 © 2014 IBM Corporation

RestAPI

What is REST?– A stateless architecture that runs over HTTP– REST = REpresentational State Transfer– http://en.wikipedia.org/wiki/Representational_state_transfer

Why expose information via REST?– Many newer applications use REST – Mobile, Social, applications that

automating business processes– Guardium has always tried to leverage existing infrastructure to help integrate

our products to make it easier to deploy and provide higher value for ourcustomers

How does it work?– Leverages existing technologies – HTTP, XML, etc– Unique Resource Indicators (URIs) - https://10.10.9.239:8443/restAPI/datasource

– REST has limited number of operations (GET, POST, PUT & DELETE = Verbs)

Wait until 9.1 Patch 200 to get the latestand greatest…

Page 38: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

38 © 2014 IBM Corporation

Guardium’s Implementation of REST1. Register Application (only once) and get Client Secret2. Store Client Secret in secure place3. Request Access Token for authorization4. Store Access Token so grdAPI command

will be authenticated properly5. Use Access Tokens to submit GrdAPI commands

ClientApplication

1. Use grdAPI to register application

Guardium Appliance

(CLI)

(HTTPS with REST)

2. Save response which contains “client secret”

3. Send request for “Access Token” with client secret

4. Save response which contains “Access Token”

5. Send grdAPI with authorized “Access Token”

Page 39: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

39 © 2014 IBM Corporation

Spreadsheet as a tool for restAPI

Page 40: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

40 © 2014 IBM Corporation

Spreadsheet as a tool for restAPI

Page 41: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

41 © 2014 IBM Corporation

REST with Guardium…

HTTP has a vocabulary of operations (request methods)– GET (pass parameters in the URL)– POST (pass parameters in JSON object)– PUT (pass parameters to change as JSON object)– DELETE (pass parameters as JSON object)

grdAPI’s list_datasourcename_by_name (parameters - ?name="MSSQL_1)

– -X GET https://10.10.9.239:8443/restAPI/datasource/?name="MSSQL_1"

create_datasource– -X POST https://10.10.9.239:8443/restAPI/datasource

update_datasource_by_name - JSON Object '{password:guardium}‘– -X PUT -d '{password:guardium, name:"MSSQL_1}‘

delete_datasource_by_id - JSON Object '{"id":20020}‘– -X DELETE -d '{"id":20020}‘

RestAPI vs GrdAPIGET = ListPOST = CreatePUT = UpdateDELETE = Delete

Page 42: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

42 © 2014 IBM Corporation

List Datasource by name

curl -k --header "Authorization:Bearer 9f8e1b10-7e6d-4803-9812-1faab5d0a094" -i -H "Content-Type: application/json" -X GEThttps://10.10.9.239:8443/restAPI/datasource/?name="MSSQL_1"

GET = list Parameters to be passed in GET request: ?name="MSSQL_1“ REST Resource: restAPI/datasource This means: show me the details of datasource name: MSSQL_1

[{

"DatasourceId":"https://G91.ibm.com:8443/restAPI/datasource?id=20021",

"DatasourceTypeId": "4","Name": "MSSQL_1","Description": "null","Host": "10.10.9.252","Port": "1433","ServiceName": "","UserName": "sa","Password": "[B@7ad07ad0","PasswordStored": "true","DbName": "null",

"LastConnect": "null","Timestamp": "2014-03-11 13:09:36.0","ApplicationId": "8","Shared": "true","ConProperty": "null","OsUsername": "null","DbHomeDir": "null","CustomUrl": "null","Severity": "5","DbDriverId": "4","CompatibilityMode": "","DatasourceType": "MS SQL SERVER","ApplicationType": "SecurityAssessment"

}]

Page 43: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

43 © 2014 IBM Corporation

Create a Datasource

[joe@ocean]$ curl -k --header "Authorization:Bearer bd9278f0-c02c-4efc-b4dc-f861b7fc28e7" -i -H "Content-Type: application/json" -XPOST -d '{application:"SecurityAssessment",host:10.10.9.252,name:"MSSQL_1",owner:admin,password:guardium,port:1433,shared:"true",severity:MED,type:"MS SQLSERVER (DataDirect)",user:sa }'https://10.10.9.239:8443/restAPI/datasource

POST = Create

URI - https://10.10.9.239:8443/restAPI/datasource

Parameters: (Values)

Response ===============

{"ID": 20004,"Message": "ID=20004"

}

Page 44: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

44 © 2014 IBM Corporation

Create a Datasource

[joe@ocean]$ curl -k --header "Authorization:Bearer bd9278f0-c02c-4efc-b4dc-f861b7fc28e7" -i -H "Content-Type: application/json" -X POST -d'{application:"SecurityAssessment",host:10.10.9.252,name:"MSSQL_1",owner:admin,password:guardium,port:1433,shared:"true",severity:MED,type:"MS SQL SERVER (DataDirect)",user:sa }'https://10.10.9.239:8443/restAPI/datasource

HTTP/1.1 200 OKSet-Cookie: JSESSIONID=52960A56AFBC5989CDC825BCEA5EEBA4; Path=/; Secure;

HttpOnlyX-UA-Compatible: IE=edgeX-FRAME-OPTIONS: SAMEORIGINAccess-Control-Allow-Methods: POST, GET, PUT, DELETEAccess-Control-Allow-Headers: authorization, origin, X-Requested-With, Content-Type,

AcceptAccess-Control-Max-Age: 18000Content-Type: application/json;charset=UTF-8Content-Length: 43Date: Wed, 12 Mar 2014 08:23:44 GMTServer: SQL Guard

{"ID": 20004,"Message": "ID=20004"

}[joe@ocean]$

Page 45: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

45 © 2014 IBM Corporation

Example of creating a group through REST

[joe@osprey ~]$ curl -k --header "Authorization:Bearer 211684bf-404d-4d98-960a-5d69ed8111c5" -i -H "Content-Type: application/json" -XPOST -d '{desc:"Application DBUsers",type:USERS,appid:"Public",category:"applicationusers",classification:"PCI data",owner:"admin" }'https://10.10.9.239:8443/restAPI/group

HTTP/1.1 200 OKSet-Cookie: JSESSIONID=B7C946314283B4D4542A1FE2368D6942; Path=/; Secure; HttpOnlyContent-Type: application/json;charset=ISO-8859-1Content-Length: 36Date: Fri, 14 Mar 2014 14:28:27 GMTServer: SQL Guard

{"ID":20009,"Message":"ID=20009\n"}

Successful Executionof create group

Page 46: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

46 © 2014 IBM Corporation

Example of adding a member to a group through REST

[joe@osprey ~]$ curl -k --header "Authorization:Bearer 211684bf-404d-4d98-960a-5d69ed8111c5" -i -H "Content-Type: application/json" -XPOST -d '{desc:"Application DB Users",member:App10 }'https://10.10.9.239:8443/restAPI/group_member

HTTP/1.1 200 OKSet-Cookie: JSESSIONID=36ECFCEB5B3351FAC33950E96E5C79DA; Path=/; Secure; HttpOnlyContent-Type: application/json;charset=ISO-8859-1Content-Length: 40Date: Fri, 14 Mar 2014 14:29:12 GMTServer: SQL Guard

{"ID":1003225,"Message":"ID=1003225\n"}

POST on resource“group_member” = create

Successful Executionof create group member

Page 47: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

47 © 2014 IBM Corporation

List members of a group through REST

[joe@osprey ~]$ curl -k --header "Authorization:Bearer 1c2cf8e2-1e3f-496f-8e09-a5bddeefbdf9" -i -H "Content-Type: application/json" -X GEThttps://10.10.9.239:8443/restAPI/group_members_by_group_id?id=20009

HTTP/1.1 200 OKSet-Cookie: JSESSIONID=7E8023B5EF9273A39E4C5503C6DF550E; Path=/; Secure; HttpOnlyX-UA-Compatible: IE=edgeX-FRAME-OPTIONS: SAMEORIGINAccess-Control-Allow-Methods: POST, GET, PUT, DELETEAccess-Control-Allow-Headers: authorization, origin, X-Requested-With, Content-Type, AcceptAccess-Control-Max-Age: 18000Content-Type: application/json;charset=UTF-8Content-Length: 220Date: Fri, 14 Mar 2014 20:46:11 GMTServer: SQL Guard

[{

"group_id": 20000,"group_description": "https://G91:8443/restAPI/group?desc=Application DB Users","group_members": [

{"member": "App10"

}]

}]

GET on resource“group_members_by_group_id” = list

Successful executionlisting members of group

In JSON format

Page 48: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

48 © 2014 IBM Corporation

How to Get Help –

curl -k --header "Authorization:Bearer 1c2cf8e2-1e3f-496f-8e09-a5bddeefbdf9" -i -H "Content-Type: application/json" -X GEThttps://10.10.9.239:8443/restAPI/restapi

https://1010.9.239:8443/restAPI/restapi?resourceId=14

[joe@osprey ~]$ curl -k --header "Authorization:Bearer 1c2cf8e2-1e3f-496f-8e09-a5bddeefbdf9" -i -H"Content-Type: application/json" -X GET https://9.70.148.214:8443/restAPI/restapi?resourceId=14

[{"parameterName": "desc","parameterType": "java.lang.String","isRequired": true

},{"parameterName": "member","parameterType": "java.lang.String","isRequired": true

},{"parameterName": "api_target_host","parameterType": "java.lang.String","isRequired": false

}]

Page 49: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

49 © 2014 IBM Corporation

How to Get Help – Update Datasourcehttps://1010.9.239:8443/restAPI/restapi?resourceId=4

[root@q]# curl -k --header "Authorization:Bearer bd9278f0-c02c-4efc-b4dc-f861b7fc28e7"https://9.70.148.214:8443/restAPI/restapi?resourceId=4

[{

"parameterName": "name","parameterType": "java.lang.String","isRequired": true

},{

"parameterName": "newName","parameterType": "java.lang.String","isRequired": false

},{

"parameterName": "description","parameterType": "java.lang.String","isRequired": false

},{

"parameterName": "port","parameterType": "java.lang.Integer","isRequired": false

},{

"parameterName": "serviceName","parameterType": "java.lang.String","isRequired": false

},{

"parameterName": "user","parameterType": "java.lang.String","isRequired": false

},{

"parameterName": "password","parameterType": "java.lang.String","isRequired": false

},{

"parameterName": "dbName","parameterType": "java.lang.String","isRequired": false

},

{"parameterName": "conProperty","parameterType": "java.lang.String","isRequired": false

},{"parameterName": "dbInstanceDirectory","parameterType": "java.lang.String","isRequired": false

},{"parameterName": "dbInstanceAccount","parameterType": "java.lang.String","isRequired": false

},{"parameterName": "shared","parameterType": "java.lang.String","isRequired": false

},{"parameterName": "customURL","parameterType": "java.lang.String","isRequired": false

},{"parameterName": "severity","parameterType": "java.lang.String","isRequired": false

},{"parameterName": "api_target_host","parameterType": "java.lang.String","isRequired": false

}]

Page 50: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

50 © 2014 IBM Corporation

Reminder: Guardium Tech Talks

Link to more information about this and upcoming tech talks can be found on the InfoSpereGuardium developerWorks community: http://ibm.co/Wh9x0o

Please submit a comment on this page for ideas for tech talk topics.

Next tech talk: Take a RESTful look at InfoSphere Guardium APIs

Speakers: Joe DiPietro and Guy Galil

Date &Time: Tuesday, April 29th, 2014

11:30 AM Eastern Standard Time (90 minutes)

Register here: http://bit.ly/1qqVub5

Page 51: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

51 © 2014 IBM Corporation

Information, training, and community

InfoSphere Guardium YouTube Channel – includes overviews andtechnical demos InfoSphere Guardium newsletter developerWorks forum (very active)Guardium DAM User Group on Linked-In (very active) Community on developerWorks (includes content and links to a

myriad of sources, articles, etc)Guardium Info Center

InfoSphere Guardium Virtual User Group.Open, technical discussions with other users.

Send a note to [email protected] ifinterested.

Page 52: InfoSphere Guardium Tech Talk: Using InfoSphere · PDF fileThrough an interactive GUI report 3. ... Question 1: Answer: All of the above Really? Through scheduled reports in Audit

52 © 2014 IBM Corporation52

GraciasMerci

Grazie

ObrigadoDanke

Japanese

French

Russian

German

Italian

Spanish

Brazilian Portuguese

Arabic

Traditional Chinese

Simplified Chinese

Thai

TackSwedish

Danke

DziękujęPolish