The progresses table
|
|
NOTE:
The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions. |
This table contains information only about Audit Player indexers. It does not contain any information about the indexer service.
| Column | Type | Description |
|---|---|---|
| audit | text |
Audit-trail: Name and ID of the audit file storing the traffic of the channel. If the session has an audit trail, a icon is displayed. Note that a the following letters may appear on the download icon: |
| ap_id | integer | [OBSOLETE] The ID of the Audit Player indexer service that is processing the audit trail. |
| id | integer | The unique ID number of the entry. |
The results table
|
|
NOTE:
The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions. |
| Column | Type | Description |
|---|---|---|
| channel_id | integer | The ID of the channel where a token was found. This value is actually a reference to the id column of the channels table. |
| id | integer | The unique ID number of the entry. |
| token | text | The token (search keyword). |
The skipped_connections table
|
|
NOTE:
The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions. |
| Column | Type | Description |
|---|---|---|
| channel_id | integer | The ID of the channel. This value is actually a reference to the id column of the channels table. |
| id | integer | The unique ID number of the entry. |
| occasions | integer |
The usermapped_channels view
This view collects data about the connections which used a usermapping policy. The view is defined as follows:
select
channels.id,
channels.scp_path,
channels.subsystem_name,
channels.protocol,
channels.originator_port,
channels.channel_policy,
channels.target_addr,
channels._archive_path,
channels._close_cleanup,
channels.dynamic_channel,
channels.environment,
channels.session_start,
channels.remote_username,
channels.local_port,
channels.four_eyes_authorizer,
channels.src_ip,
channels.session_end,
channels._archive_server,
channels.server_port,
channels.username,
channels._archive_date,
channels.server_ip,
channels.exec_cmd,
channels._archive_policy,
channels.four_eyes_description,
channels.connection_id,
channels._connection_channel_id,
channels.rule_num,
channels.target_port,
channels.src_port,
channels.originator_addr,
channels.auth_method,
channels.audit,
channels.local_ip,
channels.session_id,
channels.device_name,
channels.channel_type,
channels."connection",
channels.verdict,
channels.dst_port,
channels.dst_ip
from channels
where channels.remote_username is not null
and channels.username <> channels.remote_username;
The the usermapped_channels view has the following columns. For details of the different columns, see Connection metadata.
|
|
NOTE:
The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions. |
| Column | Type | Description |
|---|---|---|
| _archive_date | date |
Archive date: The date when the connection was archived or cleaned up. |
| _archive_path | text |
Archive path: The path where the audit trail was archived on the remote server. |
| _archive_policy | text | |
| _archive_server | text |
Archive server: The hostname or IP address of the remote server where the audit trail was archived. |
| audit | text |
Audit-trail: Name and ID of the audit file storing the traffic of the channel. If the session has an audit trail, a icon is displayed. Note that a the following letters may appear on the download icon: |
| auth_method | text |
Authentication method: The authentication method used in the connection. For example, password |
| channel_policy | text |
Channel policy: The Channel policy applied to connection. The Channel policy lists the channels (for example, terminal session and SCP in SSH, or Drawing and Clipboard in RDP) that can be used in the connection, and also determines if the channel is audited or not. The Channel policy can also restrict access to each channel based on the IP address of the client or the server, a user list, user group, or a time policy. |
| channel_type | text |
Channel type: Type of the channel. |
| _close_cleanup | boolean | |
| _connection_channel_id | integer |
Unique connection ID: The unique identifier of the connection. |
| connection_id | text |
Connection policy ID: The identifier of the connection policy. |
| connection | text |
Connection policy: The connection policy that handled the client's connection request. |
| device_name | text |
Device name: The name or ID of the shared device (redirect) used in the RDP connection. |
| dst_ip | text |
Destination IP: The IP address of the server as requested by the client. |
| dst_port | integer |
Destination port: The port number of the server as requested by the client. |
| dynamic_channel | text |
Dynamic channel: The name or ID of the dynamic channel opened in the RDP session. |
| exec_cmd | text |
Exec command: The command executed in a Session exec channel. |
| four_eyes_authorizer | text |
Four-eyes authorizer: The username of the user who authorized the session. Available only if 4-eyes authorization is required for the channel. For details on 4-eyes authorization, see Configuring four-eyes authorization. |
| four_eyes_description | text |
Four-eyes description: The description submitted by the authorizer of the session. |
| id | integer | |
| local_ip | text |
Server-local IP: The IP address of SPS used in the server-side connection. |
| local_port | integer |
Server-local port: The port number of SPS used in the server-side connection. |
| originator_addr | text |
Port/X11 forward originator IP: The IP address of the host initiating the channel in Remote Forward and Local Forward channels. Note that this host is not necessarily the client or the server of the SSH connection. |
| originator_port | integer |
Port/X11 forward originator port: The number of the forwarded port in Remote Forward and Local Forward channels. |
| protocol | text |
Protocol: The protocol used in the connection (Citrix ICA, HTTP, RDP, SSH, Telnet, or VNC). |
| remote_username | text |
Username on server: The username used to log in to the remote server. This username can differ from the client-side username if usermapping is used in the connection. For details on usermapping, see Configuring usermapping policies. |
| rule_num | text |
Rule number: The number of the line in the Channel policy applied to the channel. |
| scp_path | text |
SCP path: Name and path of the file copied via SCP. Available only for SCP sessions (Session exec SCP SSH channels) if the Log file transfers to database option is enabled in the Channel Policy of the connection. |
| server_ip | text |
Server IP: The IP address of the server connected by SPS. |
| server_port | integer |
Server port: The port number of the server connected by SPS. |
| session_end | integer |
End time: Date when the channel was closed. |
| session_id | text |
Session ID: A globally unique string that identifies the session. This session ID has the following format: svc/<unique-random-hash>/<name-of-the-connection-policy>:<session-number-since-service-started>/<protocol>, for example, svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:1/ssh. Log messages related to the session also contain this ID. For example: 2015-03-20T14:29:15+01:00 demo.example zorp/scb_ssh[5594]: scb.audit(4): (svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:0/ssh): Closing connection; connection='ssh_console', protocol='ssh', connection_id='409829754550c1c7a27e7d', src_ip='10.40.0.28', src_port='39183', server_ip='10.10.20.35', server_port='22', gateway_username='', remote_username='example-username', verdict='ZV_ACCEPT' |
| session_start | integer |
Start time: Date when the channel was started. |
| src_ip | text |
Source IP: The IP address of the client. |
| src_port | integer |
Source port: The port number of the client. |
| subsystem_name | text |
Subsystem name: Name of the SSH subsystem used in the channel. |
| target_addr | text |
Port-forward target IP: The traffic was forwarded to this IP address in Remote Forward and Local Forward channels. |
| target_port | integer |
Port-forward target port: The traffic was forwarded to this port in Remote Forward and Local Forward channels. |
| username | text |
Username: The username used in the session.
|
| verdict | text |
Verdict: Indicates what SPS decided about the channel.
|