One Identity Safeguard for Privileged Sessions 6.0.4 - Administration Guide

The usermapped_channels view

This view collects data about the connections which used a usermapping policy. The view is defined as follows:

select
    channels.id,
    channels.scp_path,
    channels.subsystem_name,
    channels.protocol,
    channels.originator_port,
    channels.channel_policy,
    channels.target_addr,
    channels._archive_path,
    channels._close_cleanup,
    channels.dynamic_channel,
    channels.environment,
    channels.session_start,
    channels.remote_username,
    channels.local_port,
    channels.four_eyes_authorizer,
    channels.src_ip,
    channels.session_end,
    channels._archive_server,
    channels.server_port,
    channels.username,
    channels._archive_date,
    channels.server_ip,
    channels.exec_cmd,
    channels._archive_policy,
    channels.four_eyes_description,
    channels.connection_id,
    channels._connection_channel_id,
    channels.rule_num,
    channels.target_port,
    channels.src_port,
    channels.originator_addr,
    channels.auth_method,
    channels.audit,
    channels.local_ip,
    channels.session_id,
    channels.device_name,
    channels.channel_type,
    channels."connection",
    channels.verdict,
    channels.dst_port,
    channels.dst_ip
from channels
where channels.remote_username is not null
and channels.username <> channels.remote_username;

The the usermapped_channels view has the following columns. For details of the different columns, see Connection metadata.

2015-03-20T14:29:15+01:00 demo.example
zorp/scb_ssh[5594]: scb.audit(4):
(svc/5tmEaM7xdNi1oscgVWpbZx/ssh_console:0/ssh):
Closing connection; connection='ssh_console',
protocol='ssh', connection_id='409829754550c1c7a27e7d',
src_ip='10.40.0.28', src_port='39183',
server_ip='10.10.20.35', server_port='22',
gateway_username='', remote_username='example-username',
verdict='ZV_ACCEPT'
			

Querying trail content with the lucene-search function

The lucene_search function allows you to search the content of indexed audit trails for a specific keyword and return the IDs of the channels that contain the search keyword. The lucene_search function requires four parameters:

• search phrase: The keyword or keyphrase you are looking for, for example, a command issued in an SSH session (exit). The keyphrase can contain the following special operators to be used & (AND), | (OR), ! (NOT). Brackets can be used to group parts of the keyphrase.

• beginning_timestamp: The date in UNIX-timestamp format. Only audit trails created after this date will be queried.

• ending_timestamp: The date in UNIX-timestamp format. Only audit trails created before this date will be queried.

For example:

select lucene_search
from lucene_search('root', 1287402232, 1318938150);
       
# Sample output:
(1,2,3,1)
(1 row)

The output of this query is a formatted as the following:

(<channel_id>,<trail_id>,<hits_count>,<rank>)

Alternatively, you can use the following query format that returns a header of the displayed columns, and uses the pipe (|) character for separator:

For example:

select * from lucene_search('tmp',1496885628,1496954028);
channel_id | trail_id | hits_count | rank
-----------------------------+-----
1    | 2    | 3    | 1
(1 row)

The output contains the following columns:

• channel_id: The ID of the channel within the audit trail (an audit trail file can contain audit trails of multiple channels).

• trail_id: Identifies the audit trail using the unique identifier of the session (the _connection_channel_id of the channel for which the audit trail was created).

• hits_count: The number of hits in the audit trail.

• rank: Shows the relevance of the search result on a 0-1 scale, where 1 is the most relevant. Note that on the SPS search page, this information is scaled to 0-5 (and shown graphically with stars).

For details on how to use more complex keyphrases, see the Apache Lucene documentation.

For details of content indexing, see Configuring the internal indexer.

Generating partial reports

The following describes how to generate a report manually for a period that has not been already covered in an automatic report.

To generate a report manually for a period that has not been already covered in an automatic report

1. Log in to the SPS web interface, and navigate to Reporting > Configuration.

   Figure 270: Reporting > Configuration — Configuring custom reports

   

2. Select the report you want to generate.

3. Click any of the following buttons:

   • To create a report from the last daily report till now, click Generate partial daily report. For example, if you click this button at 11:30 AM, the report will include the period from 00:01 to 11:30.

   • To create a report from the last weekly report till now, click Generate partial weekly report. For example, if you click this button on Wednesday at 11:30 AM, the report will include the period from Monday 00:01 to Wednesday 11:30.

   • To create a report from the last monthly report till now, click Generate partial monthly report. For example, if you click this button at 11:30 AM, December 13, the report will include the period from December 1, 00:01 to December 13, 11:30.

   The report will be automatically added in the list of reports (Reporting > Reports), and also sent in an e-mail to the regular recipients of the report.

4. Click .

Creating PCI DSS reports

To help you comply with the regulations of the Payment Card Industry Data Security Standard (PCI DSS), One Identity Safeguard for Privileged Sessions (SPS) can generate reports on the compliance status of SPS. Note that this is not a fully-featured compliance report: it is a tool to enhance and complement your compliance report by providing information available in SPS. The report corresponds with the document Payment Card Industry (PCI) Data Security Standard, Requirements and Security Assessment Procedures, Version 3.0, published by the PCI Security Standards Council.

For details on the contents of the report, see Contents of PCI DSS reports.

To create PCI DSS reports

1. Log in to the SPS web interface, and navigate to Reporting > PCI DSS.

   Figure 271: Reporting > PCI DSS — Generating PCI DSS reports

   

2. By default, members of the report group can access the custom reports via the SPS web interface. To change this, enter the name of a different group into the Reports are accessible by the following groups field, or click to grant access to other groups.

   NOTE: Members of the listed groups will be able to access only these custom reports even if their groups does not have read access to the Reporting > Reports page. However, only those reports will be listed, to which their group has access to.

3. By default, SPS sends out the reports in e-mail to the address set in the Basic Settings > Management > Mail settings > Send reports to field.

   NOTE: If this address is not set, the report is sent to the SPS administrator's e-mail address.

   • To disable e-mail sending, unselect the Send reports in e-mail option.

   • To e-mail the reports to a different address, select Recipient > Custom address, and enter the e-mail address where the reports should be sent. Click to list multiple e-mail addresses if needed.

4. Click .

5. Click Generate report.

   The report will be automatically added in the list of reports (Reporting > Reports), and also sent in an e-mail to the regular recipients of the report.