Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 7.0.5.1 LTS - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS)
The philosophy of One Identity Safeguard for Privileged Sessions (SPS) Policies Credential Stores Plugin framework Indexing Supported protocols and client applications Modes of operation Connecting to a server through One Identity Safeguard for Privileged Sessions (SPS) Archive and backup concepts Maximizing the scope of auditing zIPv6 in One Identity Safeguard for Privileged Sessions (SPS) SSH host keys Authenticating clients using public-key authentication in SSH The gateway authentication process Four-eyes authorization Network interfaces High Availability support in One Identity Safeguard for Privileged Sessions (SPS) Versions and releases of One Identity Safeguard for Privileged Sessions (SPS) Accessing and configuring One Identity Safeguard for Privileged Sessions (SPS)
Cloud deployment considerations The Welcome Wizard and the first login Basic settings
Supported web browsers and operating systems The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving Using plugins Forwarding data to third-party systems Starling integration
User management and access control Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing One Identity Safeguard for Privileged Sessions (SPS) clusters Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings MSSQL-specific settings RDP-specific settings SSH-specific settings Using Sudo with SPS Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search interface Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS)
Network troubleshooting Gathering data about system problems Viewing logs on One Identity Safeguard for Privileged Sessions (SPS) Changing log verbosity level of One Identity Safeguard for Privileged Sessions (SPS) Collecting logs and system information for error reporting Collecting logs and system information of the boot process for error reporting Support hotfixes Status history and statistics Troubleshooting a One Identity Safeguard for Privileged Sessions (SPS) cluster Understanding One Identity Safeguard for Privileged Sessions (SPS) RAID status Restoring One Identity Safeguard for Privileged Sessions (SPS) configuration and data VNC is not working with TLS Configuring the IPMI from the BIOS after losing IPMI password Incomplete TSA response received Using UPN usernames in audited SSH connections
Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help Configuring SPS to use an LDAP backend Glossary

Creating search-based report subchapters from search results

You can turn any search query or statistics into a subchapter to add to your reports. This is an easy and flexible way of creating reports to monitor traffic, track certain parameters, or get alerted about particular events.

To create a search-based report subchapter from search results

  1. Navigate to Search, and perform a query of your choice.

  2. Click Search. Search results are displayed.

  3. Click Create report. The Create new subchapter page is displayed, with the Query field populated with your query. If the Query field is not populated, enter a valid search query.

    Figure 304: Search > Create report - Example subchapter created from search results with Query field populated

  4. In the Name field, add a name to your report.

  5. In Subchapter type, select the type that fits your query. You can choose from the following types:
    • Sessions list: Displays a list of sessions.

      Set the number of sessions to show in the report as required.

    • Timeline: Visualizes the distribution of sessions within a day/week/month, depending on the time range chosen for the report under Reporting > Configuration > Generate this report every > Day/Week/Month.
    • Statistics: Visualizes the distribution of sessions based on the selected metadata.

      Select a Statistic presentation for your report, such as List, Pie chart, or Bar chart. Select the field (the metadata) to create your statistics on.

  6. To add the subchapter to an existing report, click Add to a report and select from the list of available reports.

    Alternatively, to configure a custom report from scratch, click Include in a new report. For more information, see Configuring custom reports.

Creating search-based report subchapters from scratch

The following describes how to create a search-based report subchapter from scratch.

To create a search-based report subchapter from scratch

  1. If you have multiple SPS appliances and they are organized into a cluster where one of the nodes is the Search Master (or Central Search) node, log in to that node.

  2. Navigate to Reporting > View & edit subchapters > Search-based.
  3. Click Create new. The Create new subchapter page is displayed.

    Figure 305: Reporting > View & edit subchapters > Search-based — Create new subchapter

  4. In the Name field, add a name to your report.
  5. In the Query field, type the query that you want to create a report from.
  6. In Subchapter type, select the type that fits your query. You can choose from the following types:
    • Sessions list: Displays a list of sessions.

      Set the number of sessions to show in the report as required.

    • Timeline: Visualizes the distribution of sessions within a day/week/month, depending on the time range chosen for the report under Reporting > Configuration > Generate this report every > Day/Week/Month.
    • Statistics: Visualizes the distribution of sessions based on the selected metadata.

      Select a Statistic presentation for your report, such as List, Pie chart, or Bar chart. Select the field (the metadata) to create your statistics on.

  7. Click Save.
  8. Click . Alternatively, navigate to Reporting > Create & Manage Reports.
  9. Configure a custom report from scratch, or add the subchapter to an existing report. For more information, see Configuring custom reports.

    When adding the subchapter you created, look for it under Reporting > View & edit subchapters > Search-based.

Database tables available for custom queries

This section describes the database tables, views, and functions of One Identity Safeguard for Privileged Sessions (SPS). Generally, views contain a more organized dataset, while tables contain the raw data.

NOTE: The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions.

Table 12: Database tables and views for custom queries
Database table Type Description
alerting table The list of alerting events. For details, see The alerting table.
aps table [OBSOLETE] The list of Audit Player indexing services that are available for SPS. For details, see The aps table.
archives table Data about the archiving processes. For details, see The archives table.
audit_trail_downloads table Data about the audit trail downloads. For details, see The audit_trail_downloads table.
channels table Contains metadata about the channel-opening requests and opened channels. This is the main table storing data about the connections. For details, see The channels table.
closed_connection_audit_channels view This view returns all audited channels whose connection have been closed. For details, see The closed_connection_audit_channels view.
closed_not_indexed_audit_channels view This view returns all audited channels whose connection have been closed, but have not been indexed yet. For details, see The closed_not_indexed_audit_channels view.
connection_events view List of commands or window titles detected in the connections. For details, see The connection_events view.
connection_occurrences view Contains the tokens that are used as search keywords in Content subchapter reports (reports from audit-trail content) and where these tokens appear in the audit trails. For details, see The connection_occurrences view.
connections view A view containing data of the connections. This data is identical to the information available on the Search page. For details, see The connections view.
events table The commands or events extracted from the indexed audit trails. For details, see The events table.
file_xfer table Data about the files transfered in the audited connections (SCP, SFTP). For details, see The file_xfer table.
http_req_resp_pair table Information about the requests and responses in HTTP and HTTPS sessions. For details, see The http_req_resp_pair table.
indexer_jobs table Information and statistics about indexer jobs. For details, see The indexer_jobs table.
occurrences table Contains the tokens that are used as search keywords in Content subchapter reports (reports from audit-trail content) and where these tokens appear in the audit trails. For details, see The occurrences table.
progresses table [OBSOLETE] Which audit trail is assigned to which Audit Player for processing. For details, see The progresses table.
results table Contains the tokens that are used as search keywords in Content subchapter reports (reports from audit-trail content) and in which audit trails were these tokens found. For details, see The results table.
skipped_connections table List of errors encountered when processing audit trails. For details, see The skipped_connections table.
usermapped_channels view Information about sessions where usermapping was performed in the connection. For details, see The usermapped_channels view.
Detailed information about this topic

The alerting table

NOTE: The structure of these database tables may change in future One Identity Safeguard for Privileged Sessions (SPS) versions.

Table 13: Columns of the alerting table
Column Type Description
alerting_time timestamp The timestamp of the alert.
alerting_type text The type of the alert.
channel_id integer This value is a reference to the ID of the channels table where the event occurred.
matched_content text The matched content.
matched_regexp text The matched regular expression.
rule_name text The name of the content policy rule.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating