Chat now with support
Chat with Support

Identity Manager Data Governance Edition 8.0.1 - User Guide

Introduction Data Governance navigation node and views Administering Data Governance Edition Managing unstructured data access
Managing resource access Managing account access Working with security permissions Working with SharePoint security permissions Account access modeling Bringing data under governance
Classifying governed resources Managing governed resources using the web portal Data Governance Edition reports Troubleshooting Appendix: EMC, NetApp Filer, and SharePoint configuration details Appendix: PowerShell commands Appendix: Governed data attestation policies Appendix: Governed data company policies Appendix: Governed data risk index functions About us

Data Governance agent deployment

NetApp filers are added to a Data Governance Edition deployment as managed hosts with remote agents. When selecting an agent for scanning a NetApp filer, take the following into consideration:

  • The remote agent must be hosted on a machine in the same domain as the NetApp filer device.

    Note: If you host a remote agent in an external domain to monitor a filer, the agent will NOT record the resource activity data.

  • There should be a good network connection between the NetApp filer and the monitoring agent servers.
  • The machine hosting the agent for NetApp can host agents for other servers, but those servers should be close to the agent host.
  • If the NetApp is split up into multiple domains, you must deploy one or more agents for each domain.

FPolicy deployment

FPolicy is required for Data Governance Edition to capture real-time security updates and to collect resource activity. In order to use FPolicy on NetApp 7-Mode managed hosts, CIFS file system protocol must be enabled.

When adding a NetApp 7-Mode managed host, you can choose to use one of the following for FPolicy deployment:

  • automatic FPolicy deployment
  • use a pre-created FPolicy

However, for NetApp Cluster Mode managed hosts, FPolicy deployment is always automatic.

Using automatic FPolicy deployment for NetApp 7-Mode

When you add a NetApp managed host, an FPolicy is created if either of the following managed host settings are enabled:

  • Collect activity for real-time security updates on the Security Scanning page
  • Collect and aggregate events on the Resource Activity page

When you deploy an agent, an empty FPolicy (with no monitored operations) is created by the Data Governance server (performed as the service account for the domain). When the agent starts, it registers with the FPolicy as an FPolicy Server. At the point of registration, the agent will register the operations it will monitor.

Note: If another agent is added to the managed host to index a separate root on the NetApp device, a new FPolicy will be created (named after the new agent ID).

The FPolicy:

  • is created using the credentials of the domain service account.
  • is named after the agent ID (that is, DGE_ <DeploymentName>_<FQDN of managed host>).
  • is configured to use the version 2 interface.
  • includes cifs_set_attr information, which allows Data Governance Edition to receive notification of security changes.
  • sets the cifs_setattr option to on (defaults to off in FPolicy).

  • is asynchronous.

Note: To view all the existing FPolicies on a NetApp device, establish a Telnet or SSH connection to the filer device, log in and type the following at the OnTap command line: “fpolicy”.

Note: When you remove an agent, the FPolicy is deleted.

Using a pre-created FPolicy on a NetApp 7-Mode filer

Data Governance Edition can be configured to connect to a pre-created FPolicy. The following steps are required to configure Data Governance Edition to use a manually created FPolicy instead of automatic deployment:

  • Enable CIFS FPolicy on NetApp filer
  • Create FPolicy on the filer
  • Configure the Data Governance server and agent

To enable CIFS FPolicy on a NetApp filer

  • Run options FPolicy.enable on

To create FPolicy on the filer

  • fpolicy create <PolicyName> Screen
  • fpolicy enable <PolicyName>

To configure the Data Governance server and agent

  1. Configure the Data Governance server to prevent the creation of FPolicy on the required NetApp filer:

    1. Create the following registry key: “HKEY_LOCAL_MACHINE\SOFTWARE\One Identity\Broadway\Server\ManualFPolicyCreation”.
    2. Add a string value with the fully qualified domain name of the NetApp filer.

  2. In the Manager, deploy a NetApp managed host.

    Note: Ensure that the registry key has been created on the server before deploying the agent.

  3. Configure the NetApp agent to use the manually pre-created FPolicy.
    1. Stop the agent service.

    2. Locate the following configuration setting in the %Program Files%\One Identity\One Identity Manager Data Governance Edition\Agent Services\DataGovernance.Agent.exe.config file.

      <"Agent">

        <"Services">

          <"ChangeMonitoring">

            <Setting name="OverrideFPolicyName">

    3. Add a string value with the FPolicy name you want the specified agent to register with.
    4. Save the configuration file.
    5. Restart the agent.

FPolicy deployment for NetApp Cluster Mode

FPolicy deployment for NetApp Cluster Mode is always automatic and is done by the agent at run time because of the use of dynamic ports. The FPolicy will be deleted when the agent stops. You cannot specify a pre-created FPolicy.

Managed host configuration options

During the configuration of the managed host:

  • Select the required shares (managed paths) to scan.
  • (Optional) Select to Collect activity for real-time security updates.
  • (Optional) Select to Collect and aggregate resource activity.

When you add an agent, the managed host properties impact whether FPolicy is deployed, and what properties are set within the FPolicy itself:

  • If both Collect activity for real-time security updates and Collect and aggregate activity are disabled on the managed host, FPolicy will not be created when the agent is deployed.
  • If Collect activity for real-time security updates or Collect and aggregate activity is enabled, FPolicy will be created; however, there will be no registered settings until the agent starts up and receives the updated settings from the Data Governance servers.
  • The agent must start its security scan before it registers with FPolicy. This means that managed paths must be set and the agent must hit its configured scanning schedule. (To force this scan, select the Immediately scan on agent restart or when managed paths change option and restart the agent.)
Monitored events

The following events are tracked on files and folders, as well as the identities associated with those events, when real-time security updates and/or resource activity collection is enabled:

  • File create
  • File rename
  • File delete
  • File write
  • File open
  • Setattr (Security changes including DACL, and Owner changes)
  • Directory rename
  • Directory delete
  • Directory create

Performance considerations

Enabling FPolicy on NetApp filers may impact system performance. Data Governance Edition uses 'async' mode and does not inspect any file data to try and minimize the performance impact. However, every event does require a round trip network request between the NetApp filer and the Data Governance agent.

Are rescans of all directory structures required to detect change?

To have Data Governance Edition watch for security changes, real-time security updates must be enabled. That is, select the Collect activity for real-time security updates option at the bottom of the Security Scanning page on the Managed Hosts Settings dialog for the target managed host. This will cause the FPolicy to be deployed and the security index to be updated when changes to the structure and security of the file system on the target managed host occur.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating