Chat now with support
Chat with Support

One Identity Safeguard for Privileged Sessions 6.2.0 - Administration Guide

Preface Introduction The concepts of One Identity Safeguard for Privileged Sessions (SPS) The Welcome Wizard and the first login Basic settings
Supported web browsers and operating systems The structure of the web interface Network settings Configuring date and time System logging, SNMP and e-mail alerts Configuring system monitoring on SPS Data and configuration backups Archiving and cleanup Forwarding data to third-party systems Joining to One Identity Starling
User management and access control Managing One Identity Safeguard for Privileged Sessions (SPS)
Controlling One Identity Safeguard for Privileged Sessions (SPS): reboot, shutdown Managing Safeguard for Privileged Sessions (SPS) clusters Managing a High Availability One Identity Safeguard for Privileged Sessions (SPS) cluster Upgrading One Identity Safeguard for Privileged Sessions (SPS) Managing the One Identity Safeguard for Privileged Sessions (SPS) license Accessing the One Identity Safeguard for Privileged Sessions (SPS) console Sealed mode Out-of-band management of One Identity Safeguard for Privileged Sessions (SPS) Managing the certificates used on One Identity Safeguard for Privileged Sessions (SPS)
General connection settings HTTP-specific settings ICA-specific settings RDP-specific settings SSH-specific settings Telnet-specific settings VMware Horizon View connections VNC-specific settings Indexing audit trails Using the Search interface Advanced authentication and authorization techniques Reports The One Identity Safeguard for Privileged Sessions (SPS) RPC API The One Identity Safeguard for Privileged Sessions (SPS) REST API One Identity Safeguard for Privileged Sessions (SPS) scenarios Troubleshooting One Identity Safeguard for Privileged Sessions (SPS) Using SPS with SPP Configuring external devices Using SCP with agent-forwarding Security checklist for configuring One Identity Safeguard for Privileged Sessions (SPS) Jumplists for in-product help LDAP user and group resolution in SPS

Creating report subchapters from search queries

NOTE:

Creating report subchapters from search queries is currently an experimental feature of One Identity Safeguard for Privileged Sessions (SPS), therefore One Identity recommends that only administrators use this feature and only at their own risk.

You can turn any search query or statistics into a subchapter to add to your reports. This is an easy and flexible way of creating reports to monitor traffic, track certain parameters, or get alerted about particular events. The Search interface allows you to:

Creating search-based report subchapters from search results

NOTE:

Creating report subchapters from search queries is currently an experimental feature of One Identity Safeguard for Privileged Sessions (SPS), therefore One Identity recommends that only administrators use this feature and only at their own risk.

The following describes how to create a search-based report subchapter from search results.

To create a search-based report subchapter from search results

  1. Navigate to Search, and perform a query of your choice.
  2. Click Search. Search results are displayed.
  3. Click . The Create reporting subchapter page is displayed, with the query field populated with your query.

  4. In the name field, add a name to your report.
  5. In Report type, select the type that fits your query. You can choose from the following types:
    • Sessions list: Displays a list of sessions.

      Set the number of sessions to show in the report as required.

    • Statistics: Visualizes the distribution of sessions based on the selected metadata.

      Select a Statistic presentation for your report, such as Pie chart, List, Bar chart. Select the field (the metadata) to create your statistics on.

    • Timeline: Visualizes the distribution of sessions within a day/week/month, depending on the time range chosen for the report under Reporting > Configuration > Generate this report every > Day/Week/Month.
  6. Click Save.
  7. Click . Alternatively, navigate to Reporting > Configuration.
  8. Configure a custom report from scratch, or add the subchapter to an existing report. For details, see Configuring custom reports.

    When adding the subchapter you created, look for it under Search-based subchapters.

Creating search-based report subchapters from scratch

NOTE:

Creating report subchapters from search queries is currently an experimental feature of One Identity Safeguard for Privileged Sessions (SPS), therefore One Identity recommends that only administrators use this feature and only at their own risk.

The following describes how to create a search-based report subchapter from scratch.

To create a search-based report subchapter from scratch

  1. If you have multiple SPS appliances and they are organized into a cluster where one of the nodes is the Search Master (or Central Search) node, log in to that node.

  2. Navigate to Reporting > Search subchapters.
  3. Click . The Create reporting subchapter page is displayed.

    Figure 256: Reporting > Search subchapters — Create reporting subchapter

  4. In the name field, add a name to your report.
  5. In the query field, type the query that you want to create a report from.
  6. In Report type, select the type that fits your query. You can choose from the following types:
    • Sessions list: Displays a list of sessions.

      Set the number of sessions to show in the report as required.

    • Statistics: Visualizes the distribution of sessions based on the selected metadata.

      Select a Statistic presentation for your report, such as Pie chart, List, Bar chart. Select the field (the metadata) to create your statistics on.

    • Timeline: Visualizes the distribution of sessions within a day/week/month, depending on the time range chosen for the report under Reporting > Configuration > Generate this report every > Day/Week/Month.
  7. Click Save.
  8. Click . Alternatively, navigate to Reporting > Configuration.
  9. Configure a custom report from scratch, or add the subchapter to an existing report. For details, see Configuring custom reports.

    When adding the subchapter you created, look for it under Search-based subchapters.

Creating statistics from custom database queries

The following describes how to create statistics from any custom queries from the One Identity Safeguard for Privileged Sessions (SPS) connection database. These custom statistics can be added to regular reports.

Caution:

Hazard of denial of service (DoS). This feature of SPS allows the user to execute read-only queries on the database of SPS. If the database is large (stores the data of many connections), and the query is not optimal, executing the query can consume significant CPU and memory resources, severely degrading the performance of SPS. Use this feature only if you possess the required knowledge about SQL queries.

To create statistics from any custom queries from the SPS connection database

  1. Navigate to the Reporting > Advanced statistics page and click .

  2. Enter a name for the statistics. The created statistics will be available for reports under this name as a subchapter.

  3. Enter the SQL query that returns the data you need into the Query field. Note the following important points:

    • The query must be a full PostgreSQL query.

    • SQL queries used for pie and bar charts must return a title and a cnt column, in this order. For example:

      select
        remote_username as title,
        count(*) as cnt
      from channels
      group by title
    • The query can be executed on the database tables and views that contain metadata about the audited connections, as well as the content of the audited connections (for example, the commands executed in a session) if indexing is used. Note that these tables do not contain any data from the upstream traffic, that is, passwords entered by the users are not available in the database.

    • Limit the query to avoid unnecessarily long results, for example, LIMIT = 5000. Note that SPS automatically limits the results to 10000 entries (this is a hard limit, you cannot increase it).

      Caution:

      Generating a report that includes an Advanced statistics chapter that returns several thousands of entries requires significant CPU and memory resources from One Identity Safeguard for Privileged Sessions (SPS). While generating such a partial report, the web interface of SPS can become slow or unresponsive.

    • The structure of the accessible tables may change in future versions of SPS. For details about the tables and their contents, see Database tables available for custom queries.

    The query can include the following macros: :range_start, :range_end. When including the statistics in a report, these macros will refer to the beginning and end dates of the reported interval. When clicking Preview, the macros will refer to the start and end of the current day.

    Example

    The following query generates a list of audit trail downloads within the reported interval (using standard date formatting), excluding administrator downloads:

    Example

    select
      to_timestamp(audit_trail_downloads.download_time),
      audit_trail_downloads.username, 
      channels.channel_type,
      channels.connection,
    from audit_trail_downloads,
         channels
    where channels._connection_channel_id = audit_trail_downloads.id
    and audit_trail_downloads.download_time >= :range_start
    and audit_trail_downloads.download_time < :range_end
    and audit_trail_downloads.username != 'admin'
    order by audit_trail_downloads.download_time;

    Figure 285: Reporting > Advanced statistics — Creating custom database queries

  4. Select the type of chart to display, that is, Bar, Pie or List.

    • For bar charts, enter the name of the Y axis into the Y axis title field.

    • For lists, you can customize the name of the columns in the list by clicking and entering the name of the column into the Column titles field.

  5. Click Preview to test the query.

  6. (Optional) By default, users of the search group can add these statistics to reports. To specify other groups, select Subchapter is accessible by the following groups and click .

    NOTE:

    Accessing advanced statistics subchapters requires the Reporting > Advanced statistics privilege.

  7. Click Commit to save the query.

  8. Add this new subchapter to a report. For details on how to add this subchapter to a selected report, see Configuring custom reports

Related Documents