The following describes how to create statistics from any custom queries from the One Identity Safeguard for Privileged Sessions (SPS) connection database. These custom statistics can be added to regular reports.

Caution: Hazard of denial of service (DoS). This feature of SPS allows the user to execute read-only queries on the database of SPS. If the database is large (stores the data of many connections), and the query is not optimal, executing the query can consume significant CPU and memory resources, severely degrading the performance of SPS. Use this feature only if you possess the required knowledge about SQL queries.

To create statistics from any custom queries from the SPS connection database

1. Navigate to the Reporting > View & edit subchapters > Advanced statistics page and click Create new.

2. Enter a name for the statistics. The created statistics will be available for reports under this name as a subchapter.

3. Enter the SQL query that returns the data you need into the Query field. Note the following important points:

   • The query must be a full PostgreSQL query.

   • SQL queries used for pie and bar charts must return a title and a cnt column, in this order. For example:

     select
       remote_username as title,
       count(*) as cnt
     from channels
     group by title

   • The query can be executed on the database tables and views that contain metadata about the audited connections, as well as the content of the audited connections (for example, the commands executed in a session) if indexing is used. Note that these tables do not contain any data from the upstream traffic, that is, passwords entered by the users are not available in the database.

   • Limit the query to avoid unnecessarily long results, for example, LIMIT = 5000. Note that SPS automatically limits the results to 10000 entries (this is a hard limit, you cannot increase it).

     Caution: Generating a report that includes an Advanced statistics chapter that returns several thousands of entries requires significant CPU and memory resources from One Identity Safeguard for Privileged Sessions (SPS). While generating such a partial report, the web interface of SPS can become slow or unresponsive.

   • The structure of the accessible tables may change in future versions of SPS. For details about the tables and their contents, see Database tables available for custom queries.

   The query can include the following macros: :range_start, :range_end. When including the statistics in a report, these macros will refer to the beginning and end dates of the reported interval.

   Example

   The following query generates a list of audit trail downloads within the reported interval (using standard date formatting), excluding administrator downloads:

   Example

   select
     to_timestamp(audit_trail_downloads.download_time),
     audit_trail_downloads.username, 
     channels.channel_type,
     channels.connection,
   from audit_trail_downloads,
        channels
   where channels._connection_channel_id = audit_trail_downloads.id
   and audit_trail_downloads.download_time >= :range_start
   and audit_trail_downloads.download_time < :range_end
   and audit_trail_downloads.username != 'admin'
   order by audit_trail_downloads.download_time;

   Figure 345: Reporting > View & edit subchapters > Advanced statistics — Creating custom database queries

   

4. Select the type of chart to display, that is, Session list, Pie chart, or Bar chart.

   • For the Session list, you can customize the name of the columns in the list by entering the name of the columns into the Column titles field.

   • (Optional) By default, users of the search group can add these statistics to reports. To specify other groups, select Subchapter is accessible by the following groups and click .

   • For Bar chart, enter the name of the Y axis into the Y axis title field.

5. Add this new subchapter to a report.

   NOTE: Accessing advanced statistics subchapters requires the Reporting > Advanced statistics privilege.

   For more information on how to add this subchapter to a selected report and assign privileges, see Configuring custom reports