XYGATE Merged Audit Reference Manual

XYPRO Technology Corporation 239 Proprietary and Confidential
Appendix G: Data Mapping
Data Selection Criteria is used to select audit events based on the contents of the
normalized audit data record. Every column that is utilized for a given target product is
available for generating an ACTION in a Filter.
Data selection criteria is based entirely on the product whose audit trail the MOVER is
reading.
The MOVERs normalize the data for each record in their target product’s audit trail,
which means that they move the contents of each field to the appropriate columns for
insertion in the XMA database.
• Refer to section 3.3, “Building a Filter” starting on page 44 for information about
building Filters.
• Refer to Appendix G24: “Column Usage Table” on page 299 to see which columns
are used for each product.
• Refer to the appropriate XYGATE product manual for additional information
regarding their audit trails.
The technique for creating a Filter is finding the field(s) in the audit record that makes
the event you are interested in, unique. For example, if you want to generate an email
every time a user invokes a specific XAC command, it is the command name that
makes the relevant XAC audit records unique. You would use the XAC data mapping
table described in Appendix G12: “XYGATE Access Control (XAC) Data Mapping” on
page 274 to determine which column contains the command name.
If you check the table now, you will see that the XAC command names are placed in
both the RULENAME column and the OBJECTNAME column of the AUDIT detail
table. You could choose either column for your Filter.
If you wanted to view access attempts for a particular file, you would look at the XOS
or Safeguard data mapping tables to determine which field contains the filename. In
this case, both products place the filename in the OBJECTNAME column of the AUDIT
detail table.