XYGATE Merged Audit Reference Manual

XYGATE Merged Audit
®
Reference Manual
Glossary
XYPRO Technology Corporation 316 Proprietary and Confidential
RUNCMD Filter Keyword
This ACTIONTYPE allows you to run custom processes. This would include any
process which can be executed from TACL (non-block-mode).
You should always set the MAXCOMPLETIONTIME for RUNCMD ACTIONTYPEs;
otherwise, the MOVER may not move on to process subsequent audit records.
All of the processing to take place must appear between the keywords
RUNCMDDEFBEGIN and RUNCMDDEFEND. The information in the structure
TCLEXC is available during the execution of any custom processing you specify. Refer
to Appendix E: “XMA Host Macros” starting on page 203 for more information on this
structure.
SETDATA Filter Keyword
This ACTIONTYPE enters the defined string in the USER_DATA column of the Audit
Detail table when an event matching the selection criteria of the Filter is detected. The
string can be a maximum of 16 characters.
You can use the contents of the column as selection criteria for running reports, but
you cannot use it as Filter selection criteria because it is the Filter itself that will add
the data to the column.
Syntax:
ACTION_BEGIN
ACTIONTYPE SETDATA
AUDIT.USER_DATA <string>
ACTION_END
Example:
ACTION_BEGIN
ACTIONTYPE SETDATA
AUDIT.USER_DATA SFG-Config
ACTION_END
This example will place the string "SFG-Config" in the USER_DATA column of the
Audit Detail table whenever an audit record matching the Filter’s selection criteria is
detected. In this case, the Filter is selecting Safeguard audit events that reflect
changes to the Safeguard configuration.
SFGMOVE File
SFGMOVE is the object file for the Safeguard MOVERs. The program reads
Safeguard audit records, using the XYGATESR program to normalize the data in
preparation for adding it to the XMA database.
SIEM
Security Information and Event Management.