XYGATE Merged Audit Reference Manual

XYGATE Merged Audit
®
Reference Manual
Chapter 3. Configuring Filters and the FILTERS File
XYPRO Technology Corporation 52 Proprietary and Confidential
In Example 2 above, if the RULENAME column in the AUDIT DETAIL Table contains
the value FUP-255, TACL-255, or SAFECOM-255 and the MESSAGECODE column in
the AUDIT DETAIL Table contains “XAC-I,” then a value of MATCH will be returned.
TCLEXC
The structure TCLEXC is used when the DATAFILTERTYPE = MACROFILTER is
specified. It contains information from the Audit Session, Audit Detail, Installation, and
Product tables for the record currently being examined for filtering purposes. The data
in this structure is also available for use when the ACTIONTYPE RUNCMD is
specified. The TCLEXC file resides in the XMA subvolume on the pathway node. Refer
to Appendix F: “TCLEXC” starting on page 227 for more information.
Choosing Selection Criteria for Monitoring Logons
Say that you want to generate an email whenever anyone logs on. You would create a
Filter with an ACTIONTYPE of MAIL. The MOVER would be Safeguard or XYGATEUA
because you are monitoring logons. For this example we will use Safeguard. The data
selection criteria that makes a logon event unique is the OPERATION. When someone
logs on, Safeguard creates audit records with an OPERATION of VERIFYUSER.
Because you want to monitor all logons, OPERATION is all the selection criteria that
you need. XMA will generate an email every time anyone logs on, regardless of what
ID they logon to and whether or not they are successful.
DATA_SELECT_BEGIN
FILTERTYPE STRINGFILTER
AUDIT.OPERATION = VERIFYUSER
DATA_SELECT_END
But now you are inundated with emails for successful logons, so you rethink your
strategy and decide that you really only need to monitor failed logons in real time and
that you would rather generate a daily report of all logons. Now you need to add a
second criteria to select only failed logons. What makes a failed logon unique is the
OUTCOME of 3, which means failed. Now XMA will generate an email every time
anyone attempts to logon but fails. All logons, whether successful or not, will still be
written to the XMA database.
DATA_SELECT_BEGIN
FILTERTYPE STRINGFILTER
AUDIT.OPERATION = VERIFYUSER
AUDIT.OUTCOME = 3
DATA_SELECT_END
You might decide that you only want to be notified when a userid is frozen because of
incorrect passwords. What makes this event unique is text in the RESULT column,
which will contain something like the following:
WRONG-PASSWORD Logon Fail count 2 to 3