Configuring your Guardium system

You can configure several aspects of your Guardium system to enable you to meet your business goals effectively and efficiently.

System Configuration
Most of the information on the System Configuration panel is set by using the CLI at installation time.
Managing data: archive, restore, aggregation, and system backup
Establish data retention practices; control activity volume; manage scheduling of data archive and purge, and monthly backups.
Internet Protocol modes
Configure Guardium® to run in a traditional IPv4-only environment, an IPv6-only environment, or in dual mode where the system supports both IPv4 and IPv6 addresses.
Network mirroring methods (SPAN , N-TAP) and related inspection engines
This configuration is used in cases where an S-TAP® cannot be installed in the host where the database instances to be monitored are run. Instead, you can direct a copy of the network traffic that goes to the host running the database servers, to a Guardium collector. This method only captures network traffic, not local traffic within the database server host. The limitations are listed further on in this section. IBM strongly encourages you to use an S-TAP instead.
Configuring inspection engines
An inspection engine extracts SQL from network packets; compiles parse trees that identify sentences, requests, commands, objects, and fields; and logs detailed information about that traffic to an internal database.
Configuring the Guardium portal
From the Guardium Portal page, you can reset the port for the Guardium appliance web server, import SSL certificates, and configure authentication for your Guardium system users.
Managing the TLS version
You can disable TLS 1.0/1.1, and enable TLS 1.2 on all appliances, S-TAP agents, CAS and GIM clients.
Global profile
The Global Profile page defines defaults that apply to all users.
Configuring the alerter
Configure and activate the alerter to send email messages, SNMP traps, and alert-related Syslog messages.
Facility and priority of syslog messages
The facility and priority of messages configured in the Guardium syslog can impact how they are consumed by the Security Incident Event Manager (SIEM).
Anomaly Detection
The Anomaly Detection process runs every polling interval to create and save, but not send, correlation alert notifications that are based on an alert's query.
Session Inference
Session Inference checks for open sessions that have not been active for a specified period of time, and marks them as closed.
Allow (approve) S-TAP connection to Guardium (S-TAP certification)
Use this function to control the specific S-TAP hosts whose clients are allowed ("approved") to access the Guardium system.
IP to Hostname Aliasing
The IP-to-Hostname Aliasing function accesses the Domain Name System (DNS) server to define hostname aliases for client and server IP addresses.
Configure Permission to Socket connection
This topic applies to Custom Alerting Classes.