Handbook (HTML)

• Introduction
• What’s new
• FortiDB tutorials
  • Tutorial: Generating a vulnerability assessment (VA) report
  • Tutorial: Monitoring a database table using the TCP/IP sniffer
  • Tutorial: Monitoring a database table using the native auditing feature
  • Tutorial: Monitoring changes to metadata
  • Tutorial: Generating PCI, SOX, and HIPAA compliance reports
• Installation (software-only)
  • System requirements
  • Preparing to install
  • Configuring the FortiDB repository database
    • Configuring a PostgreSQL repository
    • Configuring an Oracle repository
    • Configuring an Microsoft SQL Server repository
  • UNIX/Linux installation
  • Windows installation
  • Confirming the installation
  • Starting or stopping FortiDB
  • Installing a new license
  • Managing disk space
  • FortiDB files and folders
  • Log files for troubleshooting
  • Upgrading FortiDB
• How to set up your FortiDB
  • Registering your FortiDB
  • Planning the network topology for database activity monitoring (DAM)
  • Connecting to the web UI and CLI
  • Updating the firmware
    • Upgrading the firmware
    • Installing firmware
  • Changing the "admin" account password
  • Setting the system time
  • Configuring the network settings
    • Configuring network settings using the web UI
    • Configuring network settings using the CLI
• Backups
• Administrators
  • Configuring permissions
  • Privileges by license type (software-only )
  • Viewing and exporting an administrator report
  • FortiMonitor administrator
• Advanced/optional system settings
  • System information and settings
  • Changing the FortiDB host name
  • Global configuration
    • Assessment properties
    • Notification properties
    • Reporting properties
    • User Profile/Security properties
    • Target properties
    • LDAP Server properties
    • Monitor properties
• Connecting to target databases
  • Pre-configuration for monitoring target databases
    • Network requirements for monitoring using the TCP/IP sniffer
    • Oracle target database pre-configuration
      • Configuring an Oracle database for PCI, SOX, and HIPAA policies
      • Enabling to delete audit records
      • Oracle XML file agent installation and configuration (UNIX, Windows, AIX)
      • Monitoring encrypted Oracle traffic
      • Using the SYSLOG utility to collect audit data
    • MySQL target database pre-configuration
      • Required privileges for monitoring via SQL Trace
    • Sybase target database pre-configurations
      • Configuring the Sybase Monitoring and Diagnostic (MDA) tables
    • DB2 target database pre-configuration
      • Configuring the DB2 database and installing the agent
    • Microsoft SQL Server target database pre-configuration
  • Privileges required by the database user
    • Privileges for VA assessments, privilege summaries, and penetration tests
    • Privileges for monitoring data
    • Privileges for monitoring privileges
    • Privileges for monitoring metadata
  • Managing targets
    • Searching or filtering the target list
  • Adding (or modifying) a target connection
    • Configuring DB2 options
    • Configuring SSH connections to Oracle and DB2 databases
    • SSH environment requirements (software-only version)
    • Enabling operating system vulnerability assessment (OSVA) for Solaris and AIX
  • Exporting target information
  • Importing targets
  • Managing target groups
  • Pre-defined target groups
  • Adding or modifying a target group
  • Auto-discovery
    • How to discover DB2 databases
    • How to discover Microsoft SQL Server
    • Running auto-discovery
    • Adding targets from auto-discovery
• Vulnerability assessment (VA) policies
  • Types of VA policies
  • Updates to VA policies
  • Exporting and importing VA policies
  • VA policy version
  • VA policy groups
  • VA policy states
  • Keywords and user keywords for VA policies
  • Managing VA pre-defined policies
    • Importing pre-defined policies (appliance)
    • Importing pre-defined policies (software-only )
    • OS-Level pre-defined policies
      • Setting an access control list (ACL) for minimally-privileged users
  • VA user-defined policies
    • Adding user-defined policies
    • Deleting user-defined policies
    • Exporting user-defined policies
    • Importing user-defined policies
  • VA policy groups
    • Adding VA policy groups
    • Modifying VA policy groups
    • Deleting VA policy groups
  • Penetration tests
    • Connection options for penetration tests
    • Files used for penetration tests
    • Configuring and running penetration test assessments
  • Data discovery policies and policy groups
• Database Activity Monitoring (DAM) policies
  • Types of DAM policies
  • Managing DAM policies
    • Configuring policy information for a policy
  • Automatically generating alert policies
  • Data policies
    • Configuring a table policy
      • Configuring audit settings for a table policy
      • Configuring alert rules for a table policy
      • Table policy alert rules for different databases
    • Configuring a table and column policy
    • Configuring a session policy
      • Configuring audit settings for a session policy
      • Configuring alert rules for a session policy
    • Configuring a user policy
      • Configuring audit settings for a user policy
      • Configuring alert rules for a user policy
      • User policy alert rules for various databases
    • Configuring a database policy
    • Configuring a database query policy
  • Privilege policies
    • Oracle privilege policies
    • Microsoft SQL Server privilege policies
    • Sybase privilege policies
    • DB2 privilege policies
    • MySQL privilege policies
  • Metadata policies
    • Oracle metadata policies
    • Microsoft SQL Server metadata policies
    • Sybase metadata policies
    • DB2 metadata policies
    • MySQL metadata policies
  • PCI, SOX, and HIPAA alert policies
    • Configuring PCI, SOX and HIPAA policies
    • Selecting which tables tracks for PCI, SOX and HIPAA reports (Object Audit Options)
    • Select users to audit for PCI and SOX reports (User Audit Options)
  • Alert and audit policy groups
    • Creating or modifying an alert or audit policy group
    • Adding policy groups to target database monitoring
    • Deleting a policy group
• Vulnerability assessment
  • Adding or modifying assessments
    • Running assessments
    • Configuring assessment notifications
      • Notification OIDs for target-level assessments
      • Notification OIDs for Rule-Level Assessments
    • Selecting the type of report an assessment generates
    • Reviewing, deleting, and aborting assessment results
  • View VA global summary information
  • Assessment history
  • Viewing and exporting a privilege summary
    • DB-Type Distinctions
  • Sensitive data discovery
  • Viewing VA and sensitive data discovery event logs
• Database activity monitoring (DAM)
  • Managing target monitoring
  • Target monitoring configuration tabs and options
  • Configuring target database monitoring
    • Configuring monitoring using the TCP/IP sniffer (all database types)
    • Configuring Microsoft SQL Server monitoring
    • Configuring DB2 monitoring
    • Configuring Sybase monitoring
    • Configuring MySQL monitoring
    • Configuring Oracle monitoring
  • Adding alert and audit policies to monitoring
  • Adding policy groups to target monitoring
  • Sending alert notifications
    • FortiDB event to ArcSight data field mapping
  • Blocking invalid access while monitoring
  • Excluding policies from the Alert Policy settings (whitelist)
  • Displaying the history of issued audit commands
    • Oracle audit management
    • Microsoft SQL Server audit management
    • DB2 audit management
  • Viewing alerts
    • Changing the status of and annotating alerts
    • Exporting the alert list as a report
    • Filtering and searching alerts
    • Alert details
  • Alert group
  • Alerts summary
  • Alerts analysis
  • Viewing audit records (activity auditing results)
    • Filtering and searching the audit record list
    • Viewing audit record details
  • Audit group
  • Activity profiling
    • Viewing status and summary information for activity profiling
    • Viewing and exporting activity profiling results
  • SOX audit
• Logs
  • Local audit trail
    • Viewing and managing the audit trail records
    • Examples of audit trail records
• Reports
  • Pre-defined VA reports
    • Assessment reports
    • Policy reports
    • Sensitive data discovery reports
  • User-defined VA reports
    • Managing user-defined reports
  • Viewing scheduled VA reports
  • Pre-defined DAM reports
  • User-defined DAM reports
    • Report management
    • Filtering report data
    • Configuring data displays
    • Schedule and notification
  • PCI, SOX, and HIPAA reports
    • General steps for generating PCI, SOX, and HIPAA reports
    • Report: Abnormal Termination of Database Activity
    • Report: Abnormal or Unauthorized Changes to Data
    • Report: Abnormal Use of Service Accounts
    • Report: End of Period Adjustments
    • Report: History of Privilege Changes
    • Report: Verification of Audit Settings
  • Activity Profiling Reports
• Archiving audit data
• Using the command line interface (CLI)
  • Connecting to the CLI
  • Command syntax
  • Tips & tricks
  • Overview of commands
  • config
    • config system admin setting
    • config system backup all-setting
    • config system debug-filter
    • config system dns
    • config system global
    • config system interface
    • config system mapping
    • config system ntp
    • config system raid
    • config system route
  • execute
    • execute backup all-settings
    • execute backup configurations
    • execute backup fd-tcpdump
    • execute backup-remove fd-archive
    • execute backup-remove fd-report
    • execute backup-remove fd-tcpdump
    • execute date
    • execute format disk
    • execute generate certificate
    • execute ping
    • execute raid rebuild
    • execute reboot
    • execute reset
    • execute restart
    • execute restore all-settings
    • execute restore configurations
    • execute restore fd-archive
    • execute shutdown
    • execute time
    • execute top
    • execute traceroute
  • show
    • show system admin setting
    • show system backup all-settings
    • show system dns
    • show system global
    • show system interface
    • show system ntp
    • show system route
  • get
  • set
  • diagnose
    • diagnose counter memory
    • diagnose counter misc
    • diagnose counter packet
    • diagnose counter parser
    • diagnose counter session
    • diagnose debug application control basic
    • diagnose debug application housekeep basic
    • diagnose debug application parser basic
    • diagnose debug application parser packet
    • diagnose debug application sniffer abnormal
    • diagnose debug application sniffer basic
    • diagnose debug application sniffer block-ip
    • diagnose debug application sniffer block-session
    • diagnose debug application sniffer ip-reassemble
    • diagnose debug application sniffer malformed-packet
    • diagnose debug application sniffer packet
    • diagnose debug application sniffer tcp-reassemble
    • diagnose log show|tail|remove
    • diagnose mapping debug
    • diagnose mapping reset
    • diagnose mapping status
    • diagnose system coredump check
    • diagnose system coredump export
    • diagnose system export fd_log
    • diagnose system raid list
    • diagnose tcpdump start|stop
    • diagnose tcpdump status
    • diagnose network interface list
    • diagnose network interface detail