BigData Intelligence Policy Violations domain
All policy violation data, for all violations of the policy detected by the Guardium inspection engines or STAPs. This topic describes the domain's entities and attributes. This topic describes the domain's entities and attributes.
This entity is created each time that a policy rule violation is logged. Not all policy rule violations are logged - see the description of the rule actions in Policy rule actions. The access rule causing the violation is available in the dependent Access Rule Entity (described earlier).
Available to roles: all.
This domain is available in Guardium systems that have a defined datasource of type GBDI.
BigData Intelligence Policy Violations Entity
|Access Rule Description||The description of the rule from its definition.|
|Analyzed Client IP||Applies only to encrypted traffic; when set, client IP is set to zeroes.
Analyzed Client IP has a map for CEF source. If the query used for the CEF does NOT contain the Client IP but contains the analyzed client IP, the analyzed client IP will be used for the source. If both included in the query, then Client IP takes precedence.
|Client Host Name||Client Host Name|
|DB User Name||Database user name. The user that connected to the database, either local or remote.|
|Full SQL String||SQL string that caused the policy rule violation.|
|Guardium Appliance||Host name of collector that reported this data.|
|Objects and Verbs||Database user name. The DB user name is the person who connected to the database, either local or remote.|
|OS User||OS user that caused the policy rule violation.|
|Server Host Name||Server on which the policy rule violation occurred.|
|Server IP||Server IP on which the policy rule violation occurred.|
|Server Type||Server type on which the policy rule violation occurred.|
|Service Name||Service Name in which the policy rule violation occurred.|
|Severity||Severity of the policy rule violation.|
|Source Program||Source Program in which the policy rule violation occurred.|
|Timestamp||Created when the policy rule violation is logged. Not all policy rule violations are logged|
|Timestamp Date||Date in the timestamp|
|UTC Offset||The difference in time between UTC time and time of collector that reported that data|
|Violation Log Id||Unique identifier of the violation log|