Release of Guardium Data Protection 12.2.3

Automated patch downloads
Keep Guardium continuously up to date by letting the service automatically monitor Fix Central for new patches and download them as soon as they become available so you can schedule the installation. Easily enabled through the CLI to reduce manual effort and significantly accelerate upgrade cycles. Note: Requires connectivity to the internet either directly or through an HTTP proxy.

Active threat analytics UI 
Streamline onboarding and accelerate risk detection and response with enhanced usability.

• Modernized setup page to simplify case configurations.

• Automatic case closure options.

• Enhanced exclusion criteria with additional parameters and recurrence-based filtering capabilities.

• Caching of case summaries and policy explanations in the database improves responsiveness and reduces wait times to regenerate content.

• Server-side pagination for the Active threat analytics cases table improves performance when working with large case volumes, enabling efficient navigation and search across all cases. 

• What this means feature uses generative AI to explain policy rule violations, helping you understand what triggered violations without interpreting policy builder configurations.

Active threat analytics for IBM Db2 z/OS 

Gain more granular analysis of database-level threat detection support for IBM Db2 z/OS environments.

• 18 updated reports with database-level filtering capabilities.

• 8 new reports for database-specific threat analysis.

• Enhanced case management with database-level exclusions.

• Improved outlier detection using the APP_USER_NAME field for database identification.

Active threat detection and analytics

Reduce noise through improved observations and case correlation.

• Centralized case creation logic provides fewer false positives through improved collaboration between three specialized Guardium threat detection engines: Eagle Eye, Outlier, and Threat Finder.

• Enhanced identification of encoded and obfuscated payloads, and improved recognition of evasive attack techniques such as blind SQL injection and time-based attacks.

• Improved outlier anomaly detection by separating how instance count and records affected are learned and evaluated to increase accuracy and clarity.

Archive support for NFS

Set up a Network File System (NFS) target for archive workflows through the UI. Additionally, archive catalog entries can be created or updated in the catalog location table by using the GuardAPI commands create_entry_location and update_entry_location. 

Database activity monitoring updates

Enhancements to database activity monitoring capabilities include:

• Support for monitoring the unique identifier (UID) chain while Application TAP (A-TAP) is enabled.

• Support for exception-related policy rules that use error codes for IBM DataStax Enterprise.

• guard-config-update script updated to remove dependency on "ed" utility.

• LD_PRELOAD implementation supports dynamic configuration, allowing for more flexible library loading at runtime.

Data streams

Monitor more data sources across hybrid cloud environments.

• HashiCorp Vault and Microsoft Entra ID authentication support for Azure Event Hubs data streaming.

• Support for unique database identification for API streaming traffic from multiple subscriptions to a single event hub within Azure Event Hubs.

Edge Gateway 2.2 
A scalable, Kubernetes-based service architecture, Edge Gateway now supports ingestion into multiple partitions within the same Aggregator by using Collector ID, and supports monitoring unique identifier (UID) chains.

External AI provider integrations

Integrate Guardium with any external AI provider, such as OpenAI, Anthropic, Google Gemini, and Mistral AI, through the GenAI Settings page. Support your generative AI use cases with the AI models that align with your internal standards, while maintaining governance, transparency, and control.

Long-term retention 

Enhancements to Guardium long-term retention include new and updated user interfaces for the Setup and Data Lake Report management tools, support for Iceberg REST catalog, and overall data pipeline and optimization improvements.

Model Context Protocol support

Support added for the Guardium Model Context Protocol (MCP) server, enabling standardized access to Guardium capabilities for AI agents and removing the need for feature-specific integration code.

Policies

Expanded Basic Security Policy now includes standard outlier use cases. New session-level policy rule criteria UID_CHAIN_USER matches against usernames within the unique identifier (UID) chain, allowing policies to trigger based on which users are present in the execution chain leading to a database session.

Real-time trust evaluator

The trust evaluator now uses a continuous learning model that incorporates new findings into the scores daily. Status types are now simply WARMING UP, ACTIVE, and IDLE. Although training data for the probability engine is reset with the move to the continuous learning model, training the new model is faster and more stable.

Simplified compliance policy discovery
Use a clear, structured, and framework-aligned method to quickly identify supported regulations, standards, and industries, and apply the appropriate monitoring policies with confidence. Improve compliance clarity, accelerate onboarding, strengthen evaluation readiness, and map monitoring results directly to regulatory obligations without requiring deep product expertise.

Unified Discovery and Classification
Automatically convert Unified Discovery and Classification (UDC) classifications into Guardium groups and populate the Guardium Asset Inventory to enable regulation-aligned, sensitivity-aware monitoring. This feature delivers complete asset visibility through continuous discovery, classification, and protection.

Universal connector 
New universal connector features and enhancements include:

• Troubleshooting and health monitoring automatically logs exceptions, errors, status updates, and performance metrics, enabling faster issue identification and resolution.
• HTTP proxy support for the following UC 2.0 connectors: AWS CloudWatch, Azure Event Hub, and Google Cloud Pub/Sub.
• HashiCorp Vault integration with UC credentials extended to support AWS Secrets Engine. In addition, the Vault key/value (KV) secrets engine now supports Oracle Unified Audit (OUA)-based connectors.
• Additional classic UC input plug-in is available for CockroachDB over Syslog.
• For UC 2.0, additional Azure Event Hub, Capella, and Syslog-based connectors are available: Azure Event Hub connector for Azure Cosmos, Capella connector for Capella, and Syslog connectors for AlloyDB Omni, CockroachDB, and Yugabyte.
• CockroachDB over Syslog configuration changed significantly for the Kafka-based UC 2.0 architecture. For updated configuration details, see Configuring CockroachDB datasource profiles for Kafka Connect plug-ins.

Two universal connector security updates require action:

• The Logstash version used for universal connectors is now upgraded to version 9.3.3. This might require configuration changes in your current environment. For more information, see Logstash 9.3.3 upgrade guide.
• All universal connectors that use certificates must now be reconfigured by providing an encryption password with the ssl_key_passphrase => "${ssl_key_passphrase}" parameter in the input configuration. After you make the change, restart or reinstall your Logstash-based universal connector.

Note: Universal connector (UC) fixes are delivered in cumulative patches separate from Guardium Data Protection appliance bundle patches. When you install Guardium 12.2.3 (GPU 12.0p230), your UC will upgrade to what is included in the GPU only if the UC on the system where you are installing GPU 12.0p230 is older than the UC that is included in GPU 12.0p230. 

Vulnerability Assessment 
Scan databases for vulnerabilities by using the latest benchmarks and data source tests.

• Assessment Tests for EDB PostgreSQL based on the latest CIS PostgreSQL 17 benchmarks.
• Data source currency updates: Couchbase 7.6, 8.0, DataStax Cassandra 6.8, and Oracle 26ai (includes on-prem and autonomous cloud).
• Additional Java and Guardium CAS-based tests for MarkLogic.
• Support for running Vulnerability Assessment Scanner on Red Hat OpenShift Container Platform.

Linux-UNIX and Windows Agents updates

More information about new features and enhancements to the Configuration Auditing System (CAS), Guardium Installation Manager (GIM), File Activity Monitor (FAM) for Windows (FamMonitor), and Software TAP (S-TAP) agents, see their corresponding release notes: 

• Linux-UNIX CAS 12.x.p101 r124239: https://www.ibm.com/support/pages/node/7278165 
• Linux-UNIX GIM 12.x.p101 r124239: https://www.ibm.com/support/pages/node/7278164 
• Linux-UNIX S-TAP 12.x.p101 r124239: https://www.ibm.com/support/pages/node/7278163 
• Windows CAS 12.x.p100 r120203321:  https://www.ibm.com/support/pages/node/7278221
• Windows FamMonitor 12.x.p100 r120203321: https://www.ibm.com/support/pages/node/7278231 
• Windows GIM 12.xp100 r120203321: https://www.ibm.com/support/pages/node/7278232
• Windows S-TAP 12.xp100 r120203321: https://www.ibm.com/support/pages/node/7278217

Patch updates for the Linux-UNIX and Windows Agents are cumulative; they contain all previous patches for that major version.