Release of Guardium Data Protection 12.2.4

Intelligent appliance patch management
Redesigned patch management experience with automated downloads, at-a-glance impact indicators for reboots and schema changes, and a direct link to Fix Central documentation. Administrators can configure, track, and act on available patches from a single, consolidated view to reduce manual effort and minimizing security exposure windows.
 
Automation enablement for Application TAP (A-TAP) activation and deactivation
Guardium now enables non-root database users and automation pipelines to script A-TAP activation, deactivation, and configuration updates during database patching without elevated root access—backed by continuous state detection, automatic collector alerting, and a kernel-verified audit trail.
 
Modernized API framework ad self-service key management
A modernized REST API v2 framework featuring a centralized API key management console and an interactive, Swagger-based API documentation interface.

• Self-service API key management. Independently create, revoke, and manage expiration lifecycles for REST API keys directly within the Guardium user interface—eliminating the need to contact IBM Support. Administrators can manage all user keys, while individual users only manage their own API keys.

• Interactive API explorer and tooling. Developers can browse, test, and execute APIs from a single location, with automatically generated cURL and Guardium CLI syntax examples to accelerate integration.

REST API v2 is recommended for all new integrations and automation workflows, while v1 APIs remain fully supported for existing deployments and accessible through the same interface. Together, these enhancements improve API security, governance, and developer time-to-value.

Active threat detection and analytics
Improved case correlation, database connection classification, generated reports, and policy-based outlier detection.

• Build your own case module. Controls over how observations from Active threat analytics detection engines are correlated into cases. Rather than relying on vendor-defined logic, encode your own threat models and thresholds, define multi-stage detection expressions, and control exactly when and why a case is raised.

• Generated reports for Active threat analytics cases. Provides richer contextual information for more visibility into case details, associated observations, sources, and investigation outcomes. These reports can be sent to Syslog/SIEM by using Audit Process Builder.

• New connection logbook. View, assign, and modify the classification of every database connection profile observed across all active cases and observations. Classify connections as trusted, untrusted, or batch to accelerate triage of Active threat analytics cases. Real-time Trust Evaluator (RTTE) trust score provides rolled-up recommendations. Cases are then tagged based on these classifications.

Active threat analytics user experience modernization
Modernized dashboard with interactive charts and a configurable layout to visualize the distribution of active threat cases across multiple dimensions, including severity, threat category, database, database user, and server IP, without exporting data or building views manually.

Aggregator performance improvements
Speed up report generation and reduce latency during concurrent workloads with the new Parallel Query option in Guardium aggregators, which uses partition-aware routing and temporary staging tables to minimize data scans and optimize memory at runtime. Note: The Parallel Query option is only available for newly created or cloned reports in the Access, Exception, and Policy Violation domains.

Audit process user experience modernization
Audit Process Builder UI is modernized with clear workflow visibility, role-based actions, and a scalable review interface. Tabbed pages, expandable rows, and side panels reduce visual clutter, enabling analysis to review, comment on, and track audit history from a single, consolidated view.

Data streams monitoring proxy support
Microsoft Entra ID authentication support for Azure Event Hubs data streaming with proxy.
 
Location-aware data activity monitoring
Pre-built session-level policy template that detects and responds to location-based database activity anomalies. Prove at query time that database sessions originated from permitted jurisdictions.
 
Distributed long term retention query support
Gain capacity on demand for retaining and querying historical data with a new distributed data lake environment. Attach external worker appliances to an existing, single-node, long term retention appliance so it becomes the core unit of your distributed deployment. For more information, see release notes for Data lake (long term retention) patch 12.0p90240.
 
Edge Gateway 2.3
Reduce fragmentation of database collection and monitoring by:

• Streaming database traffic from a single Edge cluster to multiple aggregators.

• Mapping Software TAP (S-TAP)-to-Aggregator to isolate sensitive database workloads.

• Synchronizing security policy rule states across multiple collectors with session-level policies rules state service.

• Supporting File Activity Monitoring (FAM) with Linux-UNIX S-TAP to satisfy compliance mandates.

For more information, see release notes for Edge patch 12.0p15005.
 
Operational improvements
Guardium appliances now support:

• Mutual TLS authentication (mTLS) for SIEM forwarding.

• Support for 3072-bit and 4096-bit certificate key lengths.

• Real-time notification of high CPU utilization for Guardium appliances on Amazon Elastic Compute Cloud (EC2).

Small Language Model for AI use cases
Guardium gen AI appliance now includes a pre-packaged Small Language Model (SLM), enabling adoption of gen AI use cases without requiring integration with external language model providers. For more information, see release notes for Small Language Model patch 12.0p85240.
 
Universal connector
New universal connector features and enhancements:

• Ability to add custom CA certificate chains for Syslog-based universal connectors and Oracle Unified Audit (OUA) universal connector.

• Kafka-aware diagnostic agent that reads structured event data from each Kafka node and surfaces actionable diagnostics directly in the central manager troubleshooting interface.

• Ability to temporarily disconnect an asset from a universal connector without uninstalling a profile.

• Modernized Datasource Profile Management user interface with streamlined Manage, Actions, and Test connection functions.

• Updated Datasource Profile Management reports include deployed collectors.

• Support for dynamic extraction of account ID from AWS CloudTrail events payload for Amazon DynamoDB universal connector.

• Support for Windows NT authentication added for On Prem Microsoft SQL Server universal connector. 

• Amazon Resource Name (Role ARN) support for AWS data sources with on-prem collectors.

• Records Affected support for Azure PostgreSQL Logstash-based universal connector.

UC 2.0 features and enhancements include:

• New Datasource support for AWS Athena Iceberg over Cloudwatch, PostgreSQL 17 and 18.4 over Syslog, Redis over Syslog, and NetAPP ONTAP NAS.

• Additional UC 2.0 connectors available for MongoDB Atlas, MongoDB over Syslog, MySQL on prem over Syslog, and Neo4j over Syslog.

• Restart communications for a single UC 2.0 connector while other asset communications remain unaffected.

• Ability to create multiple datasource profiles with the same port for Syslog-based universal connectors.

Vulnerability Assessment
Scan databases for vulnerabilities by using a modernized user experience, new template-based assessment creation wizard, and data source tests based on the latest benchmarks.

• Create and customize vulnerability assessments faster with a guided, step-by-step Assessment Builder wizard, which includes options for predefined templates.

• Manage and monitor vulnerability assessments through a modernized Assessments user interface, which now displays error status more prominently.

• Addition of Assessment Tests for Oracle 26ai based on latest CIS benchmarks.

Linux-UNIX and Windows Agents updates

More information about new features and enhancements to the Configuration Auditing System (CAS), Guardium Installation Manager (GIM), File Activity Monitor (FAM) for Windows (FamMonitor), and Software TAP (S-TAP) agents, see their corresponding release notes: 

• Linux-UNIX CAS 12.xp103 r125006 (see release notes)
• Linux-UNIX GIM 12.xp103 r125006 (see release notes)
• Linux-UNIX S-TAP 12.xp103 r125006 (see release notes)
• Windows CAS 12.xp102 r120204351 (see release notes)
• Windows FamMonitor 12.xp102 r120204351 (see release notes)
• Windows GIM 12.xp102 r120204351 (see release notes)
• Windows S-TAP 12.xp102 r120204351 (see release notes)

Patch updates for the Linux-UNIX and Windows Agents are cumulative; they contain all previous patches for that major version.