XMA: OSS path and file name from Safeguard audit not showing up in XMA database or on SIEM
OSS commands, such as 'cat', generate an "open" operation for the OSS file on which they were executed. The Safeguard audit for "open" operations caused by 'cat' do not show the OSS path and file name in the ObjectName field of the Safeguard record. They will only show the Guardian file name representation, e.g. the logical file name. This is because of what Safeguard stores in its audittrail and is not an issue with how XMA processes the audit. HPE would need to change what audit is captured by a 'cat' command for the OSS path and file name to be included in the ObjectName field.
Example:
Safeguard Audit Record for 'cat' operation of OSS file:
Multiple records can be generated for a single operation. For 'cat' commands, a Safeguard record for an "OssResolve" operation will also be generated, along with the "open" operation. The audit record for the OssResolve will show the OSS path and file, as well as the logical Guardian file name:
The standard XYPRO XMA filters will write the Safeguard record for the open of the file by the 'cat' command to be written to the XMA database or a SIEM, but this record will not show the OSS path and file name. By default, the Safeguard audit record for the OssResolve contains the OSS path and file name, but will not be written to the XMA database or to a SIEM. This is because it is filtered out by the XMA filter $IGNORE-UNHELPFUL-SFG-RECORDS. To write Safeguard audit records of this type to the XMA database or to a SIEM, edit the FILTERS file and remove message code 458 from the filter $IGNORE-UNHELPFUL-SFG-RECORDS so that it will be captured by XMA:
!Filter out uninformative Safeguard message codes:
DATA_SELECT_BEGIN
FILTERTYPE STRINGFILTER
AUDIT.MESSAGECODE LIKE "(452|457|458|459)"
DATA_SELECT_END
In the above filter example, "458" must be removed as one of the message codes ignored for Safeguard audit records with this message code to be processed by XMA