Configuring Imperva DAM to Export DB Audit Data to Imperva Sonar

Exporting DB Audit and DB Security Events to Imperva Sonar enables you to leverage the powerful analysis tools available in Imperva Sonar. Indeed, it is recommended that you export all your audit data to Imperva Sonar for the purposes of archiving, reporting and forensics.

In order to configure Imperva DAM to send DB audit data to Sonar, do one of the following:

• Configure the Default Archive Action Set with the new Sonar Archiver action, in which case all policies configured with this action set will export their DB audit data to Sonar.
• Create a new Archiving Action Set and configure it with the new Sonar Archiver action, and then configure individual policies to use it.

After exporting the DB audit data to Imperva Sonar it will appear in SonarK, where you will be able to run reports, create dashboards and do forensics on all of the data according to the retention period you have purchased.

To configure an action set to export audit data to Imperva Sonar:

1. In the Main workspace, select Policies > Action Sets. The Action Sets window appears.
2. Either:

   Configure the Default Archive Action Set so that all policies using this action set export DB audit data to Sonar:

   1. Select the Default Archive Action Set.
   2. Remove any existing actions from the action set by clicking on the blue arrow.
   3. For the Sonar Archiver > Send to Sonar action, click the green arrow . The action appears at the top of the list.
   4. Click the expand button for the action to view its parameters.
   5. Type a Name for the new action, and then give values to its parameters as follows:
      • Host: The IP or hostname of the Sonar machine to which the audit is exported
      • Port: The connection port of the Sonar machine to which the audit is exported. The default value is 8443.
      • API token: The authentication token that provides access to the Sonar machine. It is a prebuilt token included in DSF Hub to facilitate authentication when exporting database audit data to DSF Hub. You can find information about this token in the Tokens Management window (see the token for which Token used by Archiver endpoints security is stated in the Reason column). For more information, see the Managing Authorization Tokens topic in the Sonar Administration Guide for your version.
      • Validate Server Side Certificate Against a CA: Check this box if you want to validate the Sonar machine's certificate against a Certificate Authority.
      • Internal CA Certificate: The certificate string for your internal CA if you have one.
      • Enrichment Document: This field should be empty unless you are instructed otherwise.
   6. Click Save.

   or:

   Configure a new Action Set so that selected polices export audit data to Sonar:

   1. In the Action Sets pane, click New. The Action Set dialog box appears.
   2. Type a Name for the action set.
   3. Select the Archiving option as the Action Set type.
   4. Find the Sonar Archiver action and click on the green arrow for it. The action set appears at the top of the list.
   5. Click the expand button for the action set to view its parameters.
   6. Type a Name for the new action, and then give values to its parameters as follows:
      • Host: The IP or hostname of the Sonar machine to which the audit is exported
      • Port: The connection port of the Sonar machine to which the audit is exported. The default value is 8443.
      • API token: The authentication token that allows the DAM Gateway to authenticate audit data files and update then update them to the DSF Hub machine. It is a prebuilt token included in DSF Hub to facilitate authentication when exporting DB Audit Data to DSF Hub. You can find information about this token in the Tokens Management window (see the token for which Token used by Archiver endpoints security is stated in the Reason column). For more information, see the Managing Authorization Tokens topic in the Sonar Administration Guide for your version.
      • Validate Server Side Certificate Against a CA: Check this box if you want to validate the Sonar machine's certificate against a Certificate Authority.
      • Internal CA Certificate: The certificate string for your internal CA if you have one.
      • Enrichment Document: This field should be empty unless you are instructed otherwise.
   7. Click Save.

      Notes: You can add only one Sonar Archiver > Send to Sonar action to your action set. An action set that has the Sonar Archiver > Send to Sonar action can have no other actions. Only a single action set in the system can have a Sonar Archiver action in it.