Guardium

Guardium Courses:

Create Guardium policy to log file activity

Using IBM Guardium, you can create policies to monitor access to unstructured data, such as that found in files, as well as structured data, such as that found in databases. In this lab, you learn how to create and install policies to monitor files. Then you modify the FAM policy and add a rule that prevents a group of users from copying a file.

Create Guardium reports with drill-down capabilities

Guardium contains a powerful tool that links related reports. Users can click report entries and view a list of other reports that provide more granular information related to the entry. In this lab, you create a drill-down report to extend the capabilities of existing reports. Then, you test your new report.

This lab environment reflects Guardium 10.5.

Franklin Almonte

Creating and populating Guardium groups

Guardium 10.1.4 includes a new group builder application that  provides powerful tools you can use to add users to a group  and review  which resources use a given group. In this course, you learn to how to build and populate Guardium groups.

Louis Fuka

Using IBM Guardium APIs to Speed Deployment and Automate Repetitive Tasks

Regular upkeep of your data security environment is required to keep the system aligned with the ever-changing IT environment, including new data servers, new uses of sensitive data, new users, and new applications. Organizations that use IBM Guardium for data security and compliance can take advantage of a rich set of APIs to automate processes and maintain the system in a more efficient manner. 

In this course, you learn how Guardium APIs can speed deployment and automate repetitive tasks such as creating a datasource, updating users, and modifying groups.

The lab environment reflects Guardium 10.5.

Franklin Almonte


Guardium Query-Report Builder

Starting with version 10.6, Guardium has a new query and report builder. This builder incorporates many of the 10.x design features, including a format that presents configuration options as sections, as well as an intuitive, step-by-step guide to create and configure the query. The report is automatically generated from the query. If the query is modified, the report is automatically regenerated when the query is saved.

In the lab exercises, you create a query and report that shows SQL commands. Then you generate data to test the report and view the results.

Create a Guardium policy from file activity discovery and classification results

Guardium File Activity Monitoring provides tools to discover, classify, and build policies for files. In this lab, you use the Quick Search GUI window to find files that contain sensitive information, select a set of these files, and create a policy that monitors attempts to access these files.

This lab is useful for Guardium users and administrators who need to monitor access to files that contain sensitive information. The lab is based on Guardium version 10.5.



Guardium database vulnerability assessment

The Guardium Vulnerability Assessment application enables organizations to identify and address database vulnerabilities in a consistent and automated fashion. The assessment process in Guardium evaluates and recommends actions to improve the health of your database environment. In this lab, you learn how to configure and run a database vulnerability assessment.

This lab environment reflects Guardium 10.5.

Franklin Almonte

Guardium 10.6 improved policy builder

Starting with version 10.6, Guardium has a new policy builder. This builder incorporates many of the 10.x design features, including a format that presents configuration options as sections, and an intuitive, step-by-step guide to create and configure the policy.

Franklin Almonte

Deploying the Guardium S-TAP Agent

Guardium S-TAP is a lightweight software agent installed on database servers. S-TAP agents collect the data that are used by traffic reports, alerts, and visualizations. S-TAP agents also enact certain policy rules.

In this lab, you install the S-TAP agent on a database server using the Guardium Installation Manager (GIM) and Guardium GUI.


Deploying the Guardium virtual appliance

Guardium is available as a hardware and software offering. The hardware offering is a physical appliance that is fully configured by IBM. The software offering consists of software images that are deployed on customer hardware directly or as virtual machines.

Most organizations use the software offering to deploy Guardium because they can take advantage of virtualization. The Guardium Virtual Machine (VM) is a software-only solution that you install on a host hypervisor machine such as VMware ESXI server.

In this lab you create a virtual machine, install the Guardium image, and perform basic configuration steps to connect the appliance to the network.


Author: Franklin Almonte

Create a Guardium File Activity Monitor dashboard and report

File activity monitoring (FAM) includes two major components. The first component discovers and classifies files stored in the file system, and the second component is the activity monitor. It extracts the security policy from the appliance and enforces it on file activity in real time. 


In this lab, you view the settings necessary to perform file access monitoring, create a dashboard and add a file entitlement report, and then perform some file operations to view how the FAM functionality reacts to changes.

Franklin Almonte, Guardium 10.5

Guardium session-level policy

Starting with version 10.6, IBM Guardium features special policies that work at the session level. These policies are installed and processed before standard data-security policies, and respond to information that is available at the beginning of a database session. This feature allows quicker processing and response. In this lab, you create and test a session-level policy. 

Franklin Almonte

Creating a Guardium policy that ignores trusted user session database activity

Guardium Data Security policies help flag suspicious database activity. When you configure policy rules to ignore trusted database activity, you can reduce the load on the network and Guardium managed units. In this  lab, you create a policy with rules to discard trusted activity and flag untrusted activity.

The lab environment reflects Guardium 10.5.

Overview of the IBM Guardium User Interface

This course introduces  you to the Guardium interface and command line interface. You learn how to access common Guardium features and applications. You can use the Guardium command line interface (CLI) to automate and script functions that are frequently used. You learn how to search the CLI for commands and list applicable options.

In the lab, you explore the Guardium GUI and learn how to classify data in your database environment. You create a new classification policy that searches for credit card numbers and populates the Sensitive Objects group with the table name and column name for each detected incident. 

The lab environment reflects Guardium 10.5.

Franklin Almonte


Using Guardium to quarantine database access

IBM Guardium provides powerful functions you can use to monitor and control database access. Guardium can terminate sessions performing suspicious database access commands and even quarantine suspicious users. In this lab, you explore the session termination and quarantine functionality.

The lab environment reflects Guardium 10.5.

Clone a Guardium query and report

Guardium provides over 600 preconfigured reports. As well as being useful in themselves, these reports can serve as templates to create a report customized to your specific needs. This saves time and effort. In this course, you clone a Guardium query. Then, you customize the fields and conditions of this query and generate a report from the new query.

The lab environment reflects Guardium 10.5.

Lou Fuka


Guardium policy: Using the Continue to next rule functionality

Guardium policies often have multiple rules. By default, after a rule is triggered, processing stops. If you do not want to stop processing after the first rule triggers, you must configure your policy to continue to the next rule. In this lab, you configure and test a policy to examine the continuation functionality.

The lab environment reflects Guardium 10.5.

Louis Fuka

Create a Guardium query and report

Guardium gathers a large amount of data about your database environment. You use reports and queries to learn the details of your data security environment. In this virtual lab, you create a dashboard, simple query, and report that is used to examine user data you generate.

The lab environment reflects Guardium 10.5.

Franklin Almonte

Detect database login failures with Guardium

Guardium data security policies help flag suspicious database activity and events. In this virtual lab, you create a policy that will detect and alert on database login failures that occur multiple times over a short time period.

Franklin Almonte