Previous Topic: Considerations for CA Audit UsersNext Topic: CA IT PAM Considerations

Implementation Guide › Considerations for CA Access Control Users

Considerations for CA Access Control Users

This section contains the following topics:

Integrating with CA Access Control

How to Modify CA Audit Policies to Send Events to CA User Activity Reporting Module

How to Configure a CA Access Control iRecorder to Send Events to CA User Activity Reporting Module

How to Import CA Access Control Events from a CA Audit Collector Database

Securing CA User Activity Reporting Module Using CA Access Control

Integrating with CA Access Control

You can integrate CA User Activity Reporting Module with CA Access Control using one of several different release levels. The general approach is the following:

For CA Access Control releases that use a TIBCO message server for routing events, do the following:

Note: These implementations use components that are part of the CA Access Control Premium Editions.

For CA Access Control releases that use selogrd for routing events, do the following:

If you are currently sending CA Access Control events to CA Audit, use of the following methods to get events to CA User Activity Reporting Module:

The guidelines that follow use the r8 SP2-series for the Policy Manager user interface. The general procedures are the same when you are using earlier CA Audit releases, though the user interface is different.

How to Modify CA Audit Policies to Send Events to CA User Activity Reporting Module

The process for modifying an existing CA Audit policy to send events to CA User Activity Reporting Module involves the following steps:

Repeat this process to add new rule actions to other policy rules, as needed.

More information:

About the SAPI Router and Collector

Configure the SAPI Collector Adapter to Receive CA Access Control Events

Use this procedure to configure the SAPI collector adapter to receive CA Access Control events from a CA Audit implementation.

You can modify CA Audit policies that use Collector actions to send events to a CA User Activity Reporting Module server in addition to, or in place of, sending events to the CA Audit collector database. Configure this service before you modify CA Audit policies to verify that no events are lost.

(You can configure a SAPI Router service in a similar way. If you use both the Router and Collector services, be sure that the ports listed are different, or that the port mapper service controls them.)

To configure the SAPI collector service

  1. Log into the CA User Activity Reporting Module server as an Administrator user and select the Administration tab.

    The Log Collection subtab displays by default.

  2. Expand the CA Technologies Adapters entry.

    This picture shows the Administration tab with the Log Collection Explorer pane's options, and the CA Adapters expanded.

  3. Select the SAPI Collector service.

    This picture shows the CA SAPI Collector configuration dialog.

  4. Select the EnableListener check box and set the SapiPort value to a value that matches what CA Audit uses.

    The default CA User Activity Reporting Module value, 0, uses the Portmapper service to map the ports. If you have a port defined in CA Audit, use that setting here.

  5. Accept the other field defaults, and scroll down to the list of Mapping Files.

    If you select the Register check box, specify a SAPI port value.

  6. Add the Access Control mapping file entry if it is not present, and remove the other mapping file selections from the list of Selected mapping files.

    This picture shows the available and selected mapping files for the CA SAPI Collector service configuration.

  7. Click Save.

Modify an Existing CA Audit Policy to Send Events to CA User Activity Reporting Module

Use this procedure to enable a CA Audit client to send events to both CA User Activity Reporting Module and the CA Audit collector database. By adding a new target to the Route or Collector actions on an existing rule, you can send collected events to both systems. As an alternative, you can also modify specific policies or rules to send events only to the CA User Activity Reporting Module server.

CA User Activity Reporting Module collects events from CA Audit clients using the CA Audit SAPI Router and CA Audit SAPI Collector listeners. (CA User Activity Reporting Module can also collect events using the iTech plugin directly, if you configured any iRecorders to send directly to the CA User Activity Reporting Module server.) Collected events are stored in the CA User Activity Reporting Module event log store only after you push the policy to the clients and it becomes active.

Important: Configure the CA User Activity Reporting Module listeners to receive events before you modify and activate the policy. If you do not do this configuration first, you can incorrectly map events between the time that the policy becomes active and the listeners can correctly map the events.

To modify an existing policy rule action to send events to CA User Activity Reporting Module

  1. Log into the Policy Manager server and access the My Policies tab in the left pane.
  2. Expand the policy folder until you can see the desired policy.

    The CA Audit policy manager pane, showing the My Policies tab with the Suspicious Events policy selected.

  3. Click the policy to display its basic information in the Details pane to the right.

    The Details pane shows that the Suspicious Events policy is selected, and offers a New Rule button at the top.

  4. Click Edit in the Details pane to add to the policy rules.

    The rule wizard starts:

    This picture shows the first page of the Edit a Rule wizard.

  5. Click Edit Actions next to the arrow for the step 3.

    The rule actions page displays:

    This picture shows the Edit a Rule wizard's edit action page with a list of actions in a separate pane on the left.

  6. Click the Collector action in the Browse Actions pane to display the Action List to the right.

    This picture shows the Action List that displays when you select the Collector action from the list.

    You could also use the Route action, but the collector action offers the additional benefit of an alternate host name for basic failover processing.

  7. Click New to add a new rule.
  8. Enter the IP address or host name of the collection CA User Activity Reporting Module server.

    This picture shows the completed collector action record just before you click the Add button.

    For a CA User Activity Reporting Module implementation with two or more servers, you can enter a different CA User Activity Reporting Module host name or IP address in the Alternate Host Name field. This takes advantage of CA Audit's automatic failover feature. If the first CA User Activity Reporting Module server is not available, CA Audit automatically sends events to the server named in the Alternate Host Name field.

  9. Enter the name of the management CA User Activity Reporting Module server in the Alternate Host Name field, and then create a description for this new rule action.
  10. Clear the check box, Perform this action on remote server, if it is checked.
  11. Click Add to save the new rule action and then click Finish in the wizard window.

    Note: Next you check and activate the policy, so do not log out of the CA Audit Policy Manager.

More information:

Modify an Existing r8SP2 Policy to Send Events to CA User Activity Reporting Module

Check and Activate the Changed Policy

After you change an existing policy to add a rule action, check (compile) it and then activate it.

To check and activate a CA Access Control policy

  1. Select the Rules tab in the lower right pane, and then select a rule to check.

    This picture shows the Rules tab with the Suspicious Events policy selected for checking and activation.

  2. Click Check Policies to check the changed rule with the new actions to ensure that it compiles properly.

    Make any needed modifications to the rule and ensure that it compiles correctly before you activate it.

  3. Click Activate to distribute the checked policy that contains the new rule actions you added.
  4. Repeat this procedure for each rule and policy with collected events you want to send to CA User Activity Reporting Module.

How to Configure a CA Access Control iRecorder to Send Events to CA User Activity Reporting Module

You can configure a standalone CA Access Control iRecorder to send the events it collects directly to the CA User Activity Reporting Module server for storage and reporting. The process includes the following steps:

  1. Configure the iTech Event Plugin Listener to receive information from an CA Access Control iRecorder.
  2. Download and install an CA Access Control iRecorder.
  3. Configure the iRecorder to send its collected events directly to CA User Activity Reporting Module.
  4. Verify that CA User Activity Reporting Module is receiving events.

Note: iRecorders can send their events to only one destination. When you configure using this procedure, the only destination is the named CA User Activity Reporting Module server.

Configure the iTech Event Plugin for CA Access Control Events

Before you reconfigure an iRecorder to send events directly to CA User Activity Reporting Module, you need to configure a listener to receive those events.

To configure the listener

  1. Log into the CA User Activity Reporting Module server as a user with the Administrator role.
  2. Access the Administration tab and then expand the CA Adapters node.

    This picture shows the Administration tab with the Log Collection Explorer pane's options, and the CA Adapters expanded.

  3. Expand the iTechnology Event Plugin node.
  4. Select the current CA User Activity Reporting Module server to display the local settings.
  5. Ensure that the AccessControl mapping file is first in the list of Selected mapping files to ensure the most efficient operations.
  6. Verify that the Log level value is set to NOTSET to collect all event levels.
  7. Click Save.

Download and Install a CA Access Control iRecorder

You can collect CA Access Control events to send to a CA User Activity Reporting Module server even if you do not have CA Audit installed. When you collect events in this way, you are using an iRecorder in standalone mode. You can obtain an iRecorder from the CA Technologies Support web site.

Note: iRecorders are supported only with CA Access Control r8 and later releases.

To download and install a iRecorder

  1. Access the following CA Technologies web site: 
    https://support.ca.com/irj/portal/anonymous/phpdocs?filePath=0/154/cacirecr8-certmatrix.html#caacirec
  2. Select the appropriate iRecorder for your version of CA Access Control.
  3. View and follow the installation instructions available from the Integration Guide link in the matrix.

Configure a Standalone CA Access Control iRecorder

Use this procedure to configure your iRecorder to send CA Access Control events to CA User Activity Reporting Module.

Important! A standalone iRecorder can only send its events to a single destination. If you configure an iRecorder using the procedure that follows, all of the iRecorders installed on this system will send their events only to the named CA User Activity Reporting Module event log store.

iRecorders that are installed on the same computer as a CA Audit client send events to the client directly. For those servers, you should modify an existing CA Audit policy to add rule actions and after configuring the CA User Activity Reporting Module SAPI collector or router adapters.

To configure the iRecorder to send events to CA User Activity Reporting Module

  1. Log into the server that hosts the iRecorder as a user with Administrator or root privileges.
  2. Navigate to the directory for your operating system:
  3. Stop the iGateway daemon or service with the following command:
  4. Edit the iControl.conf file.

    The following is a sample iControl file with the sections you need to change in boldface type:

    <?xml version='1.0' encoding='UTF-8' standalone='no'?>
<iSponsor>
	<Name>iControl</Name>
	<ImageName>iControl</ImageName>
	<Version>4.5.0.2</Version>
	<DispatchEP>iDispatch</DispatchEP>
	<ISType>DSP</ISType>
	<Gated>false</Gated>
	<PreLoad>true</PreLoad>
	<RouteEvent>false</RouteEvent>
	<RouteEventHost>localhost</RouteEventHost>
	<EventsToCache>100</EventsToCache>
	<EventUseHttps>true</EventUseHttps>
	<EventUsePersistentConnections>true</EventUsePersistentConnections>
	<EventUsePipeline>false</EventUsePipeline>
	<StoreEventHost max="10000">localhost</StoreEventHost>
	<RetrieveEventHost interval="60">localhost</RetrieveEventHost>
	<UID>ef1f44ef-r8sp1cr3596a1052-abcd28-2</UID>
	<PublicKey>Public_Key_Value</PublicKey>
	<PrivateKey>Private_Key_Value</PrivateKey>
	<EventsToQueue>10</EventsToQueue>
</iSponsor>
  5. Specify the following RouteEvent value: 
    <RouteEvent>true</RouteEvent>

    This entry tells the iGateway to send its events, including all iRecorder events, to the host named in the RouteEventHost tag pair.

  6. Specify the following RouteEventHost value: 
    <RouteEventHost>Your_CA_Enterprise_Log_Manager_hostname</RouteEventHost>

    This entry tells the iGateway to send its events to the CA User Activity Reporting Module server using its DNS name.

  7. Save and close the file.
  8. Restart the iGateway daemon or service with the following command:

    This action forces the iRecorder to use the new settings and starts the flow of events from the iRecorder to the CA User Activity Reporting Module server.

How to Import CA Access Control Events from a CA Audit Collector Database

The process for importing CA Access Control events from an existing SEOSDATA table includes the following:

  1. Copy the LMSeosImport utility to the CA Audit Data Tools server.
  2. Create an event report to determine if CA Access Control events are present in the database.
  3. Run a preview of the import with CA Access Control-specific parameters.
  4. Import the CA Access Control events.
  5. Run CA User Activity Reporting Module queries and reports on the imported events.

Prerequisites for Importing CA Access Control Events

Before you using the LMSeosImport utility, do the following:

Copy the Import Utility to a Windows Data Tools Server

Before you can import data from your SEOSDATA table, you must copy the LMSeosImport utility from the CA User Activity Reporting Module Application installation DVD-ROM to your Windows Data Tools server.

Note: The LMSeosImport utility requires the presence of the etsapi and etbase dynamic link libraries. These files are part of the base Data Tools server installation. Before you try to use the LMSeosImport utility, ensure that the directory, Program Files\CA\eTrust Audit\bin, is included in your system PATH statement.

To copy the utility

  1. Access a command prompt on the Windows Data Tools server.
  2. Insert the CA User Activity Reporting Module Application installation DVD-ROM.
  3. Navigate to the directory, \CA\ELM\Windows.
  4. Copy the LMSeosImport.exe utility to the CA Audit Data Tools server's iTechnology directory, <drive>:\Program Files\CA\SharedComponents\iTechnology.

    The utility is ready for use after you copy it to the designated directory. There is no separate installation to run.

Copy the Event Import Utility to a Solaris Data Tools Server

Before you can import data from your SEOSDATA table, you must copy the LMSeosImport utility from the CA User Activity Reporting Module Application installation DVD-ROM to your Solaris Data Tools server.

Note: The LMSeosImport utility requires the presence of the etsapi and etbase libraries. These files are part of the base Data Tools server installation. Before you try to use the LMSeosImport utility, ensure that the CA Audit install directory is included in your system PATH statement. The default directory is opt/CA/eTrustAudit/bin.

Before you run the utility, set the following environment variables with the env command:

To copy the utility

  1. Access a command prompt on the Solaris Data Tools server.
  2. Insert the CA User Activity Reporting Module Application installation DVD-ROM.
  3. Navigate to the directory, /CA/ELM/Solaris_sparc.
  4. Copy the LMSeosImport utility to the CA Audit Data Tools server's iTechnology directory, /opt/CA/SharedComponents/iTechnology.

    The utility is ready for use after you copy it to the designated directory and set the required environment variables. There is no separate installation to run.

Create a SEOSDATA Event Report for CA Access Control Events

To determine whether an existing SEOSDATA table contains CA Access Control events, and to decide upon an import method, you should run an event report. The logname for CA Access Control events is eTrust Access Control. The report lists all events in the database separated by their log names. The easiest way to import CA Access Control events is to import them based on their log name.

To create an event report

  1. Create an event report so that you can see what CA Access Control events are present in the SEOSDATA table. 
    LMSeosImport -dsn My_Audit_DSN -user sa -password sa -report

    After processing, the utility displays a report that resembles the following:

    Import started on Fri Jan  2 15:20:30 2009


No transport specified, defaulting to SAPI...

Preparing ODBC connections...

Successfully attached to source [My_Audit_DSN]

---------- SEOSDATA Event Time Range ----------

Minimum TIME = 2008-05-27
Maximum TIME = 2009-01-02

---------- Event Count Per Log ----------

Unix : 12804
ACF2 : 1483
eTrust AC : 143762
com.ca.iTechnology.iSponsor : 66456
NT-Application : 5270
CISCO PIX Firewall : 5329
MS IIS : 6765
Netscape : 530
RACF : 14
Apache : 401
N/A : 28222
SNMP-recorder : 456
Check Point FW-1 : 1057
EiamSdk : 2790
MS ISA : 609
ORACLE : 2742
eTrust PCM : 247
NT-System : 680
eTrust Audit : 513
NT-Security : 14714
CISCO Device : 41436
SNORT : 1089

---------- SEOSDATA EntryID Range ----------


Minimum ENTRYID : 1
Maximum ENTRYID : 10000010243


Report Completed.

Successfully detached from source [My_Audit_DSN]

Exiting Import...
  2. Review the report to ensure that events from CA Access Control are present.

    The boldface line in this report excerpt shows that there are CA Access Control events contained in this SEOSDATA table.

    ---------- Event Count Per Log ----------

Unix : 12804
ACF2 : 1483
eTrust AC : 143762
com.ca.iTechnology.iSponsor : 66456
NT-Application : 5270
...

Preview a CA Access Control Event Import

You can use the import preview to fine-tune your import parameters. This example demonstrates two preview passes, based on a need to import events from a specific time period. The example assumes the following things:

The output from the command with the -preview option sends sample import results to STDOUT. (This example uses the value My_CA-ELM_Server to represent a CA User Activity Reporting Module server name.)

To preview the import

  1. Preview your CA Access Control event import with the following command: 
    LMSeosImport.exe -dsn My_Audit_DSN -user sa -password sa -target My_CA-ELM_Server -log "eTrust Access Control" -preview

    The -preview command shows information like the following:

    Import started on Fri Jan  2 15:35:37 2009


No transport specified, defaulting to SAPI...

Preparing ODBC connections...

Successfully attached to source [My_Audit_DSN]

No starting ENTRYID specified, using minimum ENTRYID of 1...

Import (preview) running, please wait...

.........

Import (preview) Completed (143762 records in 4 minutes 12 seconds).

---------- Imported Events (preview) By Log ----------

eTrust AC :     143762

Last EntryId processed: 101234500

Successfully detached from source [My_Audit_DSN]

Exiting Import...

    The preview results note that there are a fairly large number of CA Access Control events to import. Suppose for this example that you only need to import the events that occurred in a two-month period. You can tailor the preview command to import a smaller group of events by date.

  2. Change the import parameters to include a date range and run the preview again with the following command: 
    LMSeosImport.exe -dsn My_Audit_DSN -user sa -password sa -target My_CA-ELM_Server -log "eTrust Access Control" -mintm 2008-11-01 -maxtm 2009-12-31 -preview

    The amended command shows information like the following:

    Import started on Fri Jan  2 15:41:23 2009


No transport specified, defaulting to SAPI...

Preparing ODBC connections...

Successfully attached to source [My_Audit_DSN]

No starting ENTRYID specified, using minimum ENTRYID of 1...

Import (preview) running, please wait...

.........

Import (preview) Completed (143762 records in 4 minutes 37 seconds).

---------- Imported Events (preview) By Log ----------

eTrust AC :     2349

Last EntryId processed: 5167810102

Successfully detached from source [My_Audit_DSN]

Exiting Import...

    This import preview shows that the date range results in a smaller subset of events to import. You are now ready to run the actual import.

More information:

Preview Import Results

Understand the LMSeosImport Command Line

Import CA Access Control Events

After you run the event report and an import preview, you are ready to import CA Access Control events from the SEOSDATA table.

To import CA Access Control events

Use the command from the preview without the -preview option to retrieve the CA Access Control events from the named date range:

LMSeosImport.exe -dsn [My_Audit_DSN] -user sa -password sa -target [My-CA-ELM-Server] -log "eTrust Access Control" -mintm 2008-11-01 -maxtm 2009-12-31

The utility displays results like the following:

Import started on Fri Jan  2 15:41:23 2009


No transport specified, defaulting to SAPI...

Preparing ODBC connections...

Successfully attached to source [My_Audit_DSN]

No starting ENTRYID specified, using minimum ENTRYID of 1...

Import running, please wait...

.........

Import Completed (143762 records in 5 minutes 18 seconds).

---------- Imported Events (preview) By Log ----------

eTrust AC :     2241

Last EntryId processed: 5167810102

Successfully detached from source [My_Audit_DSN]

Exiting Import...

More information:

Import Events from a Windows Collector Database

Import Events from a Solaris Collector Database

Understand the LMSeosImport Command Line

View Queries and Reports to See CA Access Control Events

CA User Activity Reporting Module provides a number of queries and reports for examining events collected from CA Access Control. Use the procedure that follows to access CA Access Control queries and reports.

To access CA Access Control queries

  1. Log into the CA User Activity Reporting Module server as a user with rights to view queries and reports.
  2. Access the Queries sub-tab on the Queries and Reports tab, if it is not already displayed.

    This picture shows the list of available tags in the Queries sub-tab, with the CA Access Control query tag highlighted.

  3. Click the CA Access Control query tag, to display the available queries in a list on the left.

    This pictures shows the list of queries that displays when you select the CA Access Control query tag.

  4. Select a query to view the event data.

To access CA Access Control reports

  1. Log into the CA User Activity Reporting Module server as a user with rights to view queries and reports.
  2. Access the Reports sub-tab on the Queries and Reports tab, if it is not already displayed.

    This pictures shows the list of reports with the CA Access Control tag highlighted.

  3. Click the CA Access Control report tag to display the available reports in a list on the left.

    This picture shows a list of the reports under the CA Access Control report tag.

  4. Select a report to view the event data.

Securing CA User Activity Reporting Module Using CA Access Control

To secure CA User Activity Reporting Module using CA Access Control, you must install CA Access Control on CA User Activity Reporting Module. You can control user access and secure audit logs received from a product or generated by CA User Activity Reporting Module by creating rules on CA Access Control.

Note: For information about creating rules on CA Access Control, see the CA Access Control documentation set.

Example: Create a Rule that Monitors User Access to the /data Folder

Suppose that you want to create a rule on CA Access Control that monitors user access to the /data folder of CA User Activity Reporting Module, do the following:

  1. Navigate to the installation path of CA Access Control.

    Default Installation Path: /opt/CA/Access Control

  2. Execute the following command: 
    selang

    The CA Access Control command line interpreter is displayed.

  3. Execute the following command: 
    nr GFILE CA_ELM_DBFILES owner(nobody) warning

    A new resource group CA_ELM_DBFILES is created for the DBFiles.

  4. Execute the following command: 
    newres FILE /data/hot/* owner(nobody) defaccess(none) warning audit(failure)

    A new resource rule is created for the CA User Activity Reporting Module hot database files.

  5. Execute the following command: 
    newres FILE /data/raw/* owner(nobody) defaccess(none) warning audit(failure)

    A new resource rule is created for the CA User Activity Reporting Module raw database files.

  6. Execute the following commands: 
    editres GFILE CA_ELM_DBFILES mem+(/data/hot/*)

    The resource rule for the CA User Activity Reporting Module hot database files is added to CA_ELM_DBFILES.

  7. Execute the following commands: 
    editres GFILE CA_ELM_DBFILES mem+(/data/raw/*)

    The resource rule for the CA User Activity Reporting Module raw database files is added to CA_ELM_DBFILES.

  8. Execute the following command: 
    authorize GFILE CA_ELM_DBFILES uid(caelmservice) access(all)

    The message 'Successfully added caelmservice to CA_ELM_DBFILES's ACL' is displayed. A rule is created to monitor user access to the /data folder of CA User Activity Reporting Module.

  9. (Optional) Execute the following command to view the activities performed by a user on the hot database files and raw database files of CA User Activity Reporting Module: 
    seaudit -a

More information:

Prerequisites

Prerequisites

Before you create rules on CA Access Control, do the following:

Note: For information about installation procedures on Linux, see the CA Access Control documentation set.