IBM Guardium v11.x Admin cheat sheet

The Guardium architecture separates the collector (which captures and normalizes database traffic) from the aggregator (which stores and consolidates audit data) and the central manager (which distributes policy and configuration to managed units).

A standalone unit performs collection, aggregation, and central management on one appliance; a distributed deployment separates these roles across multiple appliances for scale and fault isolation.

The S-TAP is a lightweight agent on the database server that monitors local traffic and forwards it to the collector; it does not store audit data locally.

The Guardium Installation Manager (GIM) is the mechanism for deploying and updating S-TAPs and other agents on managed hosts; it requires a GIM client on the host and a GIM server on the collector.

Supported upgrade paths require the appliance to be at a minimum base version before applying the target patch; check the release notes for the exact prerequisite build.

Before an upgrade, back up the system configuration and the internal database, and verify that sufficient disk space exists in /var and the Guardium partitions.

The collector and aggregator must run the same major version; the central manager should be upgraded before or simultaneously with its managed units.

Virtual appliance deployment uses OVA/OVF images; the appliance requires a static IP, correct DNS and NTP configuration, and a valid license before it becomes fully operational.

The Guardium system time must be synchronized via NTP across all units; clock skew between collector and aggregator causes aggregation and reporting inconsistencies.

The CLI is accessed via SSH as the guardium user and then elevated; administrative commands include restart, backup, restore, and network configuration.

The internal database (typically Db2 or Derby depending on version) stores configuration, policy, and audit metadata; it is backed up separately from the collected audit data.

Scheduled backups should include the configuration backup and the internal database backup; store backups off-appliance to survive appliance loss.

The purge and archive process moves older audit data from the collector to the aggregator or to external storage; retention periods are set per data source or globally.

The appliance health monitor tracks CPU, memory, disk, and process status; alerts can be configured for threshold breaches.

System patches are applied through the Guardium patch installer or the CLI; always review the patch release notes for dependency and rollback information.

The support information collection (diag) gathers logs and configuration for IBM support; it should be run before contacting support and after any critical failure.

NTP, DNS, and mail relay settings are configured through the CLI or the Guardium UI; incorrect mail relay settings prevent alert notifications from being delivered.

A data source definition in Guardium includes the database type, host, port, and credentials used for monitoring; the S-TAP is associated with the data source on the collector.

The S-TAP can operate in local mode (traffic sent to the collector) or in a proxy mode; the default is local monitoring with the collector receiving the traffic.

For databases that support it, the S-TAP uses a shared memory or inter-process communication mechanism to capture traffic without network interception.

The database credentials used by Guardium for monitoring should have the minimum privileges required; for some databases, a dedicated monitoring user with specific grants is required.

Data source discovery can be performed by the S-TAP or by a network scan; discovered instances must be reviewed and approved before they are monitored.

The S-TAP configuration includes the collector IP, port, and the SSL/TLS settings; the S-TAP must be able to reach the collector on the configured port.

For clustered databases, each node requires its own S-TAP; the data source definition may group nodes for reporting purposes.

The data source must be assigned to a policy and to a group of receivers (collectors) before audit data is captured and stored.

A Guardium policy is a set of rules evaluated in order; each rule has a condition (who, what, where, when) and an action (allow, block, log, alert, or quarantine).

Rules are evaluated top-down; the first matching rule determines the action, so specific rules must precede general ones.

Access rules can be based on source IP, database user, application user, object, command, and time of day; compound conditions use AND/OR logic.

The policy must be installed on the collector for enforcement; installing a policy pushes it to the managed units that are assigned to it.

A policy can be in simulation (audit-only) mode while being tested; simulation mode logs rule matches without blocking traffic.

The S-TAP can enforce blocking only if the collector is reachable and the policy includes a block action; if the collector is unavailable, the S-TAP falls back to the configured fail-open or fail-closed behavior.

Policy violations generate audit events that are stored in the Guardium repository and can trigger alerts or reports.

The policy installation process includes a validation step; errors in rule syntax or group references prevent installation.

Policy versioning allows rollback to a previous policy version if a new policy causes unintended blocking.

The audit process consists of capture (S-TAP), normalization (collector), storage (aggregator), and reporting (central manager or aggregator).

Guardium provides predefined compliance reports for standards such as PCI DSS, SOX, GDPR, and HIPAA; these reports map audit events to control objectives.

Reports are built from queries against the Guardium internal database; report definitions include the data source, time range, and filters.

Scheduled reports can be delivered by email or saved to a shared location; the schedule is configured per report and per recipient group.

The compliance workflow includes evidence collection, review, and sign-off; Guardium can track report reviews and approvals.

Audit data retention must align with compliance requirements; the purge process must not delete data before the required retention period.

The audit trail itself must be protected from tampering; Guardium provides integrity checks and access controls on audit data.

Report results can be exported to CSV, PDF, or XML; exports should be secured because they contain sensitive audit information.

Guardium roles define the permissions granted to users; predefined roles include admin, supervisor, operator, and auditor, each with different access levels.

Role-based access control (RBAC) restricts users to the functions and data sources permitted by their assigned roles.

LDAP integration allows Guardium to authenticate users against an external directory; the LDAP configuration includes the server, base DN, bind credentials, and user search filter.

LDAP group mapping maps directory groups to Guardium roles; users inherit the roles of the groups they belong to.

SSO integration (SAML or OIDC) allows users to authenticate through an identity provider; Guardium acts as the service provider.

The Guardium administrator account (guardium) is a local account that remains available even if LDAP or SSO is unavailable.

User authentication events are logged in the Guardium audit trail; failed login attempts can trigger alerts.

Password policies for local accounts include complexity, expiration, and lockout after failed attempts; these are configured in the Guardium UI or CLI.

Guardium encrypts audit data at rest using AES-256; the encryption keys are managed by the appliance and can be backed up and restored.

TLS/SSL is used for communication between S-TAPs and collectors, and between collectors and aggregators; certificates must be valid and trusted.

The Guardium key management process includes key generation, rotation, and escrow; losing the encryption keys makes audit data unrecoverable.

The appliance supports FIPS 140-2 validated cryptographic modules in some configurations; the FIPS mode must be enabled and verified.

Database credentials stored in Guardium are encrypted; access to these credentials is restricted to authorized roles.

The S-TAP can use SSL to encrypt traffic to the collector; the collector must have a valid certificate and the S-TAP must trust the certificate authority.

Key rotation should be performed according to organizational policy; the rotation process includes re-encrypting data with the new key.

Audit data integrity is protected by checksums and access controls; any tampering with audit records should be detectable.

The central manager distributes configuration, policies, and groups to managed units; it does not store collected audit data.

An aggregator receives audit data from collectors and consolidates it for reporting; it can also perform aggregation from multiple collectors.

Managed units register with the central manager using a shared secret or certificate; the registration process establishes trust.

The central manager can push policies to multiple collectors simultaneously; the policy installation status is reported per unit.

Aggregation can be scheduled or continuous; the schedule determines how often data is moved from collectors to aggregators.

The central manager maintains a inventory of managed units; units that are unreachable are flagged and can generate alerts.

Data from multiple collectors can be aggregated into a single view for enterprise-wide reporting; the aggregator must have sufficient storage for the consolidated data.

The central manager should be deployed in a highly available configuration if it is a single point of failure for policy distribution.

Guardium alerts are triggered by policy violations, system health thresholds, or audit event patterns; alerts can be sent by email, SNMP, or syslog.

Alert definitions include the condition, severity, and notification method; alerts can be associated with specific policies or system events.

The incident response workflow includes detection (alert), triage (review of audit events), containment (blocking or quarantining), and remediation.

The Guardium dashboard provides real-time views of database activity, policy violations, and system health.

The anomaly detection feature baselines normal database activity and alerts on deviations; it requires a learning period.

The S-TAP can be configured to block traffic when a policy violation occurs; this is a containment action that should be used with caution.

Alert notifications should be tested regularly to ensure that the mail relay and SNMP configuration are correct.

Incident evidence should be preserved; Guardium audit records can be exported and stored securely for forensic analysis.

Common S-TAP issues include connectivity to the collector, certificate trust, and insufficient permissions on the database host; check the S-TAP logs for errors.

Collector performance can be tuned by adjusting the number of S-TAPs per collector, the buffer sizes, and the aggregation schedule.

The Guardium internal database performance can be improved by indexing, purging old data, and ensuring sufficient disk I/O.

Network latency between S-TAP and collector can cause packet loss; the S-TAP buffer should be sized to accommodate latency.

The collector's CPU and memory usage should be monitored; high usage may indicate too many S-TAPs or insufficient resources.

The diag command collects logs and configuration for support; it should be run before contacting IBM support.

The Guardium health monitor can be configured to alert on disk space, CPU, and memory thresholds; proactive monitoring prevents outages.

Policy evaluation performance can be improved by ordering rules so that the most frequent matches occur early.