IBM Guardium v11.x Admin flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Collector role

A Guardium appliance that captures and normalizes database traffic from S-TAPs and stores audit data locally before forwarding to an aggregator.

Aggregator role

A Guardium appliance that receives audit data from one or more collectors, consolidates it, and provides enterprise-wide reporting and long-term storage.

Central manager role

A Guardium appliance that distributes policies, groups, and configuration to managed units; it does not store collected audit data.

S-TAP

A lightweight software agent installed on a database server that monitors local database traffic and forwards audit events to a Guardium collector.

GIM

Guardium Installation Manager, a component that deploys and updates S-TAPs and other agents on managed hosts from a central GIM server.

Upgrade prerequisite

Before upgrading, the appliance must be at the minimum base version specified in the release notes, and a configuration backup must be taken.

CLI access

Guardium command-line interface accessed via SSH as the guardium user, used for administrative tasks such as restart, backup, and network configuration.

Configuration backup

A backup of the Guardium configuration and internal database, stored off-appliance, used to restore the system after failure or before an upgrade.

Purge and archive

The process that moves older audit data from the collector to the aggregator or external storage according to configured retention periods.

Health monitor

A Guardium feature that tracks CPU, memory, disk, and process status and can generate alerts when configured thresholds are breached.

Data source definition

A Guardium configuration object that specifies the database type, host, port, and monitoring credentials, and associates the data source with an S-TAP.

S-TAP local mode

The default S-TAP operating mode in which captured database traffic is sent directly to the assigned Guardium collector for normalization and storage.

Monitoring user privileges

The database account used by Guardium should have only the minimum privileges required for monitoring, such as read access to system views.

Data source discovery

The process by which Guardium identifies database instances on the network or via S-TAP; discovered instances must be reviewed and approved before monitoring.

Guardium policy rule

A rule with a condition (who, what, where, when) and an action (allow, block, log, alert, or quarantine) evaluated in order during policy enforcement.

Rule evaluation order

Guardium evaluates policy rules top-down; the first matching rule determines the action, so specific rules must be placed before general rules.

Policy simulation mode

A mode in which a policy logs rule matches without blocking traffic, used to test policy behavior before enforcement.

Fail-open behavior

The S-TAP behavior when the collector is unreachable; if configured to fail open, database traffic continues without enforcement.

Compliance report

A predefined Guardium report that maps audit events to control objectives for standards such as PCI DSS, SOX, GDPR, or HIPAA.

Audit data retention

The period for which audit data must be kept to satisfy compliance requirements; the purge process must not delete data before this period ends.

Report scheduling

The configuration that determines when a Guardium report runs and how it is delivered, such as by email or to a shared location.

Guardium RBAC

Role-based access control that restricts users to the functions and data sources permitted by their assigned roles, such as admin, supervisor, operator, or auditor.

LDAP group mapping

The configuration that maps external LDAP directory groups to Guardium roles, so users inherit roles based on their directory group membership.

SSO integration

Authentication through an identity provider using SAML or OIDC, with Guardium acting as the service provider and the local guardium account remaining available.

Audit data encryption

Guardium encrypts audit data at rest using AES-256; the encryption keys must be backed up because lost keys make data unrecoverable.

TLS between components

TLS/SSL encrypts communication between S-TAPs and collectors and between collectors and aggregators; certificates must be valid and trusted.

Key rotation

The process of replacing encryption keys according to organizational policy, including re-encrypting data with the new key and securely retiring the old key.

Managed unit registration

The process by which a collector or aggregator registers with the central manager using a shared secret or certificate to establish trust.

Policy distribution

The central manager pushes policies to multiple collectors simultaneously and reports the installation status for each managed unit.

Guardium alert

A notification triggered by a policy violation, system health threshold, or audit event pattern, delivered by email, SNMP, or syslog.

Anomaly detection

A Guardium feature that baselines normal database activity and alerts on deviations; it requires a learning period before alerts are reliable.

S-TAP connectivity issue

A common problem where the S-TAP cannot reach the collector, often caused by network, certificate trust, or firewall issues; check S-TAP logs.