Monitoring, Alerts, and Incident Response
Alerts
Alert Builder defines policy alerts, system alerts, and threshold alerts. Receivers include email, SNMP, and syslog, which is how Guardium feeds a SIEM. System alerts cover disk, S-TAP down, aggregation failure, and service health. Policy alerts fire from rules with an alert action. Real-time dashboards show sessions and recent alerts for triage.
Incident response
Detect, triage, contain, document. Use session detail and the audit trail to confirm what happened, then contain with a blocking policy if the S-TAP supports it. Record the alert ID, the session, and the policy change for the audit file.
Worked example
An S-TAP-down system alert fires for a production database host. Check GIM and the host service, restart the tap, confirm the collector sees sessions, and close the alert. Separately, a DDL alert fires: open the session, identify the user and object, confirm whether it was a change window, and document. If it was not authorized, install a deny rule and verify enforcement.
Traps
Configuring alerts only on the collector and expecting the CM to see them; SMTP relay failures; thresholds set in the wrong units; alert storms from overly broad policy rules.