Fortinet FortiDB Rule Chaining

Rule Chaining MS-SQL

FortiDB Version 3.2 Utilities User Guide

15-32000-81369-20081219 9

Rule Chaining

The Rule Chaining module allows you to associate rules so that one, the source1

rule, can influence the execution of another, the target2 rule. Both rules are

established with the same target database.

Rule Chaining Setting Screen

FortiDB MA offers two types of chained-rule pairs:

• Rule pairs in which there are no parameters passed. (In this case, you may

use Guarded Items from Privilege Monitor (PM), Metadata monitor (MM),

Content Monitor (CM), and User Behavior Monitor (UBM))

• Rule pairs in which there are parameters passed(In this case, you may use

Guarded Items only from User Behavior Monitor (UBM))

You invoke Rule Chaining from the tree navigator on the left.

1. This is sometimes called the original rule.

2. This is sometimes called the chained rule.

Contents

Main Page Table of Contents Page FortiDB MA Utilities Auto Discovery Page DB2 MS-SQL Page Page Rule Chaining Page Chaining with Parameterized User-Defined Rules General PUDR Steps PUDR Process Page Page Page Page Alert Behavior Table Columns That Could Appear in Alerts Multiple Source-Rule-Violation Behavior PUDR Alert Behavior with Multiple SELECT-List Objects in the Violating SQL State- ment Page Report Manager Alert Report Manager Setting a Report Schedule Setting a Timer-based Schedule Deleting a Previously Set Timer Schedule Setting a Calendar-based Schedule Setting a Combined Schedule Setting a Randomized Interval Page Page Page Page Page Report Summary Action Report Detailed Action Limitation Custom Reports Using This Feature Scheduling Page Customer and Company Information Report and Template Generation and Management Adding Reports Modifying Reports Page Modifying Report Templates Generating Reports Report Result Page Page Licensing and Administration Custom Report Properties Limitations Description of Shipped Sample Report SOX Compliance Reports Reports and Acronyms Common Report Header Fields General Setup Instructions SOX Report Specifics History of Privilege Changes Report (HPC) Abnormal or Unauthorized Changes to Data Report (AUC) Abnormal Use of Service Accounts Report (AUS) Abnormal Termination of Database Activity Report (ATD) End of Period Adjustments Report (EPA) Determining Your Reporting Period Case 1 Case 2 Verification of Audit Settings Report (VAS) Licensing and Administration Limitations Archiving Reports Page Index A C D L