Fortinet FortiDB

Rule Chaining Chaining with Parameterized User-Defined Rules

FortiDB Version 3.2 Utilities User Guide

15-32000-81369-20081219 15

Policy Settings for Suspicious Login Time

2Create a UBM Session Policy, our Source rule, in order to monitor BAD_GUY and

generate an alert to trigger our Target rule, a PUDR. We will pass the Session ID

from the Source to the Target rule.

3Create a Target PUDR, in the UBM module, which will contain the following kill-

session code. That code, in turn, will accept our passed Session ID parameter

(shown in red):

Contents

Main Page Table of Contents Page FortiDB MA Utilities Auto Discovery Page DB2 MS-SQL Page Page Rule Chaining Page Chaining with Parameterized User-Defined Rules General PUDR Steps PUDR Process Page Page Page Page Alert Behavior Table Columns That Could Appear in Alerts Multiple Source-Rule-Violation Behavior PUDR Alert Behavior with Multiple SELECT-List Objects in the Violating SQL State- ment Page Report Manager Alert Report Manager Setting a Report Schedule Setting a Timer-based Schedule Deleting a Previously Set Timer Schedule Setting a Calendar-based Schedule Setting a Combined Schedule Setting a Randomized Interval Page Page Page Page Page Report Summary Action Report Detailed Action Limitation Custom Reports Using This Feature Scheduling Page Customer and Company Information Report and Template Generation and Management Adding Reports Modifying Reports Page Modifying Report Templates Generating Reports Report Result Page Page Licensing and Administration Custom Report Properties Limitations Description of Shipped Sample Report SOX Compliance Reports Reports and Acronyms Common Report Header Fields General Setup Instructions SOX Report Specifics History of Privilege Changes Report (HPC) Abnormal or Unauthorized Changes to Data Report (AUC) Abnormal Use of Service Accounts Report (AUS) Abnormal Termination of Database Activity Report (ATD) End of Period Adjustments Report (EPA) Determining Your Reporting Period Case 1 Case 2 Verification of Audit Settings Report (VAS) Licensing and Administration Limitations Archiving Reports Page Index A C D L