Skip to main content

IBM Guardium Data Protection

IBM Guardium Data Protection is a comprehensive data security and compliance platform that provides real-time monitoring, auditing, and protection for sensitive data across databases, data warehouses, file systems, and big data environments. This enterprise-grade solution helps organizations discover, classify, and protect sensitive information while maintaining detailed audit trails for compliance and security investigations.

CategoryVulnerability management
DirectionQuery source
Sign-inUsername & Password
Query languagesSTIX
Websiteibm.com

Before you start​

Huntbase signs in to IBM Guardium Data Protection with Username & Password. Create the credential in IBM Guardium Data Protection first, then keep it to hand for the Connect step.

  1. Log in to the CLI of the Guardium collector.
  2. Register an OAuth client by running grdapi register_oauth_client client_id=<name> grant_types="password".
  3. Copy the client_secret value from the JSON output.
  4. Choose the Guardium user whose username and password Huntbase will use.
Watch out for
  • Quick search must be enabled and include "Policy violation", and active threat analytics must be enabled.

For the vendor's own instructions, see IBM Guardium REST API documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect IBM Guardium Data Protection​

  1. Go to Connections and click New connection, or click New connection on the IBM Guardium Data Protection product page.
  2. On Product, pick IBM Guardium Data Protection and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your IBM Guardium Data Protection lives:

FieldRequiredNotes
Server AddressYesSpecify the IP address or hostname of the data source.
PortYesThe Guardium REST API port, usually 8443. Defaults to 8443.
Client IDYesThe client_id you passed to grdapi register_oauth_client.
Client SecretYesThe client_secret returned by grdapi register_oauth_client.
Self-Signed Cert (PEM)NoProvide a self-signed or CA-signed certificate to securely communicate with the data source.

Credentials​

The only Method is Username & Password. Enter a Credential label (for example Production), then fill in:

FieldRequiredNotes
UsernameYesUsername with access to the search API. Secret — not shown again after you save it.
PasswordYesPassword of the user with access to the search API. Secret — not shown again after you save it.

Query it​

Once connected, IBM Guardium Data Protection can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
STIXSTIX patterns for indicator sweeps, translated into the product's native search.

Next steps​