AnsweredAssumed Answered

DAG or alternatives for collecting server accounts

Question asked by Sandeep Sharma on Sep 13, 2017
Latest reply on Sep 2, 2020 by Ian Staines

Like • Show 1 Like1
Comment • 4

Hi,

One of the clients is looking at using L&G for collecting Windows (2008,2012 etc.) and Unix (Solaris, Linux, AIX etc.) server accounts. They have a few hundred servers.

1. Technically can DAG module (StealthAudit v7.1) be used to collect server account information? L&G collector(s) - multi-app etc. can then collect these servers and accounts as different applications? Does DAG licensing for L&G allow this?

2. If not DAG, has anyone tried achieving this using custom scripts to get information remotely. Then L&G CSV based collector(s) - multi-app etc. can be used to collect this information?

The business case is to review server access via access certification reviews for audit/ compliance.

Any thoughts on this are welcome as it is not a uncommon requirement i believe.

Regards,

Sandeep

No one else has this question

Outcomes

Pradeep Kadambar

Sep 13, 2017 8:47 AM

Technically both 1 & 2 are possible.

StealthAudit OEM license can be used to collect Windows local accounts but not UNIX accounts. For UNIX you will need to purchase the license directly from Stealthbits.

Alternatively if you have the resources then you can write scripts to collect these accounts and groups from endpoints and dump it into a file or database and be collected like regular applications. But there is no point in reinventing the wheel when there are third part tools that do this like StealthAudit, Varonis ...

1 person found this helpful

Actions

Sandeep Sharma @ Pradeep Kadambar on Sep 13, 2017 9:51 AM

Thanks for your reply Pradeep

I shall certainly propose DAG (with appropriate license). Alternatively, custom scripts would be the way to go, in case budget or having an additional server (Windows) is a constraint.

The client has a big development team and they might already have some 3rd party tool or scripts which I can leverage and integrate with L&G.

Just read Boris Lekumovich post as well Account collection from *NIX servers. How to. which is relevant!

Actions

Chuck Good @ Sandeep Sharma on Sep 26, 2017 2:54 PM

StealthAudit also makes collecting AD group sets as an application easier to do. Say you have 100 groups that make up an application. Writing that in an AD query is cumbersome. If you have StealthAudit you can write a database collector and get the information using SQL.

Actions

4 Replies

Pradeep Kadambar Sep 13, 2017 8:47 AM
Mark Correct
Correct Answer
Technically both 1 & 2 are possible.

StealthAudit OEM license can be used to collect Windows local accounts but not UNIX accounts. For UNIX you will need to purchase the license directly from Stealthbits.

Alternatively if you have the resources then you can write scripts to collect these accounts and groups from endpoints and dump it into a file or database and be collected like regular applications. But there is no point in reinventing the wheel when there are third part tools that do this like StealthAudit, Varonis ...
1 person found this helpful
Like • Show 2 Likes2
Actions
- Sandeep Sharma @ Pradeep Kadambar on Sep 13, 2017 9:51 AM
  Mark Correct
  Correct Answer
  Thanks for your reply Pradeep
  I shall certainly propose DAG (with appropriate license). Alternatively, custom scripts would be the way to go, in case budget or having an additional server (Windows) is a constraint.
  
  The client has a big development team and they might already have some 3rd party tool or scripts which I can leverage and integrate with L&G.
  
  Just read Boris Lekumovich post as well Account collection from *NIX servers. How to. which is relevant!
  Like • Show 0 Likes0
  Actions
  - Chuck Good @ Sandeep Sharma on Sep 26, 2017 2:54 PM
    Mark Correct
    Correct Answer
    StealthAudit also makes collecting AD group sets as an application easier to do. Say you have 100 groups that make up an application. Writing that in an AD query is cumbersome. If you have StealthAudit you can write a database collector and get the information using SQL.
    Like • Show 0 Likes0
    Actions
Ian Staines Sep 2, 2020 7:02 PM
Mark Correct
Correct Answer
Also check out this recent announcement.

RSA Announces Updated Capabilities for Unstructured Data Collection for Data Access Governance (DAG Module) and End of Primary Support (EOPS) for Current OEM Unstructured Data Crawler/Aggregation Capabilities
Like • Show 0 Likes0
Actions

DAG or alternatives for collecting server accounts

Outcomes

Related Content

Recommended Content