Версия: 4.5.X

Интеграция с SearchInform DLP

Собирать события с SearchInform DLP можно с помощью SQL-коллектора.

Ниже представлен шаблон запроса.

Инициализирующий запрос:

SELECT MAX(ResultID)-1 AS "ECS.Event.ID"
FROM AlertResults

Регулярный запрос:

SELECT TOP (1000) 
        [ResultID] AS "ECS.Event.ID"
    ,[InterceptTime] AS "ECS.Event.Ingested"
    ,[DisplayName] AS "ECS.Rule.Name"
    ,[user_to_sort] AS "ECS.User.Name"
    ,[SearchSummary] AS "ECS.Rule.Category"
       ,AlertResults.IndexDocumentID
    ,[DocumentExt] AS "ECS.File.Type"
       ,[DocumentName] AS  "ECS.File.Name"
    ,[InterceptIP] AS "ECS.Host.IP"
    ,[InterceptMAC] AS "ECS.Host.MAC"
    ,[to_addr] AS "ECS.Destination.IP"
    ,[from_addr] AS "ECS.URL.Domain"
   
  FROM [alertcenter].[dbo].[AlertResults]
  LEFT JOIN [ReportCenter].[dbo].[AC_Alerts]
  ON AlertResults.AlertID = AC_Alerts.AlertID
  LEFT JOIN [alertcenter].[dbo].[IndexDocuments]
  ON IndexDocuments.IndexDocumentID = AlertResults.IndexDocumentID
WHERE ResultID > $1