Activate the Database Collector - Administrator Guide - Cortex XDR - Cortex

Activate the Database Collector - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Pro Administrator Guide

Product

Cortex XDR

License

Pro

Creation date

2024-07-16

Last date published

2024-12-12

Notice

Ingesting logs and data from external sources requires a Cortex XDR Pro per GB license.

The Broker VM provides a Database Collector applet that enables you to collect data from a client relational database directly to your log repository for query and visualization purposes. After you activate the Database Collector applet on a Broker VM in your network, you can collect records as datasets (<Vendor>_<Product>_raw) by defining the following.

Database connection details, where the connection type can be MySQL, PostgreSQL, MSSQL, and Oracle. Cortex XDR uses Open Database Connectivity (ODBC) to access the databases.
Settings related to the query details for collecting the data from the database to monitor and upload to Cortex XDR .

Danger

Before activating the Database Collector applet, review and perform the following:

Configure the Broker VM

How to activate the Database Collector

Select Settings → Configurations → Data Broker → Broker VMs.
In either the Brokers tab or the Clusters tab, locate your Broker VM.
You can either right-click the Broker VM and select Add App → DB Collector, or in the APPS column, left-click Add → DB Collector.
Configure your Database Collector settings.
Database Connection
Connection
Select the type of database connection as MySQL, PostegreSQL, MSSQL, or Oracle.
Host
Specify the hostname or IP address of the database.
Port
Specify the port number of the database.
Database
Specify the database name for the type of database configured. This field is relevant when configuring a Connection Type for MySQL, PostegreSQL, and MSSQL.
When configuring an Oracle connection, this field is called Service Name, so you can specify the name of the service.
Enable SSL
Select whether to Enable SSL (default) to encrypt the data while in transit between the database and the Broker VM.
Username
Specify the username to access the database.
Password
Specify the password to access the database.
Test Connection
Select to validate the database connection.
Database Query
Rising Column
Specify a column for the Database Collector applet to keep track of new rows from one input execution to the next. This column must be included in the query results.
Retrieval Value
Specify a Retrieval Value for the Database Collector applet to determine which rows are new from one input execution to the next. Cortex XDR supports configuring this value as an integer or a string that contains a timestamp. The following string timestamp formats are supported: ISO 8601 format, RFC 2822 format, date strings with month names spelled out, such as “January 1, 2022”, date strings with abbreviated month names, such as “Jan 1, 2022", and date strings with two-digit years- MM/DD/YY.
The first time the input is run, the Database Collector applet only selects those rows that contain a value higher than the value you specified in this field. Each time the input finishes running, the Database Collector applet updates the input's Retrieval Value with the value in the last row of the Rising Column.
(Optional) Unique IDs
Specify the column name(s) to match against when multiple records have the same value in the Rising Column. This column must be included in the query results. This is a comma separated field that supports multiple values. In addition, when specifying a Unique IDs, the query should use the greater than equal to sign (>=) in relation to the Retrieval Value. If the Unique IDs is left empty, the user should use the greater than sign (>).
Collect Every
Specify the execution frequency of collection by designating a number and then selecting the unit as either Seconds, Minutes, Hours, or Days.
Vendor and Product
Specify the Vendor and Product for the type of data being collected. The vendor and product are used to define the name of your Cortex Query Language (XQL) dataset (<Vendor>_<Product>_raw).
SQL Query
Specify the SQL Query to run and collect data from the database by replacing the example query provided in the editor box. The question mark (?) in the query is a checkpoint placeholder for the Retrieval Value. Every time the input is run, the Database Collector applet replaces the question mark with the latest checkpoint value (i.e. start value) for the Retrieval Value.
Generate Preview
Select Generate Preview to display up to 10 rows from the SQL Query and Preview the results. The Preview works based on the Database Collector settings, which means that if after running the query no results are returned, then the Preview returns no records.
(optional) Add Query
To define another Query for data collection on the configured database connection, select Add Query. Another Query section is displayed for you to configure.
(optional) Add Connection to define another database connection to collect data from another client relational database.
(optional) Other available options.
As needed, you can return to your Database Collector settings to manage your connections. Here are the actions available to you.
- Edit the connection name by hovering over the default Collection name, and selecting the edit icon to edit the text.
- Edit the query name by hovering over the default Query name, and selecting the edit icon to edit the text.
- Disable/Enable a query by hovering over the top area of the query section, on the opposite side of the query name, and selecting the applicable button.
- Delete a connection by hovering over the top area of the connection section, on the opposite side of the connection name, and selecting the delete icon. You can only delete a connection when you have more than one connection configured. Otherwise, this icon is not displayed.
- Delete a query by hovering over the top area of the query section, on the opposite side of the query name, and selecting the delete icon. You can only delete a query when you have more than one query configured. Otherwise, this icon is not displayed.
Activate the Database Collector applet.
After a successful activation, the APPS field displays DB with a green dot indicating a successful connection.
(Optional) To view metrics about the Database Collector, left-click the DB connection in the APPS field for your Broker VM.
Cortex XDR displays Resources, including the amount of CPU, Memory, and Disk space the applet is using.
Manage the Database Collector.
After you activate the Database Collector, you can make additional changes as needed. To modify a configuration, left-click the DB connection in the APPS column to display the Database Collector settings, and select:
- Configure to redefine the Database Collector configurations.
- Deactivate to disable the Database Collector.
You can also Ingest Database Data as Datasets.