logs

Security

Regulatory requirements in various countries require that the event of viewing personally identifying information (PII) &#8211; such as address, full name, or ID &#8211; should be logged and monitored for future audit.
Regulatory requirements in various countries require that viewing sensitive data that can identify a person must be logged and monitored for future audit. This requirement applies to whenever someone is viewing identifiable information related to a person (such as address, full name, ID, etc.) the action must be monitored and logged.
This add-on enables the logging of information when any user views row-level data from specific tables and columns.
The level of logs can be modified to contain only the viewed field names or the viewed field values, as well.
<img loading="lazy" class="alignnone" src="https://cdn.sisense.com/wp-content/uploads/2018-07-18_10h54_09.png" alt="" width="1436" height="919" />

__hr-image-unique-image-unique

__HR

The Monitoring Sensitive Data add-on consists of three components:
<ol>
<li>Server-side microservice (Windows) or an external plugin (Linux): Creates a new POST logger REST API endpoint that logs data to the configured logs database. 
<img loading="lazy" class="alignnone" src="https://cdn.sisense.com/wp-content/uploads/rest-api-logs-db.png" alt="" width="1365" height="712" /></li>
<li>Client-side plugin: Notifies the user if sensitive PII is viewed.</li>
<li>Server-side plugin: Intercepts JAQL requests to detect if sensitive PII is viewed.</li>
</ol>
<h4>Installation</h4>
Windows:
<ol>
<li>Download and extract the add-on .zip file.</li>
<li>Install the client-side plugin by copying the folder ./monitoringSensitiveData into the Sisense plugins folder: 
C:\Program Files\Sisense\app\plugins
<ul>
<li>If the folder doesn’t exist, create it.</li>
</ul>
</li>
<li>Configure the client-side add-on as described below.</li>
<li>To install the microservice, run the PSE.Sisense.MonitoringSensitiveData.msi installer from the archive file.</li>
<li>Configure the microservice as described below.</li>
<li>Restart the windows service Sisense.MonitoringSensitiveData to apply the configuration changes.</li>
<li>To install the server-side plugin, go to http://localhost:3030/ to open System Configuration.
<ol>
<li>Click the Sisense top left logo five times to view advanced configurations. 
<img loading="lazy" class="alignnone" src="https://cdn.sisense.com/wp-content/uploads/advanced-config.png" alt="" width="1600" height="405" /></li>
<li>Click the Api-Gateway section.</li>
<li>Under ServerSidePlugins, enable serverSidePlugins.enabled.</li>
<li>Locate the ./monitorSensativeDataInterceptors folder under serverSidePlugins.dirPath.</li>
<li>Click  Save Changes.</li>
</ol>
</li>
<li>Configure the server-side plugin as described below.</li>
<li>Restart the API-Gateway service by clicking Restart Services. 
<img loading="lazy" class="alignnone" src="https://cdn.sisense.com/wp-content/uploads/restart-services.png" alt="" width="1252" height="349" /></li>
<li>Refresh the dashboard.</li>
</ol>
Linux:
<ol>
<li>Download the installation package for Linux.</li>
<li>Upload {pluginName}.tar.gz to the root folder /opt/sisense/storage or any other location using the File Manager or SSH.</li>
<li>Connect to your server via SSH.</li>
<li>Go to the plugin file folder and extract it: 
`cd /opt/sisense/storage &amp;&amp; tar -zxvf {pluginName}.tar.gz`</li>
<li>Navigate to the unarchive plugin folder: cd {pluginName}</li>
<li>Run the installation script: 
chmod +x install_plugin.sh &amp;&amp; sh install_plugin.sh 
Note: An external-plugins pod is restarted in Kubernetes. Make sure the service is up and running.</li>
<li>Configure the client-side add-on: 
Configure /opt/sisesnse/storage/plugins/monitoringSensitiveData/config.js file (read more below). 
Configure the interceptor: 
Open the <a href="https://documentation.sisense.com/latest/administration/system-settings/configmgr_linux.htm#gsc.tab=0">Configuration Manager page</a>. 
<img loading="lazy" class="alignnone" src="https://cdn.sisense.com/wp-content/uploads/sys-config.png" alt="" width="1600" height="812" /> 
Scroll to the bottom of the page and click Show Advanced  
Expand the Server Side Plugins section and enable the server side plugins. 
<img loading="lazy" class="img-polaroid alignnone" src="https://cdn.sisense.com/wp-content/uploads/server-side-plugin-1-370x168.png" alt="" width="370" height="168" /> 
Click Save. 
Confirm that serverSidePlugins.dirPath is identical to the located interceptors path.</li>
<li>Configure  the interceptor: 
./opt/sisesnse/storage/serverSidePlugins/monitorSensitiveDataInterceptors/config.js file (read more below).</li>
<li>Refresh the dashboard.</li>
</ol>
<h4>Configuration</h4>
Configuring the client-side add-on:
The configuration file is located under ./plugins/monitoringSensitiveData/config.js 
Configure sensitiveDataConf to set the text presented to the user when viewing sensitive PII.
<img loading="lazy" class="alignnone" src="https://cdn.sisense.com/wp-content/uploads/sensitive-data.png" alt="" width="786" height="111" />
Configuration file example:
<img loading="lazy" class="alignnone" src="https://cdn.sisense.com/wp-content/uploads/config-file-eg.png" alt="" width="587" height="375" />
<ul>
<li>message The message presented when the user navigates to a dashboard that contains sensitive PII</li>
<li>dismiss  Dismiss sensitive data popup button text</li>
<li>doNotShowAgain  “Do not show again” sensitive data popup button text</li>
<li>linkUrl  URL to redirect to when clicking the link button (More details)</li>
<li>linkName Link button name (More details)</li>
<li>allowLink  true/false, to show or hide the link</li>
<li>allowDoNotShowAgain  true/false. Set to true to permanently present the dismiss sensitive data viewed popup</li>
<li>show true/false. Set to true to enable the sensitive data viewed popup</li>
</ul>
<h4>Configuring the Server-side plugin:</h4>
The Configuration file location is:
Windows: C:/Program Files/Sisense/app/monitoringSensitiveDataService/config.js
Linux: /opt/sisense/storage/external-plugins/apiPlugins/plugins/monitoringSensitiveData/v1/config.js
<img loading="lazy" class="alignnone" src="https://cdn.sisense.com/wp-content/uploads/config-server-side-plugin.png" alt="" width="512" height="509" />
In the server-side configuration file, you can configure which data is considered sensitive PII, and which actions should be logged:
<ul>
<li>dataForLogs: A list of all columns or tables that are considered sensitive PII and should be logged by their names</li>
<li>dataDims: A list of all columns that are considered sensitive PII and should be logged by their value.</li>
<li>monitoredActions: A list of user actions that should be logged in case of viewing sensitive PII.</li>
</ul>
<h4>Configuring the External-plugin/Microservice</h4>
The Configuration file location is :
Windows: C:/Program Files/Sisense/app/monitoringSensitiveDataService/config.js
Linux: /opt/sisense/storage/external-plugins/apiPlugins/plugins/monitoringSensitiveData/v1/config.js
<img loading="lazy" class="alignnone" src="https://cdn.sisense.com/wp-content/uploads/config-micros-service.png" alt="" width="1371" height="732" />
<ul>
<li>appConfig logger configuration
<ul>
<li>activeLogger: The active database logger, which uses MSSQL or MongoDB.</li>
<li>loggerFilePath: The absolute path to the log file.</li>
<li>maxLogFileSize: The maximum size of the log file. When the file size exceeds this value, a new log file is created with the incremented suffix number.</li>
<li>maxLogFilesDaysLifeTime: The allowed storage time. The log files will be automatically removed after this time expires.</li>
</ul>
</li>
<li>mongoConfig (optional): MongoDB configurations should be set in case the active log was set to mongodb
<ul>
<li>sourceDB: The log database name. The database must be created.</li>
<li>sourceTable. The log table name. The table will be created automatically if it does not already exist. 
<img loading="lazy" class="alignnone" src="https://cdn.sisense.com/wp-content/uploads/source-table-log-name.png" alt="" width="194" height="192" /></li>
<li>connectionString: The MongoDB connection string. Use the following guide to create a user for Sisense MongoDB authentication: <a href="https://documentation.sisense.com/latest/administration/application-database/access-sisense-application-database.htm">https://documentation.sisense.com/latest/administration/application-database/access-sisense-application-database.htm</a></li>
</ul>
</li>
<li>mssqlConfig (optional). MSSQL configurations should be set in case the active log was set to MSSQL.
<ul>
<li>sourceDB: The log database name.  The database must be created.</li>
<li>sourceTable: The log table name. The table must be created. 
<img loading="lazy" class="alignnone" src="https://cdn.sisense.com/wp-content/uploads/source-table-create.png" alt="" width="422" height="187" /></li>
<li>connectionString: The MSSQL connection string.</li>
<li>encrypt true/false. Defines if the connection will be encrypted.</li>
</ul>
</li>
</ul>
Notes:
<ul>
<li>FieldToLog will be the actual name of the column from the ElastiCube. If there are multiple columns to log, they will all be specified in a table.</li>
<li>Dashboard ID instead of the dashboard name is logged when exporting to Excel.</li>
<li>Monitor Sensitive data supports only MSSQL or MongoDB as logs databases.</li>
</ul>

Get the Add-on

Leave Feedback