Importing MS SQL using CCS with raw-based data collection in CCS 12.6.x

Products

• Control Compliance Suite
• Control Compliance Suite Standards Server

Issue/Introduction

For Agent-based - Follow all the steps to apply the Control Compliance Suite (CCS) MSSQL plugin to servers that have SQL databases and a CCS agent installed.

For Agent-less - Skip to the bullet items below step 7. Also make sure the Privileges to import an SQL Server Asset are properly configured.

Environment

CCS 12.6.x

Currently supported platforms and databases:

https://techdocs.broadcom.com/us/en/symantec-security-software/information-security/control-compliance-suite/12-x/ccs-support-matrix-v123000389-d8e133191.html

Resolution

1. Ensure the CCS agent is installed on SQL server.  You can also install the SQL plugin manually as well or install it by pushing it out from CCS (see step 5).  Register the CCS agent to the CCS manager.
   (NOTE: The 'Microsoft OLE DB Driver 18 for SQL Server' must be manually installed on the agent server for CCS to be able to collect data.  Please see KB https://knowledge.broadcom.com/external/article?articleId=209481 for more information)
   
   
2. Ensure that a common credential is configured in CCS for All SQL servers. (needed for import)
   • NOTE: Please see the attached document 'CCS Data Collection Privileges Guide' for required privileges for SQL Asset Import (page 22 under 'Privileges to import SQL Server Asset' section)
     
     
3. Run "Fetch Registered Agent" job.
   
   
4. Run "Agent content update" (selecting Microsoft Windows first). This updates the platform content on the agent itself.
   
   
5. Run "Agent content update" (selecting Microsoft SQL). This installs the SQL plugin and SQL content needed to collect data. 
   (NOTE: The 'Microsoft OLE DB Driver 18 for SQL Server' must be manually installed on the agent server for CCS to be able to collect data.  Pushing the SQL Plugin from CCS does not push out the MSSQL OLE driver.  
6. To make sure the content has been applied to the agent, go to 'Asset System' -> 'Agents' and then highlight the agent server and confirm that you have the latest content.
           > Select the Content tab (In the Agent Preview panel on the left)
                   > Expand Raw-based content (this should show Windows and SQL)
   
   
7. Now that you have verified that SQL content is installed on the agent, you need to run an SQL Asset import for CCS to go out and collect information on the SQL databases that are on that agent.

• Run asset import job by selecting the 'Asset Tasks' dropdown and the select 'Import Assets'.
  • Name the asset import job then click 'Next'.
  • in the 'Define Asset Import Source' section
    • select asset type - SQL Server
    • select Source - Network
    • scope - click the green '+' sign and select asset* that has the SQL plugin installed.  Click 'Ok' then 'Next'.
  • Select correct folder to import the SQL assets into.  Check the box for 'Specify additional asset import rules' and then click 'Next'.
  • At the top select 'Add Rules', then in the new pop-up window select 'Pre-defined Rules'.  In the 'Available items' panel highlight the 'Add asset to the Asset System' and 'Update asset' rules and click 'Add' (moving those 2 predefined rules to the 'Selected Items') and then click 'Ok'.  Once back in the 'Specify reconciliation Rules' section click 'Next'.
  • At the 'Specify Asset Import Filters' click 'Next' 
  • At the 'Schedule Job', select 'Run Now'.

Once the Import Asset job completes, the information for the SQL Asset should be populated. 

Make sure you have setup credentials** for CCS to use for your SQL assets data collection in the CCS Credentials section (Admin -> Credentials), and then run a standard on that SQL asset to verify that it is working correctly.

**NOTE: Please see the attached document 'CCS Data Collection Privileges Guide' for required privileges to query a SQL server database (starts on page 21 under 'Minimum required privileges to query a SQL server database' section)

Additional Information

*NOTE: When selecting the asset, you can also select a Folder or an Asset Group or any combination of those.
It may help to tag the Windows Machine assets with something you can use to group those assets together as having SQL Server installed.
Then you can use a dynamic asset group when importing the SQL Server assets.