How do I create a new data source query within ICA for SQL Server data sources?

Products

• Information Centric Analytics
• Data Loss Prevention Core Package

Issue/Introduction

When creating a custom integration via Information Centric Analytics ( ICA ) through the Integration Wizard you will be required to create a data source within Risk Fabric. 

In the current version of ICA we support the ability to create data sources for the following Data Source Types:  SQL Server, Splunk, ArcSight, Dropbox, file systems for flat file integrations, and Q Radar.  This TECH NOTE will guide you through the process of creating a data source query for SQL Server based data sources.   

Resolution

1. Navigate to the Integration application under Admin -> Integration.

_{Figure 1 Navigate to the Integration application through Admin Menu}

2. By accessing the integration menu, ICA will deliver you to the Integration Packs tab by default. This tab displays a comprehensive listing of all Integration Packs configured for your instance of ICA.  By default, there are no integration packs configured for ICA.  In the figure below, you can see that there are two Integration Packs configured in our demonstration system, the Risk Fabric Active Directory Integration Pack and the Risk Fabric Symantec Data Loss Prevention Integration Pack.   

_{Figure 2 This figure depicts the Integration Packs tab}

3. Navigate to the Data Sources tab next to the Integration Packs tab.  The Data Sources Tab will provide you with a comprehensive list of all data sources currently configured for the ICA application.  By default, no data sources are configured for ICA out-of-the-box.  In the figure below, we have a data source configured for demonstration purposes.  To create a data source, click on the Create Data Source button to the left of the Edit button.  

_{Figure 3 This figure depicts the Data Sources tab, it displays all data sources configured within ICA}

4. When Creating an SQL based data source you will need to define the Data Source Type, in this case it will be ‘SQL Server IW’.  The Data Source Label is a free-form text field that will allow you to create a label for the data source.  The Server Name attribute is where the name of the server is defined, the Database Name will allow you to configure the database name for the server, Server Port will allow you to define the port configured for a database, leaving the Server Port blank will default the port to 1443.  The Authentication Mode can be configured as Windows / Active Directory or User / Pass.  If Authentication Mode Active Directory is used, the service account used to install RiskFabric must have access to the target database, alternatively if you select User / Pass for Authentication Mode you can specify the username and password.  ICA will store the Username and Password within the RiskFabric database where the password will be stored as an encrypted value.  

 

_{Figure 4 Process to Create a data source for SQL Server IW}

 

5. When creating SQL Server Based data sources within ICA, physical linked serves will be created on the SQL Server to establish connections to the data source.  To verify the creation of a linked server Through SSMS, connect to the Database and navigate to Server Objects -> Linked Servers.  This will provide you a comprehensive list of all linked servers created for the SQL Server. 

 

_{Figure 5 Verify Linked Servers within SQL Server Management Studio}