Updating a Symantec DLP data source connection

Products

• Information Centric Analytics

Issue/Introduction

When a Symantec Data Loss Prevention (DLP) Oracle database is migrated to a new server during an upgrade, or when its hostname has been modified, the Information Centric Analytics (ICA) data source connection to the Oracle database must be updated to preserve the DLP integration.

Environment

Release : 6.x

Component : Symantec Data Loss Prevention Integration Pack

Resolution

The following procedure will update the DLP data source connection when the DLP database is migrated to an upgraded instance on a new server:

1. Confirm the current DLP database is online and available to ICA
2. Open the ICA console and navigate to Admin > Integrations > Data Sources
3. From the Choose Data Source drop-down menu, select Symantec Data Loss Prevention
4. Select the server to be updated and click the Edit button
5. In the Edit Connection Settings window, click the Next button
6. Update the Oracle Host Name with the new Oracle database server host name
7. Update the Oracle Database Service Name (if needed) for the new Oracle database
8. Update the Specify Port field (if needed) for the new Oracle database
9. Update the Symantec Data Loss Prevention Credentials (if needed) for the new Oracle database
10. Click the Next button
11. Update the API settings for the Enforce server (if needed)
12. Click the Next button
13. Modify the DLP Custom Field Mapping (if needed)
14. Click the Next button
15. Confirm the Summary details are correct and click the Next button
16. Click the Finish button once you've received confirmation that the connection settings were updated successfully

To verify the new Oracle database is reachable and readable by the updated linked server connection, do the following:

1. Using SQL Server Management Studio (SSMS), connect to the database engine hosting the RiskFabric database
2. In Object Explorer, navigate to Server Objects > Linked Servers
3. Locate the linked server connection RISKFABRIC_DLP_RISKFABRIC_<Oracle_Hostname>_<schema>
4. Expand the linked server connection and navigate down to Catalogs > default > Tables
5. If you are able to view the list of tables in the Oracle database, the linked server connection was updated properly

Additional Information

Do not delete the existing Symantec DLP data source connection except when directed by a member of the Broadcom support or engineering groups; deleting a data source connection can result in all previously ingested incidents and user data becoming orphaned and unusable within ICA.