Skip to main content

Privacera Platform

General process
:
Add a new data source - System

  1. From the Privacera main menu, scroll down to Settings and click Data Source Registration.

  2. From the Data Source Registration page, click + Add System.

  3. Enter System Name in the Name field. (Required).

  4. Enter a brief description in the Description field. (Optional)

  5. Click Save.

    Your new entry appears upon page refresh.

Add data source - Resources

  1. Select the settings icon in a data source detail box to add resources to your system. Resources can be applications, tables, or filesystems.

  2. Select an application from the drop-down menu.

  3. Enter a Name, an optional Description, and an Application Code in the Application Detail dialog box.

  4. Set the status toggle to Enable.

  5. Click Save.

    You can optionally test your data source connection at this point by selecting Test Connection.

  6. Select the Application Properties tab. You can import exsting application properties from a file using the Import Properties option. Open a browser window, select a JSON file, and click Add.

  7. In the Add New Properties section, add the following properties for Dataserver. Add one property per line.

    SSL: If SSL is enabled for Dataserver, use the following properties.

    explorer_proxy_enable=true 
explorer_proxy_host=dataserver 
explorer_proxy_port=8282 
explorer_proxy_protocol=https 
explorer_protocol=http

    Non-SSL: If SSL is not enabled for Dataserver, use the following properties.

    explorer_proxy_enable=true 
explorer_proxy_host=dataserver 
explorer_proxy_port=8181 
explorer_proxy_protocol=http 
explorer_protocol=http

  8. Click Test Connection.

  9. Click Next.

    A success banner displays upon a successful addition.

    Note

    To minimize the inflow of audits to Privacera, there is an option to add inclusion filter support for CDH (HDFS and Hive).

Enable an application

  1. Click Edit.

  2. Set the status to Enable.

  3. Click Save.

AWS S3 application

The following steps shows you how to add an AWS S3 application. You can allows users to access multiple S3 accounts using AssumeRole.

  1. Create an AWS S3 application on the Privacera Platform Portal.

    1. Click Setting > + Add Application.

    2. Select AWS S3 Application.

    3. Enter the Application Name and Application Code.

    4. Select the Application Properties tab. You can import existing application properties from a file using the Import Properties option. Browse and select the JSON file and click Add.

    5. Under Add New Properties, add the following for Dataserver. Add one property per line.

      SSL: If SSL is enabled for Dataserver, use the following properties.

      explorer_proxy_enable=true 
explorer_proxy_host=dataserver 
explorer_proxy_port=8282 
explorer_proxy_protocol=https 
explorer_protocol=http

      Non-SSL: If SSL is not enabled for Dataserver, use the following properties.

      explorer_proxy_enable=true 
explorer_proxy_host=dataserver 
explorer_proxy_port=8181 
explorer_proxy_protocol=http 
explorer_protocol=http

    6. Click Test Connection.

    7. Click Next.

      When the AWS S3 application is added successfully a success banner is displayed.

  2. Create one more AWS S3 application following the above steps, and add the following custom property:

    explorer_assume_role_arn=arn:aws:iam::${111111111111}:role/${s3_assume_role}

Tip

To minimize the in-flow of audits to Privacera audits, there is an option to add inclusion filter support for CDH (HDFS and Hive).

Azure ADLS

The following steps shows you how to add an Azure ADLS:

  1. Click Setting > + Add Application.

  2. Select Azure ADLS.

  3. Enter the Application Name and Application Code.

  4. Select the Application Properties tab. You can import existing application properties from a file using the Import Properties option. Browse and select the JSON file and click Add.

  5. Under Add New Properties, add the following for Dataserver. Add one property per line.

    SSL: If SSL is enabled for Dataserver, use the following properties.

    explorer_proxy_enable=true 
explorer_proxy_host=dataserver 
explorer_proxy_port=8282 
explorer_proxy_protocol=https 
explorer_protocol=http storage_type=blob

    Non-SSL: If SSL is not enabled for Dataserver, use the following properties.

    explorer_proxy_enable=true 
explorer_proxy_host=dataserver 
explorer_proxy_port=8181 
explorer_proxy_protocol=http 
explorer_protocol=http storage_type=blob

  6. Click Test Connection.

  7. Click Next.

    When the AWS S3 application is added successfully a success banner is displayed.

Google Cloud Storage (GCS)

A) Using Credential File

A credential type is a JSON file downloaded from the GCP that allows you to access the GCP service account from outside. Attaching this credential file will give access to the resources in the environment which can be used to run Discovery scans on GCP resources, such GCS or GBQ.

There are two ways to incorporate the credential file.

  • Local File Path: Provide the path of the local file system to where the credential file is saved, and the system will read and copy internally to configuration location.

  • File: Upload the credential file using a browser, and the system will copy internally to configuration location.

To add a GCS data source with credential file type, do the following:

  1. Under GCP, add a new Data Source, then select Google Cloud Storage.

  2. Enter the following:

    • Name: A name is provided by default. if required, enter a preferred name.

    • Description: Enter a suitable description

    • Application Code: An application code is an unique identifier for a data source. A code is provided by default. if required, enter a preferred code. No two data sources can have the same application code.

  3. In the Application Properties section, add the following properties:

    • Credential Type: Select Google Credentials Local File Path from the drop-down list.

    • Google Credentials Local File Path: /tmp

    • Google Project Id: ${PROJECT_ID}

    • Default Datasource for RealTime Scan - This value is set to false by default. Set this value to true if you have more than one data source. In such scenarios, it is recommended that you identify one data source as the default data source which will be used for real-time scanning.

  4. Scroll down to the bottom of the screen, and under Add new properties enter the following properties:

    SSL: If SSL is enabled for Dataserver, use the following properties.

    explorer_proxy_enable=true 
explorer_proxy_host=dataserver 
explorer_proxy_port=8282 
explorer_proxy_protocol=https 
explorer_protocol=http

    Non-SSL: If SSL is not enabled for Dataserver, use the following properties.

    explorer_proxy_enable=true 
explorer_proxy_host=dataserver 
explorer_proxy_port=8181 
explorer_proxy_protocol=http 
explorer_protocol=http

  5. Click Save.

B) Using Project ID

A project ID is a unique ID assigned to a GCP project. The project ID is required in order to interact with resources in the project. Using this project ID, you can access the resources defined in the project and run Discovery scans on those resources.

To add a GCS data source with project ID, do the following:

  1. Under GCP, add a new Data Source, then select Google Cloud Storage.

  2. Enter the following:

    • Name: A name is provided by default. if required, enter a preferred name.

    • Description: Enter a suitable description

    • Application Code: An application code is an unique identifier for a data source. A code is provided by default. if required, enter a preferred code. No two data sources can have the same application code.

  3. In the Application Properties section, add the following properties:

    • Credential Type: Select Google Credentials Local File Path from the drop-down list.

    • Google Credentials Local File Path: /tmp

    • Google Project Id: ${PROJECT_ID}

    • Privacera Configuration Bucket: gcs. Use the same bucket name you added in GCP Configuration.

    • Default Datasource for RealTime Scan - This value is set to false by default. Set this value to true if you have more than one data source. In such scenarios, it is recommended that you identify one data source as the default data source which will be used for real-time scanning.

  4. Click Save.

If you want to scan multiple resources, or resources from a different project, see Cross-project Setup.

Google BigQuery (GBQ)

  1. From the Privacera main menu, open Settings, and click Data Source Registration.

  2. Add a System with the name GBQ.

  3. Click the Setting icon of your added system, and click + Add Application.

  4. Choose Google BigQuery as the application.

  5. Enter the following:

    • Name

    • Description

    • Application Code

  6. Enable Status (Optional).

  7. Click Save.

  8. Enter the Google Project Id (Required).

  9. Default Datasource for RealTime Scan - This value is set to "false" by default. Set this value to "true" when adding the data source for a default project.

  10. Click Next, then click Save.

Google Pub-Sub

  1. From the Privacera main menu, select Settings, and click Data Source Registration.

  2. Under your GCP system, +Add New Data Source, select Google Cloud Storage.

  3. From the Add Data Source dialogue box, select/enter the following properties:

    • Google Project Id: ${PROJECT_ID} (Required)

    • scan.result.topic: ${Scan_Topic_Name} (Required)

    Use the same topic name you created as part of the prerequisite steps.

    • scan.result.project.id: ${Specify_ID_of_Cross_Project}

    If you do not specify a project ID, the system will consider applying a default project ID.

  4. Click Test Connection to verify the above configuration.

  5. Click Save.