MSSQL

This document provides guidance on how to integrate Microsoft SQL Server withGoogle SecOps.

Integration version: 14.0

1. Add your DNS servers to the/etc/resol.conf file:#vi /etc/resolv.conf

2. Install the krb5 package for CentOS 7:#yum install krb5-workstation

3. Open the/etc/krb5.conf file and add your domain asdefault_realm:#vi etc/krb5.conf.

   Note: The domain must be in full FQDN syntax and uppercase.

4. Test connection with Active Directory. Use a user that has access to the SQLServer database:#kinit sql_user

5. Input your user password.

6. Show the obtained ticket:#klist

7. Optional: Remove the kerberos ticket:#kdestroy -A

For more information about creating a remote agent on CentOSusing the Microsoft SQL integration, seeCreate agent with installer forCentOS.

Configure a Google SecOps remote agent (Docker)

To configure a Google SecOps remote agent (Docker)to work with SQL Server, complete the following steps in the remote agent Linuxshell:

1. Run a shell in a docker container:docker exec -it siemplify /bin/bash

2. Add your domain DNS servers to the/etc/resol.conf file:#vi /etc/resolv.conf

3. Install the krb5 package for CentOS 7:#yum install krb5-workstation

4. Open the/etc/krb5.conf file and add your domain asdefault_realmwith uppercase:#vi etc/krb5.conf

   Note:ThedomainmustbeinfullFQDNsyntaxandinuppercase.

5. Obtain a kerberos ticket. Use a user that has access to the SQL Serverdatabase:#kinit sql_user

6. Enter your user password.

7. Show the obtained ticket:#klist

8. Optional: Remove the kerberos ticket:#kdestroy -A

For more information about creating a remote agent on Docker, seeCreate agentwith Docker.

Optional: Install SQL Server tools for debugging

To install the SQL Server tools for debugging, complete the following steps inthe remote agent Linux shell:

1. Add the Microsoft repository:# curlhttps://packages.microsoft.com/config/rhel/7/prod.repo >/etc/yum.repos.d/msprod.repo

2. Install SQL Server tools:# yum install mssql-tools unixODBC-devel

   Binaries are installed in the following directory:/opt/mssql-tools/bin.

3. Test the connection to SQL Server:#kinit sql_user

4. Run the following command:/opt/mssql-tools/bin/sqlcmd -Ssqlserver.yourdomain.com -E

   Note:ThedomainmustbeinfullFQDNsyntaxandinuppercase.

Integrate MSSQL with Google SecOps

The integration requires the following parameters:

For instructions about configuring an integration inGoogle SecOps, seeConfigureintegrations.

You can make changes at a later stage, if necessary. After you configure anintegration instance, you can use it in playbooks. For more information onconfiguring and supporting multiple instances, seeSupporting multipleinstances.

Actions

The SQL Server integration includes the following actions:

• Ping
• Run SQL Query

Ping

Use thePing action to test connectivity to the SQL Server.

This action runs on all entities.

Action inputs

None.

Action outputs

ThePing action provides the following outputs:

Script result

The following table describes the values for the script result output when usingthePing action:

Run SQL Query

Use theRun SQL Query action to run SQL queries.

This action runs on all entities.

Action inputs

TheRun SQL Query action requires the following parameters:

Action outputs

TheRun SQL Query action provides the following outputs:

JSON result

The following shows an example of the JSON result output received when using theRun SQL Query action:

[{"Name":"Actions Monitor System","Creator":"System","Integration":"Example","VersionId":"VERSION_ID","ModificationTimenixTimeInMs":1558278307098,"Description":"Notifies of all the actions, that have individually failed at least 3 times, in the last 3 hours"},{"Name":"Jobs Monitor System","Creator":"System","Integration":"Example","VersionId":"VERSION_ID","ModificationTimenixTimeInMs":1558278307098,"Description":"Notifies of all the jobs, that have individually failed at least 3 times, in the last 3 hours"}]

Script result

The following table describes the values for the script result output when usingtheRun SQL Query action:

Need more help?Get answers from Community members and Google SecOps professionals.