Filter policy and action tables

The policy and action tables are in a linked design and rely on each other to deliver disclosure options to requesters. The disclosure filter policy table is used to provide access to disclosure options, whereas the associated disclosure filter action table is used to set specific attributes of the disclosure options (timeouts and so on)

Bravura Privilege executes all actions that reference (via a foreign key) a policy that passes. This design allows a user to configure a single policy that activates one or more disclosure plugins.

Not all columns in a policy or action table rule have to be populated, only the ones the rule purpose requires. If multiple columns are populated for the rule, the condition is an AND, whereby all conditions of the rule must be true for the rule to trigger its action. If OR logic is needed, add separate rules for each condition requirement.

Like all policy tables, the last policy that passes wins. If you have conflicting actions, the last one overwrites any previous conflicting actions.

Policy Engine terminology:

Disclosure Filter Policy Table

The following table outlines the supported options and usage of the fields in the pam_disclosure_filter_policy extdb table.

The ComponentOwnerFQN field, included in all external data store tables, shows the name of the component providing specific rows to a table.

Disclosure Filter Action Table

The following table outlines the supported options and usage of the fields in the pam_disclosure_filter_action extdb table.

The ComponentOwnerFQN field, included in all external data store tables, shows the name of the component providing specific rows to a table.

Disclosure Filter Policy Examples

Restricting display of passwords to Windows platforms only and limiting disclosure

Click below to view a demonstration where disclosure filter rules are altered so display of passwords is restricted to Windows platforms only, with a time limit of 5 minutes. A Windows and Linux account are then checked out to demonstrate that only the Windows account can display passwords, and it remains visible for only the configured time.

Adding a new disclosure to a checkout

This is an example of adding the Remote Desktop disclosure plugin to a checkout for a user accessing a Windows server. This example assumes that the default Remote Desktop disclosure plugin has not been changed.

Policy Table:

Action Table:

Setting up AD disclosure based on group membership

This is an example of adding multiple disclosure plugins based on the user’s group membership. This example assumes that you have managed the Active Directory security group “security_appliance_admins” and run Auto discovery. This example also assumes you have configured new disclosure plugins in Bravura Privilege for Cisco Iron Port and Blue Coat.

This example is going to look at the platform the account exists on, and the security group. Once it confirms that the account being accessed exists on an Active Directory domain and a security group, it will add both Cisco Iron Port and Blue Coat to the list of disclosure controls available to the user.

Generally, this type of policy would be paired with a generic Active Directory policy that would add a disclosure control(s) that all users have access to, such as Remote Desktop.

Policy Table:

Action Ironport Policy:

Action Bluecoat Policy: