6.6 Rules

Rules provide the means by which you can control commands. Commands can be authorized to run, or not authorized to run, by setting rule conditions based on different criteria:

  • The command being submitted

  • The user and host submitting the command

  • The user and host assigned to run the command

  • The time the command is submitted

  • The contents of Perl scripts you have defined.

See Setting Conditions for a Rule for details.

If a rule’s conditions are met, there are a number of options you can set to determine how the rule processes the command. You can configure a rule to:

  • Display a message to the user submitting the command

  • Capture the user session for reporting and auditing purposes

  • Authorize or not authorize the command to be run

  • Specify what further rule processing to do. The rule can specify that the processing of additional rules ends by using the stop conditions (Stop, Stop if authorized, Stop if unauthorized).

    When the Framework Manager receives a command request, the evaluation starts at the top of the rule tree. Even when a request matches a rule, the evaluation continues until a rule has a stop condition or the rule tree has been processed.

You can also:

  • Specify the user and host to run the command

  • Set a risk level for use with keystroke reports

  • Assign an audit group to the rule for use with the Compliance Auditor.

See Modifying a Rule for details.

You can also create and assign Perl scripts to the rule to provide additional functionality. See Adding a Script and Assigning a Script to a Rule for details.

NOTE:If you are using a different user (run user) to run an authorized command than the user who submitted the command (submit user), by default the submit user’s environment variables are used for the run user. If you want to use the environment variables associated with the run user, you can add a script to a rule containing the following text:

$meta->get_params("Job")->arg("job_default_env",0);
return 1;

6.6.1 Adding a Rule

  1. On the home page of the console, click Command Control.

  2. In the command control pane, click Rules.

  3. In the task pane, click Add to add a rule at the top level.

    To add a rule as a child of another rule, select the rule and click Add in the task pane.

  4. Specify a name for the rule.

  5. Click Finish to add a new rule.

  6. Select the rule, then click Modify Rule in the task pane.

    For configuration information, see Section 6.6.2, Modifying a Rule.

  7. Move the rule by using the Alt key and drag and drop it to the correct position according to the order in which you want to process the rules.

    When a user specifies a command under Command Control, the following rule processing takes place:

    • The conditions set for the first rule in the hierarchy are checked.

    • If there is a match, the rule is processed. Depending on how the rule is configured, processing of additional rules takes place or stops. If rule processing is not stopped, the next rule for which conditions are checked is the child of this rule. Rule checking and processing continues until it is stopped by a rule, or until all appropriate rules have been processed.

    • If there is no match, the conditions for the next rule at the same hierarchical level as the first rule are checked, and this continues until a match is found. Rule processing then takes place as described above.

    You can change the default order of rule processing on the Modify Rule screen, or by using scripts. See Modifying a Script.

6.6.2 Modifying a Rule

  1. On the home page of the console, click Command Control.

  2. In the command control pane, click Rules.

  3. Select the rule you want to modify.

  4. In the task pane, click Modify.

  5. Modify the following as per your requirement:

    Name: Change the name of the rule.

    Disabled: To disable the rule, select the Disabled box. A disabled rule is dimmed.

    Description: Specify a description of the rule.

    User Message: Specify a user message to be displayed to the user when this rule is processed, before any commands are run.

    Session Capture: Select either On or Off. Setting Session Capture to On allows the Audit Manager to perform keystroke logging for the rule. To view a captured session from a Command Control report, an Auditing Manager and the Reporting Console must be installed.

    Authorize: Select either Yes or No, depending on whether you want the command protected by the rule to be authorized or not authorized if the rule conditions are met.

    Define what happens next by using the drop-down list as follows:

    • Blank: The next rule in the hierarchy is checked.

    • Stop: No more rules are checked for the command.

    • Return: The next rule to be checked is up one level in the hierarchy from the current rule.

    • Stop if authorized: If Authorize is set to Yes, no more rules are checked for the command.

    • Stop if unauthorized: If Authorize is set to No, no more rules are checked for the command.

    Run User: Define a run user by selecting the name of the user you want to run this command (this overrides any username defined through a set command).

    Account Domain: Select the appropriate LDAP or SSH account domain from the drop down list.

    Credentials: The credential for the selected account domain gets populated. You can also select the required credential from the drop-down list.

    Run User: Define a run user by selecting the name of the user you want to run this command. The Run User gets automatically populated with the domain user provided in the account domain.

    Run Host: Define a run host by selecting the name of the host on which you want to run this command (this overrides any hostname defined through a set command).

    Risk Level: Set a Risk Level of 0 to 99. This option allows you to set a value representing the relative risk of a rule when using the pcksh or cpcksh clients with the session auditing option (see Section 6.2, Integrating Command Control to User Environments). When viewing a Command Control Keystroke Report, you see commands controlled by rules with different risk values represented in different colors.

    Audit Group: Define an Audit Group. This setting is for use in Compliance Auditor reports.

    NOTE:To configure video capturing refer section Section 7.5, Video Capture for Windows

  6. Click Modify.

6.6.3 Viewing Conditions for a Rule

You can view all the conditions that create a rule. These conditions are created with the help of the entities such as host group, user group and so on. You can view the entity that includes the condition and also modify it if required.

To view the condition perform the following steps:

  1. In the Command Control pane, click the required rule.

  2. In the details pane, select the condition of the rule.

  3. Click View Condition.

    This displays the list of entities that are part of the condition. If required, you can modify the required entity.

6.6.4 Setting Conditions for a Rule

You can set a number of conditions for a rule to determine whether the rule is processed or not. For example, you can set a particular command as a condition, and only process the rule if a user enters that command.

There are two ways of setting conditions for a rule:

  • Dragging and dropping an entity onto the rule.

  • Using the Edit Condition option, as described in the steps below.

NOTE:When you drag and drop an entity onto a rule, you might need to edit the condition to ensure that the condition logic is what you want. If you want to use a script in rule conditions, you must set it to Conditional first (see Modifying a Script).

To set conditions by using the Edit Condition option:

  1. On the home page of the console, click Command Control.

  2. In the Command Control pane, click Rules.

  3. Select the rule for which you want to set conditions.

  4. In the details pane, select the currently defined condition then click Edit Condition.

    If you have not yet defined a condition, select Match All

  5. In the Add Condition drop-down list, select the type of condition you want.

  6. Set the condition to the value and logic you want. For example, if you set a condition to match a run user to a user group:

    1. Change user (submit user) to run user.

    2. Leave the logic setting as IN.

    3.  Select the user group you require from the user group drop-down list.

  7. Repeat Step 5 and Step 6 for any other conditions you want. Set the condition logic as necessary.

    You can use parentheses to group conditions according to the necessary logic by selecting the parentheses ( ) entry from the Add Condition drop-down list. The opening and closing parentheses are displayed.

    1. Select the opening parenthesis.

    2. Select the condition type you want to place inside the parentheses and set it as necessary.

    3. Select the opening parenthesis again.

    4. Select another condition type to place inside the parentheses and set it as necessary.

    5. If necessary, change OR to AND.

    6. Repeat Step 7.d through Step 7.f for any other conditions you require inside this set of parentheses. You can also place parentheses within parentheses.

  8. Click Finish.

6.6.5 Removing Conditions for a Rule

You can remove all the conditions for a rule, or you can remove individual conditions.

  1. On the home page of the console, click Command Control.

  2. In the Command Control pane, click Rules.

  3. Use the arrow to display all the rules and select the rule for which you want to remove conditions.

  4. In the task pane, select the currently defined condition.

  5. To remove all conditions, click Remove Condition in the task pane, then click OK to remove the condition.

    The rule condition is displayed as Match All.

  6. To remove individual conditions, click Edit Condition in the task pane, click the delete icon against the condition to remove the condition, then click Finish.

6.6.6 Configuring Script Arguments and Entities for a Rule

You can configure script arguments and entities for the scripts assigned to a rule before or after assigning the scripts. You can define only one set of arguments and entities, which applies to all scripts assigned to a rule.

  1. On the home page of the console, click Command Control.

  2. In the Command Control pane, click Rules.

  3. Select the rule for which you want to add script arguments.

  4. In the task pane, click Script Arguments.

  5. Click Add .

  6. In the Name field, specify a name for the argument.

  7. In the Value field, specify a value for the argument.

  8. To add more arguments, repeat Step 5 through Step 7.

  9. When you finish adding arguments, click Finish, or continue with Step 10 to add script entities.

  10. Click the arrow under Add Script Entity to display the list of available entities, then select the type of entity you want.

    A drop-down list of entities is displayed in the Script Entities table.

  11. Select the entity you want from the drop-down list.

  12. To add more entities, repeat Step 10 and Step 11.

  13. Click Finish.

6.6.7 Assigning a Script to a Rule

You can use Perl scripts to provide additional, customized functionality to the rules (see Adding a Script). To assign a script to a rule, use drag and drop as described in the following procedure.

NOTE:If you drag and drop a script that has been set to Conditional, the script is added to the rule conditions.

  1. On the home page of the console, click Command Control.

  2. In the Command control pane, click Rules.

  3. Click the arrow to display the list of rules.

  4. In the navigation pane, click the Scripts icon.

  5. Select the script you want to assign to the rule.

  6. Drag and drop the selected script to the rule.

  7. Configure script arguments and entities for the scripts if necessary. For more information, see Configuring Script Arguments and Entities for a Rule.

6.6.8 Removing Script Arguments and Entities

  1. To remove a script argument, select the argument, then click Remove.

  2. To remove a script entity, select the icon next to the name of the entity, then click Remove.

6.6.9 Removing a Script from a Rule

  1. On the home page of the console, click Command Control.

  2. In the navigation pane, click Rules.

  3. Use the arrow to display the list of rules, then select the rule from which you want to remove a script.

  4. In the details pane, select the script.

  5. Click Remove Script.

  6. Click OK to confirm the removal. The scripts are removed from the rule.

6.6.10 Finding a Rule

  1. On the home page of the console, click Command Control.

  2. In the Command Control pane, click Rules.

  3. In the details pane, click Find to find a rule from the entire list of rules.

    or

    Select the parent rule, then in the details pane click Find.

  4. In the Rule Filter field, specify the name of the rule you are looking for, then click Find.

    You can use wildcard characters “*” and “?”. This field is case sensitive.

    NOTE:Some special characters, such as “[“ and “]”, might not work in this field. For example, if you search for first rule [linked rule], you might get an error message. In such case, replace “[“ and “]” with “*” or “?”.

  5. When the name of the rule is displayed, you can modify the rule by using Modify Rule and if you want to view the rule in the Command Control pane, click Goto Rule. Click Close to return to the Command Control pane without a rule selected.

6.6.11 Moving a Rule

  1. On the home page of the console, click Command Control.

  2. In the Command Control pane, click Rules.

  3. Select the rule you want to move.

  4. Drag and drop the selected rule to the location you want.

6.6.12 Copying a Rule

You can create a copy of an existing rule in the rule hierarchy, so you can use the same rule in more than one place in the hierarchy, or so you can create a new rule based on the existing rule.

NOTE:If you want to use the same rule in more than one place and you want any changes you make to the rule to be reflected in the other copy or copies, you should link the rule instead. See Linking a Rule for details.

  1. On the home page of the console, click Command Control.

  2. In the Command Control pane, click Rules.

  3. Select the rule you want to copy.

  4. To create the copy, press the Ctrl key and drag and drop the selected rule to the desired location

  5. (Optional) Use the Modify Rule option to rename or modify the copy.

  6. Move the rule to the correct position according to the order in which you want to process the rules. See Adding a Rule for details.

6.6.13 Linking a Rule

If you want a specific rule to be used in different places in the hierarchy of rules, you can create a linked rule. Any changes you make to the linked rule are reflected in all the instances of the rule in the hierarchy. If you simply copy the rule, any changes made to the original rule or to one of its copies are not reflected in the other copies.

Changes to sub-rules of a linked rule are not linked. For example if you add or modify a rule under a linked rule, the change is not reflected in other instances of the linked rule.

  1. On the home page of the console, click Command Control.

  2. In the Command Control pane, click Rules.

  3. Select the rule to link.

  4. To create the links, press the Ctrl key and the Shift key at the same time, then drag and drop the selected rule to the location you want.

    A linked rule is displayed with an arrow .

6.6.14 Deleting a Rule

  1. On the home page of the console, click Command Control.

  2. In the Command Console pane, click Rules.

  3. Select the rule you want to delete.

  4. In the details pane, click Delete.

  5. Click Delete to delete the rule and all rule children.

6.6.15 Viewing Pseudocode

The pseudocode for a rule provides a simplified representation of the actual code that is processed when the rule is activated. For complex rules, this can assist you with understanding what happens in different situations.

To view the pseudocode for a rule:

  1. On the home page of the console, click Command Control.

  2. In the Command Control pane, click Rules.

  3. Select the rule for which you want to view the pseudocode.

  4. In the details pane, click Pseudocode.

    You can copy the pseudocode by using Ctrl+A or Ctrl+C, then paste it into a document for printing.

  5. Click Close.