System Configurations

This section plays a critical role in ensuring that the information system is properly configured, secure, and efficient. This section covers several areas, including data lake configuration, retention policies, entity resolution, etc. In DataBee, you can select the data lake to store and analyze large volumes of data. The retention policy section involves defining the retention policies for the search history stored in the system.

Click on the settings icon at the top right corner of the portal, and from the dropdown menu select System.

Data Lakes Configuration

You can load and search your security data into a cloud-based data warehousing platform like Snowflake or Iceberg using DataBee. On the left panel, click the Data Lakes button.

Refer to Snowflake Setup Guide for the configuration steps. Click S3 Iceberg Wizard Setup Guide and ADLS Iceberg Wizard Setup Guide to learn more about the Iceberg configuration steps.

Data Collectors

Refer to Configure Data Collector in DataBee for a step-by-step guide.

HTTP Collector

Data can be sent to the DataBee platform using the following endpoint. From the left sidebar, select HTTP Collector. Click on the Copy to clipboard button to copy the ‘Endpoint URL’.

Retention Policy

The system configuration section of DataBee allows you to set the retention policy for your search history. This policy determines how long your search history will be stored in the system before it is automatically deleted. You can configure the retention policy based on a specific number of days.

Select the Retention button, which takes you to the “Retention Policies” page. Here, you can enter the number of days you want to retain the user Search History. Click on the Submit button to configure your retention policy.

Customers have full control over data retention policies within their cloud environment. Data retention can be configured to age out records automatically based on organizational requirements and compliance needs.

Retention settings can be applied at a per-table level, allowing different retention timeframes for different datasets depending on their operational or regulatory importance.

Customers who need guidance on defining appropriate retention periods or configuring retention policies in their cloud environment can open a support ticket for recommendations and implementation assistance.

Entity Resolution

The system configuration section of DataBee allows you to set configuration options to customize Entity Resolution to your organization if you have the Security Threats or the Security Hygiene package. Entity Resolution should be enabled and configured after completion of feed configuration to ensure accuracy. Feeds can be prioritized for Entity Resolution in the “Provider Priority” by selecting a provider from the list, then dragging it into the desired order. These inputs are leveraged directly by Entity Resolution when collisions or conflicting information are present. Entity Resolution allows for configuration of age out by 3 primary types of entities: Virtual Devices, Physical Devices, and Users. Virtual Devices take their definition from the Device Type ID in the OCSF framework, which includes, for example, cloud assets and virtual machines. All other device types are considered Physical Devices for consistency. Internal CIDRs and Internal Hostnames can be provided. CIDRs should be inputted in the format of X.X.X.X/Y in a comma-separated list. Providing the CIDR Blocks assigned to your organization allows Entity Resolution to track external IPs as internal assets from a variety of sources. Providing Internal Hostnames allows for more accurate identification of assets.

Select the Entity Resolution button, which takes you to the “Entity Resolution” page. Here, you can configure your Device, Application, and User entities by filling in the required details- Feed Priority, Entity Age Out time, and internal CIDR Blocks. Click on the Submit button to configure your entity resolution.

Refer Entity Resolution Configuration for more details.

DataBee BeeKeeper

For detailed instructions, refer to DataBee BeeKeeper Setup in the DataBee UI.

Integrations

Refer to Setting Up ServiceNow Integration for details.