Integrating Cloud Protect with PPC (Protegrity Provisioned Cluster)

Mon, 01 Jan 0001 00:00:00 +0000

This guide describes how to configure the Protegrity Policy Agent and Log Forwarder to connect to a Protegrity Provisioned Cluster (PPC), highlighting the differences from connecting to ESA.

Key Differences: PPC vs ESA

Feature	ESA 10.2	PPC (this guide)
Datastore Key Fingerprint	Optional/Recommended	Required
CA Certificate on Agent	Optional/Recommended	Optional/Recommended
CA Certificate on Log Forwarder	Optional/Recommended	Not supported
Client Certificate Authentication from Log Forwarder	Optional/Recommended	Not supported
IP Address	ESA IP address	PPC address

Prerequisites

Access to PPC and required credentials.
Tools: curl, kubectl installed.

Policy Agent Setup with PPC

Important

When connecting to PPC, the Policy Agent requires the PTY_DATASTORE_KEY fingerprint. For ESA 10.2, the fingerprint is optional but recommended. See Policy Agent Installation for general setup steps.

Follow these instructions as a guide for understanding specific inputs for Policy Agent integrating with PPC:

Configuring Regular Expression to Extract Policy Username

Mon, 01 Jan 0001 00:00:00 +0000

Configuring Regular Expression to Extract Policy Username

Cloud Protect Function exposes USERNAME_REGEX configuration to allow extraction of policy username from user in the request.

USERNAME_REGEX Function Environment configuration

The USERNAME_REGEX environment variable can be set to contain regular expression with one capturing group. This group is used to extract the username. Examples below show different regular expression values and the resulting policy user.

USERNAME_REGEX

User in the request

Getting JWT for Service Account in Azure Active Directory

Mon, 01 Jan 0001 00:00:00 +0000

Getting JWT for Service Account in Azure Active Directory

Protect Function App can use Microsoft identity platform endpoint for identity-as-a-service, available in Azure Active Directory, to implement OpenID Connect and OAuth 2.0 authorization. This section describes how to get JWT using OAuth 2.0 client credentials grant flow in Azure Active Directory and authorize the Client ID in Protegrity Policy.

Note

Protect Function App and Azure Active Directory support more authorization methods, and the correct procedure should be chosen based on the use case.

Protection Methods

Mon, 01 Jan 0001 00:00:00 +0000

Protection Methods

For more information about the protection methods supported by Protegrity, refer to the Protection Methods Reference.

Tokenization Type

Supported Input Data Types

Notes

Numeric

Credit Card

Alpha

Upper-case Alpha

Alpha-Numeric

Upper Alpha-Numeric

Lower ASCII

Printable

Decimal

Unicode

Unicode Base64

Unicode Gen2

STRING

NULL

Integer

NUMBER

NULL

Date

Datetime

STRING

NULL

For information about supported formats, refer to the Protection Methods Reference.

ARM Template Installation - Required Permissions

Mon, 01 Jan 0001 00:00:00 +0000

ARM Template Installation - Required Permissions

Permissions below are required to install Protegrity service using ARM template.

All permissions in the table must be granted with the Resource group scope.

Permissions

Description

Built-In Azure Role

Microsoft.Insights/components/read

Microsoft.OperationalInsights/workspaces/read

Read access to monitoring data and settings

Monitoring Reader

Microsoft.Insights/components/write

Microsoft.OperationalInsights/workspaces/write

Write and manage access to monitoring data and settings

Monitoring Contributor

Microsoft.Web/serverFarms/write

Microsoft.Web/sites/write

Microsoft.Web/sites/host/listkeys/action

Microsoft.Web/serverFarms/join/action

Microsoft.Web/register/action

Write and manage access to web apps

Associating ESA Data Store With Cloud Protect Agent

Mon, 01 Jan 0001 00:00:00 +0000

Associating ESA Data Store With Cloud Protect Agent

ESA controls which policy is deployed to protector using concept of data store. A data store may contain a list of IP addresses identifying servers allowed to pull the policy associated with that specific data store. Data store may also be defined as default data store, which allows any server to pull the policy, provided it does not belong to any other data stores. Node registration occurs when the policy server (in this case the policy agent) makes a policy request to ESA, where the agent’s IP address is identified by ESA.

Appendices on

Integrating Cloud Protect with PPC (Protegrity Provisioned Cluster)

Key Differences: PPC vs ESA

Prerequisites

Policy Agent Setup with PPC

Important

Configuring Regular Expression to Extract Policy Username

Configuring Regular Expression to Extract Policy Username

Getting JWT for Service Account in Azure Active Directory

Getting JWT for Service Account in Azure Active Directory

Note

Protection Methods

Protection Methods

ARM Template Installation - Required Permissions

ARM Template Installation - Required Permissions

Associating ESA Data Store With Cloud Protect Agent

Associating ESA Data Store With Cloud Protect Agent