Imperva Cyber Community

Hi,

Many MSSQL users I work with use the ".net sqlclient" source application to connect to their MSSQL servers.
Often, their "source application" data, presented in SecureSphere, has a long variable string at the beginning. 
For example -

[aaaa-1111].net sqlclient data provider
aaaa2222].net sqlclient data provider
[bbbb1111].net sqlclient data provider
[zzzzz-3333].net sqlclient data provider
etc...

Each time a user logs in, they may get a different variable.
This makes profiling impossible since each connection is considered by SecureSphere to be from a different source app.
Alert aggregation also suffers as the source app name cannot be aggregated, even though it's the same source app for all events.

Any idea how to resolve this?

Hi,

Many MSSQL users I work with use the ".net sqlclient" source application to connect to their MSSQL servers.
Often, their "source application" data, presented in SecureSphere, has a long variable string at the beginning. 
For example -

[aaaa-1111].net sqlclient data provider
aaaa2222].net sqlclient data provider
[bbbb1111].net sqlclient data provider
[zzzzz-3333].net sqlclient data provider
etc...

Each time a user logs in, they may get a different variable.
This makes profiling impossible since each connection is considered by SecureSphere to be from a different source app.
Alert aggregation also suffers as the source app name cannot be aggregated, even though it's the same source app for all events.

Any idea how to resolve this?

Hi,

Many MSSQL users I work with use the ".net sqlclient" source application to connect to their MSSQL servers.
Often, their "source application" data, presented in SecureSphere, has a long variable string at the beginning. 
For example -

[aaaa-1111].net sqlclient data provider
aaaa2222].net sqlclient data provider
[bbbb1111].net sqlclient data provider
[zzzzz-3333].net sqlclient data provider
etc...

Each time a user logs in, they may get a different variable.
This makes profiling impossible since each connection is considered by SecureSphere to be from a different source app.
Alert aggregation also suffers as the source app name cannot be aggregated, even though it's the same source app for all events.

Any idea how to resolve this?

Hi,

Many MSSQL users I work with use the ".net sqlclient" source application to connect to their MSSQL servers.
Often, their "source application" data, presented in SecureSphere, has a long variable string at the beginning. 
For example -

[aaaa-1111].net sqlclient data provider
aaaa2222].net sqlclient data provider
[bbbb1111].net sqlclient data provider
[zzzzz-3333].net sqlclient data provider
etc...

Each time a user logs in, they may get a different variable.
This makes profiling impossible since each connection is considered by SecureSphere to be from a different source app.
Alert aggregation also suffers as the source app name cannot be aggregated, even though it's the same source app for all events.

Any idea how to resolve this?

Hi,

Many MSSQL users I work with use the ".net sqlclient" source application to connect to their MSSQL servers.
Often, their "source application" data, presented in SecureSphere, has a long variable string at the beginning. 
For example -

[aaaa-1111].net sqlclient data provider
aaaa2222].net sqlclient data provider
[bbbb1111].net sqlclient data provider
[zzzzz-3333].net sqlclient data provider
etc...

Each time a user logs in, they may get a different variable.
This makes profiling impossible since each connection is considered by SecureSphere to be from a different source app.
Alert aggregation also suffers as the source app name cannot be aggregated, even though it's the same source app for all events.

Any idea how to resolve this?

Hi,

Many MSSQL users I work with use the ".net sqlclient" source application to connect to their MSSQL servers.
Often, their "source application" data, presented in SecureSphere, has a long variable string at the beginning. 
For example -

[aaaa-1111].net sqlclient data provider
aaaa2222].net sqlclient data provider
[bbbb1111].net sqlclient data provider
[zzzzz-3333].net sqlclient data provider
etc...

Each time a user logs in, they may get a different variable.
This makes profiling impossible since each connection is considered by SecureSphere to be from a different source app.
Alert aggregation also suffers as the source app name cannot be aggregated, even though it's the same source app for all events.

Any idea how to resolve this?