MongoDB

This section covers the following topics:

• Prerequisites

• Add MongoDB Data Store

• Add MongoDB Scan

Prerequisites

Add MongoDB Data Store

To configure MongoDB data store:

1. Log on to the CipherTrust Manager GUI.

2. Open the Data Discovery & Classification application.

3. Click Data Stores > Data Stores > Add Data Store. The Add Data Store wizard is displayed.

4. Complete the following steps:

   1. Select Type & Category

   2. General Info

   3. Configure Connection

   4. Add Access Control & Tags

Select Type & Category

1. Under Select Data Store Category, select Database.

2. From Select Database Type, select MongoDB.

3. Click Next.

General Info

1. Specify the following details:

   • Data Store Name: Name for the data store.

   • Description (Optional): Description for the data store.

   • Location Name: Location of the data store.

   • Add Location: Click Add Location to add new locations to the Location Name dropdown list. Refer to Adding Locations for detailed steps.

   • Sensitivity Level (Optional): Sensitivity level for the data store. Refer to Sensitivity Levels for details.

   • Enable Data Store: Whether to enable the newly added data store. Select the check box to enable the data store.

2. Click Next.

Configure Connection

1. Specify the credentials for the MongoDB data store:

   Field	Description
   Hostname/IP	Specify a valid hostname or IP address of database server. Hostname must be more than 2 characters long.
   Port	Specify a valid port for connecting to database server. It must be a valid integer between 1 and 65535. Default port: 27017
   User	Specify the username.
   Password	Specify the password.

2. (Optional) In the Select Number of Agents field, set the minimum and maximum number of agents for the data store. Refer to Agents for more information.

   Warning

   • As there is no limit on the number of minimum and maximum agents that you can set, you should exercise caution so that you do not impact the system performance by using too many resources for a single scan.
   • You will not be able to add a datastore if the minimum number of agents cannot be assigned.
   • A scan will fail if the assigned agent is unavailable after adding the datastore.
   • The minimum number of agents must be less than or equal to the maximum number of agents.

3. (Optional) In the Add Label field, enter a label. You can also remove an existing label.

4. Click Next.

Add Access Control & Tags

1. (Optional) Grant the All groups (default) access for reports. Alternatively, select a group.

2. Click Save.

The data store is added to the Data stores page. If the Ready to Scan column shows Ready, then data store is properly configured.

For more information on Access control and Tags, expand the section below.

Add MongoDB Scan

To add a scan for MongoDB:

1. Open the Data Discovery & Classification application.

2. Click Scans > Add Scan. The Add Scan wizard is displayed.

3. Complete the following steps:

   1. General Info

   2. Select Data Stores

   3. Add Targets

   4. Select Profiles

   5. Add Filters

   6. Schedule Run

   Refer to Scans for the description of screens of the Add Scan wizard.

General Info

1. Specify a Name for the scan.

2. (optional) Add a Description for the scan.

3. Expand Advanced Configuration and specify advanced configurations such as Scan Priority, Memory Usage Limit, and Amount of Data Object Volume. Refer to Advanced Configuration for details.

4. Click Next.

Select Data Stores

1. Under Data Store Name, select the desired data store that is Ready for scanning. You can select multiple data stores, if required.

2. Click Next.

Add Targets

1. To add a scan target, do one of the following:

   • Under Add Target Path field, specify the complete target path and click Apply.

     If no specific target is added, the entire data store will be scanned. Target paths are case-sensitive.

     The following table lists target paths and syntax to specify them with examples.

     Target Path to Scan	Syntax	Example
     Full Data Store	<EmptyPath>
     Database	<DatabaseName>	admin
     Collection	<DatabaseName>/<CollectionName>	admin/test

   • Navigate and add target paths.

     1. Click Browse to navigate target paths from the root level. Alternatively, provide an initial path in the Add Target Path field and click Browse to navigate targets from that point onward.
     2. In the left pane, navigate and select the desired target path.
     3. Click Add Path to add the target path to the right pane. Similarly, add other target paths.
     4. Click Add.

     Tip

     Either navigate the target paths from the root level (without specifying any path in the Add Target Path field) or make sure you provide the correct path to navigate further locations within it.

2. Click Next.

Select Profiles

1. Under Classification Profile Name, select the desired classification profiles to search for in the data store. You can select multiple profiles, if required. Refer to Classification Profiles for details on classification profiles.

2. Click Next.

Add Filters

This step is optional.

1. Select the desired filter from the Select Filter drop-down list.

   To filter the locations to scan a MongoDB data store, consider the following syntax.

   Note

   Exclude locations by prefix, suffix, and expression filters support wildcard characters. See Using Wildcard Characters to learn how wildcards work.

   • Exclude locations by prefix

     Exclude search locations and nested locations with paths beginning with a given string. It can be used to exclude entire directory trees.

     Filter Item	Syntax	Example
     Database	<DatabaseName>	admin
     Collection	<DatabaseName>/<CollectionName>*	admin/test* — applies all locations that start with 'admin\test' as prefix *test* —applies all locations that contains "test" as prefix

   • Exclude locations by suffix

     Exclude search locations and nested locations with paths ending with a given string, specify <string>.

     Filter Item	Syntax	Example
     Database	<DatabaseName>*	admin* — applies all locations that start with 'admin' as prefix.
     Collection	<DatabaseName>/<CollectionName>*	admin/test* — applies all locations that start with 'admin/test' as suffix. *test* — applies all locations that contain 'test' as suffix.

   • Exclude locations by expression

     This filter is majorly used with wildcard characters.

     Exclude search locations and nested locations that matches a given expression.

     Filter Item	Syntax	Example
     Database	<DatabaseName>*	admin* — excludes all locations that start with 'admin'.
     Collection	<DatabaseName>/<CollectionName>*	admin/test* — excludes all locations that start with 'admin\test'. *test* — excludes all locations that contain 'test'.

2. Click Apply.

3. Repeat above steps to apply multiple filters. Click Remove to remove any applied filter.

4. Click Next.

Schedule Run

1. Specify the scan run frequency. The two options are:

   • Manual: This is the default option. Select this option to run the scan manually. Select the Run Now check box to start the scan run after you save the changes.

   • Scheduled: Select this option to configure the scan to run automatically at the specified time.

   Refer to Schedule Scan for more details on scheduling scan runs.

2. Click Save.

Potential problems when scanning a MongoDB with GridFS

There are several known issues specific to MongoDB while scanning GridFS database:

• You cannot specify a GridFS database collection in the scan path, even if, by default, the scan path for MongoDB is of the format <database/collection>. If you do, the scan will fail with the error: "Wrong database collection in target path". Instead, you should only use the <database> in the scan path.

• A scan on a GridFS database only accepts two default collections with a bucket named fs: fs.files and fs.chunks. If you use another prefix/bucket name, it will not be scanned.

• Scanning with multiple agents will not work. If you run a scan with multiple agents, then:

  • Full data store scans skip the GridFS database. It will not appear in the report under the data object list, and users will receive no notification of its exclusion

  • Specifying the GridFS database in the scan path will cause the scan to fail with the error: "Scan results could not be found".

• Scanning a GridFS database that contains files with common name, with same or different content, results in a single report entry under filename with a combined match count.

• In a report for a scan on a GridFS database, the list of data objects can contain both collections and files.