Overview of Websense databases

Administering Websense Databases | Web, Data, and Email Security Solutions | v7.6.x - v7.8.x

Applies to:

In this topic

Web Filter, Web Security, and Web Security Gateway (Anywhere), v7.6.x - v7.8.x

Data Security, v7.6.x - v7.8.x

Email Security Gateway (Anywhere), v7.6.x - v7.8.x

Websense Data Security Fingerprint Database

Websense TRITON solutions use a variety of databases for different purposes: configuration information, reporting data, URL categorization, fingerprinting, and forensics. Several data formats are used, including SQL, PostgreSQL, and Websense proprietary formats.

These databases include:


Database	Description
Websense reporting databases	Web, Data, and Email Security SQL Server databases that store reporting and logging data for individual TRITON modules. The Data Security reporting database also stores configuration data. See Understanding the reporting databases.
Websense TRITON Settings Database	Web, Data, and Email Security PostgreSQL database that stores global configuration and infrastructure settings that affect all TRITON modules. It is installed automatically on the TRITON management server and requires no administrator configuration.
Websense Master Database	Web Security Proprietary database that contains URL categories and protocol definitions, as well as supporting information, such as risk class groupings. A copy of the Master Database resides on each Filtering Service machine. By default, a full update is performed daily. Incremental updates can occur much more frequently if they are enabled on the Settings > General > Database Download page in Web Security manager. See "The Websense Master Database" in the v7.6, v7.7, or v7.8 Web Security Help for further details.
Websense RTM Database	Web Security Holds and organizes filtering data for display in Real-Time Monitor. This is an independent database (not hosted on SQL Server) installed with each RTM Client and RTM Server instance. Administrators can specify when Real-Time Monitor captures data on the Settings > Reporting > Preferences page in Web Security manager. No other aspect of database behavior is configurable.
Websense Web Security Forensics Database	v7.7 and later only Web Security Gateway and Gateway Anywhere Stores details about files that may be associated with advanced malware threat activity in your network. Enable or disable the forensics repository, and configure its location and size on the Settings > Reporting > Dashboard page in Web Security manager. See "Configuring Dashboard reporting data" in the v7.7 or v7.8 Web Security Help for details.
Websense Data Security Fingerprint Database	Data Security Stores Data Security fingerprints. See Websense Data Security Fingerprint Database.
Websense Data Security Forensics Database	Data Security Contains information about DLP and discovery transactions that resulted in incidents, such as the contents of an email body, including the From:, To:, and Cc: fields, as well as actual attachments. Transactions can also include Web posts, endpoint operations, and discovered as well as other events. For transactions that occurred on a Web channel, the forensics might include the URL category property. For discovery transactions, forensics might include the host name and file name. Configure the size and location of the forensics repository in Data Security manager. Navigate to the Settings > Deployment > System Modules page and click Forensics Repository under the management server.

Websense Data Security Fingerprint Database

One of the ways that you can classify data in Websense Data Security is by "fingerprinting" it. This lets Data Security detect sensitive information despite manipulation, reformatting, or other modification. Fingerprints enable the protection of whole or partial documents, antecedents, and derivative versions of the protected information, as well as snippets of the protected information whether cut and pasted or retyped.

When you fingerprint data, the fingerprints are stored in the Data Security Fingerprint Database on the TRITON management server and pushed to other Data Security components for fast analysis on those machines.

To tune performance, you can configure the disk space and cache size of the database on the management server in Data Security manager. To do so:

Log onto the TRITON console and select the Data Security module.

Navigate to Settings > Deployment > System Modules.

Select Primary Fingerprint Repository under the management server.

Adjust the maximum disk space and cache size as needed.

Secondary repositories are maintained by Websense Content Gateway and Email Security Gateway. You can configure Data Security to detect fingerprints from repositories local to those machines (best practice) or from a remote machine, such as the management server.

Periodically, you must synchronize the fingerprints in the secondary repositories with the ones on the management server. How often you synchronize depends on your business needs. For best performance, select a time with low traffic volume.

To configure these settings:

Navigate to Settings > Deployment > System Modules.

Select Secondary Fingerprint Repository under the component or solution of interest.

Choose the repository from which to detect fingerprints.

Set the maximum cache size and synchronization frequency as needed.

See "Configuring the fingerprint repository" in the v7.6, v7.7 or v7.8 Data Security Help for instructions on configuring these settings.