Overview of TRITON databases

Administering TRITON Databases | Web, Data, and Email Solutions | v8.2.x

Applies to:

In this topic

TRITON AP-WEB and Web Filter & Security, v8.2.x

TRITON AP-DATA, v8.2.x

TRITON AP-EMAIL, v8.2.x

Data Fingerprint Database, page 3

TRITON solutions use a variety of databases for different purposes: configuration information, reporting data, URL categorization, fingerprinting, and forensics. Several data formats are used, including SQL, PostgreSQL, and Forcepoint proprietary formats.

These databases include:


Database	Description
TRITON reporting databases	Web, Data, and Email products SQL Server databases that store reporting and logging data for individual TRITON Manager modules. The Data reporting database also stores configuration data. See Understanding the reporting databases, page 4.
TRITON Settings Database	Web, Data, and Email products PostgreSQL database that stores global configuration and infrastructure settings that affect all TRITON Manager modules. It is installed automatically on the TRITON management server and requires no administrator configuration.
Master Database	Web products only Proprietary database that contains URL categories and protocol definitions, as well as supporting information, such as risk class groupings. A copy of the Master Database resides on each Filtering Service machine. By default, a full update is performed daily. Incremental updates can occur much more frequently if they are enabled on the Settings > General > Database Download page in the Web module of TRITON manager. See "The Master Database" in the Administrator Help for your web protection solution for further details.
RTM Database	Web products only Holds and organizes filtering data for display in Real-Time Monitor. This is an independent database (not hosted on SQL Server) installed with each RTM Client and RTM Server instance. Administrators can specify when Real-Time Monitor captures data on the Settings > Reporting > Preferences page in the Web module of TRITON Manager. No other aspect of database behavior is configurable.
Web Forensics Database	TRITON AP-WEB only Stores details about files that may be associated with advanced malware threat activity in your network. Enable or disable the forensics repository, and configure its location and size on the Settings > Reporting > Dashboard page in the Web module of TRITON Manager. See "Configuring Dashboard reporting data" in the Administrator Help for your web protection solution for details.
Data Fingerprint Database	TRITON AP-DATA only Stores data security fingerprints. See Data Fingerprint Database, page 3.
Data Forensics Database	TRITON AP-DATA only Contains information about DLP and discovery transactions that resulted in incidents, such as the contents of an email body, including the From:, To:, and Cc: fields, as well as actual attachments. Transactions can also include web posts, endpoint operations, and discovered as well as other events. For transactions that occurred on a web channel, the forensics might include the URL category property. For discovery transactions, forensics might include the hostname and file name. Configure the size and location of the forensics repository in the Data module of TRITON Manager. Navigate to the Settings > Deployment > System Modules page and click Forensics Repository under the management server.

Data Fingerprint Database

One of the ways that you can classify data in TRITON AP-DATA is by "fingerprinting" it. This allows the detection of sensitive information despite manipulation, reformatting, or other modification. Fingerprints enable the protection of whole or partial documents, antecedents, and derivative versions of the protected information, as well as snippets of the protected information whether cut and pasted or retyped.

When you fingerprint data, the fingerprints are stored in the Data Fingerprint Database on the TRITON management server and pushed to other Data components for fast analysis on those machines.

To tune performance, you can configure the disk space and cache size of the database on the management server in the Data module of TRITON Manager. To do so:

Log onto TRITON Manager and select the Data module.

Navigate to Settings > Deployment > System Modules.

Select Primary Fingerprint Repository under the management server.

Adjust the maximum disk space and cache size as needed.

Secondary repositories are maintained by Content Gateway and TRITON AP-EMAIL. You can configure TRITON AP-DATA to detect fingerprints from repositories local to those machines (best practice) or from a remote machine, such as the management server.

Periodically, you must synchronize the fingerprints in the secondary repositories with the ones on the management server. How often you synchronize depends on your business needs. For best performance, select a time with low traffic volume.

To configure these settings:

Navigate to Settings > Deployment > System Modules.

Select Secondary Fingerprint Repository under the component or solution of interest.

Choose the repository from which to detect fingerprints.

Set the maximum cache size and synchronization frequency as needed.

See "Configuring the fingerprint repository" in the TRITON AP-DATA Help for instructions on configuring these settings.