Security planning for IT Data Analytics

The product architecture handles and provides security at various levels, as described in the following sections:

Related topics

Configuring a secured connection Open link

Architecture Open link

Data transfer

The product can securely transfer data:

  • Between various product components
  • From product components to external system components. External systems include all products integrated with TrueSight IT Data Analytics (or IT Data Analytics) and PATROL for IT Data Analytics. For more information about the supported external systems, see  Architecture Open link

Data flow

When encrypted

Browser to TrueSight IT Data Analytics server

When HTTPS is configured in the TrueSight IT Data Analytics server

Console Server to Collection Station

CLI to TrueSight IT Data Analytics server

When HTTPS is configured in the TrueSight IT Data Analytics server and in the CLI client

TrueSight IT Data Analytics server to Search component

When HTTPS is configured in the Search component and the TrueSight IT Data Analytics server client

Collection Agent to Collection StationWhen HTTPS is configured in Collection Station and encryption in Payload Service
Collection Station to target hostsWhen SSH remote collection is used
SMTP send for emailWhen SMTP is configured with credentials, TLS is used

ProactiveNet to get and send data

When HTTPS connection type is used to configure ProactiveNet configuration

For more information about the default communication ports and protocols, see Communication ports and protocols.

User authentication and authorization

  • Users assigned an administrator role can configure user authentication and role-based access control (RBAC) from the TrueSight IT Data Analytics Console. For more information, see User roles and permissions.
  • User authorization is defined by the data access control setting that allows granular control over functions and data access for different users. For more information, see Managing user groups in IT Data Analytics Open link .


The following types of credentials are stored in encrypted form:

  • TrueSight IT Data Analytics user credentials
  • SMTP email credentials
  • ProactiveNet (or TrueSight Infrastructure Management) server credentials
  • Credentials specified as part of  credential profile Open link creation and  Enabling security for the Console Server and Search components Open link creation

Credentials used for data collection are stored in encrypted form and are decrypted by the Collection Station or the Collection Agent just before passing the credentials to the external system for authentication. The product does not store or transfer the password in plain text. But the password is not encrypted when passed from the browser to the Console Server; to ensure complete security you need to enable security for the Console Server. For more information, see


The encryption and decryption keys are pre-configured in the product components. These keys are not visible to administrators and cannot be customized.

Cross-site request forgery (CSRF) checks

TrueSight IT Data Analytics prevents CSRF attacks by checking the HTTP header, called as Referer, of the incoming HTTP request. This header is present in the requests that come from browsers. All invalid requests return a HTTP 403 response. The CSRF check is controlled by the check.csrf property in the file. 


The product cannot be accessed by using an iPv6 address. To enable the access, you must configure the system. For more information, see Configuring access URLs. Open link

By default, the CSRF checks do not filter out the following requests from accessing the product:

  • Requests that are generated by CLI commands.

  • Requests that are generated by typing the URL in the address bar of the browser.

  • Requests in which the Referer matches the TrueSight IT Data Analytics server host name.

  • Browser requests in which Referer matches any of the following regular expressions: 

    Regular expressionDescription

    Any HTTP or HTTPS referrer with IPV4 loopback address as


    Port is either 9797 or 9443


    Any HTTP or HTTPS referrer with IPv6 loopback address as ::1


    Port is either 9797 or 9443


    Any HTTP or HTTPS referrer with localhost


    Port is either 9797 or 9443

Adding X-Requested-With=XMLHttpRequest Header to prevent vulnerabilities

To handle CSRF-related security vulnerabilities, a new header X-Requested-With=XMLHttpRequest is added to the API calls. For accessing the application in secure mode (from CSRF), the addition of this header is mandatory in every request.

This header is validated only if the check.csrf.header.XRequestedWith property in is set to TRUE. By default, this property is set to TRUE.

If you are using IT Data Analytics public APIs, add the following header to each API – X-Requested-With=XMLHttpRequest. If you do not want to update the header, set this property to FALSE and do not add the X-Requested-With=XMLHttpRequest header.


To avoid security vulnerabilities, BMC recommends that you do not change the value of this property.

Was this page helpful? Yes No Submitting... Thank you