452 Sentinel 6.1 User Guidenovdocx (en) 7 January 2010Data Access Service (DAS) ProcessThe Data Access Service (DAS) process is Sentinel Server's persistence service and provides aninterface to the database. It provides data driven access to the database backend.DAS is a container, composed of five different processes. Each process is responsible for differenttypes of database operations. These processes are controlled by the following configuration files: das_binary.xml: Used for event and correlated event insertion operations das_query.xml: All other database operations activity_container.xml: Used for executing and configuring activity service workflow_container.xml: Used for configuring the workflow (iTRAC) service das_rt.xml: Used for configuring the Active Views function within the Sentinel ControlConsoleDAS receives requests from the different Sentinel processes, converts them to a query against thedatabase, processes the result from the database and converts it that back to a reply. It supportsrequests to retrieve events for Quick Query and Event Drill Down, to retrieve vulnerabilityinformation and advisor information and to manipulate configuration information. DAS also handleslogging of all events being received from the Collector Manager and requests to retrieve and storeconfiguration information.Correlation Engine Process (correlation_engine)The Correlation Engine (correlation_engine) process receives events from the Collector Managerand publishes correlated events based on user-defined correlation rules.Collector ManagerCollector Manager services, processes and sends events.iSCALEIt is a message-oriented middleware (MOM) that provides the communication platform for all otherSentinel processes.A.4 Logical ArchitectureSentinel is composed of three logical layers: Section A.4.1, “Collection and Enrichment Layer,” on page 453 Section A.4.2, “Business Logic Layer,” on page 456 Section A.4.3, “Presentation Layer,” on page 464The collection/enrichment layer aggregates the events from external data sources, transforms thedevice-specific formats into Sentinel format, enriches the native events source with business-relevant data and dispatches the event packets to the message bus. The key component orchestratingthis function is the Collector, aided by a taxonomy mapping and global filter service.The business logic layer contains a set of distributable components. The base component is aRemoting service that adds messaging capabilities to the data objects and services to enabletransparent data access across the entire network and Data Access service that is an object
