Skip to content

Migrate Data from CSAT Pro or CIS-CAT Pro Dashboard to the CIS SecureSuite Platform

Introduction

Users of CSAT Pro, CIS-CAT Pro Dashboard, or both can migrate their test and configuration data to the CIS SecureSuite Platform. The data migration is handled within the CIS SecureSuite Platform and ensures data integrity, prevents duplicates, and maintains relationships between entities.

Access Requirements

Only CIS SecureSuite Platform System Admins can perform data migrations.

Warning

Please do not attempt to run data migration more than once. If you have experienced an issue with migration, please contact support immediately for next steps.

This guide explains:

What to Expect During Migration

Migration Formation

Data will be copied from the source system and inserted into the CIS SecureSuite Platform's database using a secure backend process.

Error Handling

If errors occur (e.g., missing foreign keys or invalid references), an error message will be displayed. Errors are logged in detail in securesuite.log which can be found in .../SecureSuite/logs/securesuitelogs/. Please attach the log when submitting a Product Technical Support ticket.

Data Scope

Only supported tables relevant to assessments, systems, results, and Controls will be migrated. Non-essential or deprecated tables are excluded.

User Interaction

Users will need to ensure all prerequisites are met and setup steps completed before attempting to migrate data. The data migration itself is handled automatically in the background when initiated.

Go to Data Migration

1. Open the CIS SecureSuite Platform.
2. Go to Support.
3. Select Data Migration.

You will land on the Data Migration page, where you can migrate data from CSAT Pro or from CIS-CAT Pro Dashboard.

Migrate CSAT Pro Data

Migrate data from your CSAT Pro Neo4j database into the CIS SecureSuite Platform relational database.

Prerequisites

Ensure all of the prerequisites are met before attempting the data migration:

  • CIS SecureSuite Platform installed
  • Know CSAT Pro URI
  • Know Neo4j DB credentials
  • On CSAT Pro host machine, configure port 7687 to allow connection from Neo4j to consolidated Maria DB in the CIS SecureSuite Platform
  • Have access to your CSAT Pro host machine and your current admin user
  • Ensure Neo4j is running and accessible (e.g., bolt://localhost:7687)
  • Ensure MariaDB is running and accessible (e.g., jdbc:mariadb://localhost:3306/secure_suite) for your CIS SecureSuite Platform installation
  • Must use self-signed certificate ONLY for data migration

Edit CSAT Pro Configuration File

1. On your CSAT Pro host machine, open the neo4j.conf file found at C:\Program Files\CSAT_Pro\neo4j\conf.
2. In the "Network connector configuration" section, delete the hashtag (#) at the start of the following line: 

#dbms.connectors.default_listen_address=0.0.0.0

3. Save the file and restart the Neo4j service.
4. Ensure CSAT Pro is up and running and all the prerequisites have been met.

Run CSAT Pro Data Migration

1. Go to Admin > Email & Login Settings and change the Session Lock When Idle value to 360.
2. On the Data Migration page, enter the database connection information:

  • Neo4j Database URI: URI of your CSAT Pro Neo4j instance.
  • Password: Password for your CSAT Pro Neo4j instance.

3. Select Begin migration.

Once started, the tool will:

  • Extract data from CSAT’s graph database including assessments, rules, rule controls, and related metadata.
  • Map and transform this data into the SecureSuite schema.
  • Ensure relationships like rule-to-Control and Control-to-Sub-Control are preserved during import.
  • Show a real-time progress indicator and a success message once the migration completes. Errors (if any) will be shown in a summary at the end of the process.

Warning

Please do not attempt to run data migration more than once. If you have experienced an issue with migration, please contact support immediately for next steps.

4. Change the Session Lock When Idle value back to what is was originally (or to a value aligned with your organization's security policy).

Migrate CIS-CAT Pro Dashboard Data

Migrate data from your CIS-CAT Pro Dashboard MariaDB to your CIS SecureSuite Platform database.

Prerequisites

Ensure all of the prerequisites are met before attempting the data migration:

  • CIS SecureSuite Platform installed
  • Know CIS-CAT Pro URI
  • Know Maria DB credentials for CIS SecureSuite Platform and CIS-CAT Pro
  • On CIS-CAT Pro host machine, configure port 3306 to allow connection from CIS-CAT Pro Dashboard Maria DB to the consolidated Maria DB in the CIS SecureSuite Platform.
  • Have access to your CIS-CAT Pro host machine and your current admin user
  • Ensure that any open tasks on CIS-CAT Pro Dashboard are completed. The migration process will not migrate your Inbox data.
  • Ensure CIS-CAT Pro MariaDB is running and accessible
  • Ensure MariaDB is running and accessible (e.g., jdbc:mariadb://localhost:3306/secure_suite) for the CIS SecureSuite Platform
  • Must use self-signed certificate ONLY for data migration

Set Up CIS-CAT Pro Dashboard Host Machine.

1. Copy ciscat-remote-enable.jar from the dataMigration folder in the destination directory you defined during the CIS SecureSuite Platform installation.
2. Place the ciscat-remote-enable.jar on your CIS-CAT Pro Dashboard host machine.
3. In Windows Search, enter Environment Variables and select Edit the system environment variables.
4. Select Environment Variables....

5. Under System variables, select the Path variable and then Edit.
6. Select New, enter %JAVA_HOME%\bin, and exit out of the windows.

Run Remote Enabler JAR

Running ciscat-remote-enabler.jar establishes a user specifically for data migration that has the correct permissions to insert data into the CIS SecureSuite Platform. This user will be disabled at the end of a successful migration.

1. Open Command Prompt (Windows) or Terminal (Linux).
2. Navigate to the directory containing ciscat-remote-enable.jar. 

cd <path\to\jar\directory>\bin

Locating ciscat-remote-enable.jar

If you do not know the directory containing the JAR file, run this command to find it: echo %JAVA_HOME%.

3. Run the JAR file using the java -jar command: 

java -jar ciscat-remote-enable.jar

Note

Store the password of the migration user created by ciscat-remote-enable.jar in a secure but discoverable location. You will need it when running the data migration or if you need to re-run the script.

Run CIS-CAT Pro Dashboard Data Migration

1. Ensure CIS-CAT Pro Dashboard is up and running and all the prerequisites have been met.
2. On your CIS SecureSuite Platform host machine, go to Admin > Email & Login Settings and change the Session Lock When Idle value to 600.
3. Go to the Data Migration page and enter the database connection information:

  • Maria Database URI: URL of your CIS-CAT Pro Dashboard MariaDB instance.
  • Password: Password of the migration user.

4. Select Begin migration.

Once started, the tool will:

  • Transfer all relevant CIS-CAT data including system characteristics, rules, collected objects, and item data.
  • Normalize values such as control versions to ensure compatibility.
  • Maintain referential integrity across related tables using built-in business key logic and special handlers.
  • Show a progress bar displaying migration status. A final summary will indicate success or highlight any rows that were skipped or errored during the import.
  • Check that the username for the migration user is not root and revokes all privileges from the migration user after data migration is finished.

How long will the data migration take?

How long the data migration takes is contingent on how many configuration assessment reports you are migrating. For example, one Member's migration of 7,000 configuration reports took about 3 hours. Another Member's migration of 21,000 configuration reports took 16 hours. Your experience may be different and dependent on your network.

Warning

Please do not attempt to run data migration more than once. If you have experienced an issue with migration, please contact support immediately for next steps.

5. Change the Session Lock When Idle value back to what is was originally (or to a value aligned with your organization's security policy).

Troubleshooting

If data migration fails, do not add more data until the root cause of the failure has been determined.

Restart Services and Task

Data migration may be failing due to a service or task being unavailable. Restart the services and tasks to ensure they are available.

Windows

1. Open Services.
2. Right-click SecureSuite_Windows and select Restart.

3. Repeat step 2 for the MariaDB and Apache HTTPD services.
4. Open Task Scheduler.
5. Select Task Scheduler Library, right-click Keycloak, and select Run.

Linux

1. Open Terminal.
2. Run the following commands: 

sudo systemctl restart securesuite 
sudo systemctl restart mariadb
sudo systemctl restart apache2
sudo systemctl restart keycloak

Data Migrations Over 10 Hours (Only CIS-CAT Pro Dashboard)

If your data migration exceeds 10 hours, you may receive a failure message even though the data transfer is still running successfully.

To verify that the data migration has completed:

1. Go to SecureSuite/logs/securesuitelogs/ and open the securesuite.log.

Note

If you want CIS to double-check the status of the migration, submit the log to Product Support.

2. Check that the log shows the “special mappings” as the last data to be migrated. If the data migration was successful, it will say that (e.g., "successfully migrated special mappings") and will be followed by the connections closing (e.g., "Neo4j connection closed").

19/09/2025 00:14:39.024 INFO org.cisecurity.migration.MariadbMigrationService - successfully migrated special mappings
19/09/2025 00:14:56.710 INFO org.cisecurity.migration.MariadbMigrationService - successfully restricted migration user privileges after completion
19/09/2025 00:14:56.741 INFO org.neo4j.driver.internal.InternalDriver - Closing driver instance 1938718587
19/09/2025 00:14:56.975 INFO org.cisecurity.migration.MigrationHelperService - Neo4j connection closed.
19/09/2025 00:14:56.975 INFO org.cisecurity.migration.MigrationHelperService - source MariaDB connection closed.
19/09/2025 00:14:56.975 INFO org.cisecurity.migration.MigrationHelperService - target MariaDB connection closed.

Contact Product Support

Follow the instructions below to receive troubleshooting assistance:

1. Start a Product Technical Support ticket.
2. Fill out the ticket with as much details as possible and attach the securesuite log to the ticket.

Log Location

Go to your designated CIS SecureSuite Platform destination directory and then logs\securesuitelogs (e.g., C:\Program Files\SecureSuite\logs\securesuitelogs).