Imperva Cyber Community

communities_1.jpg
 View Only

  • 1.  DAM Audit Policy Capturing Queries Other Than DML Statements

    Posted 25 days ago

    Hello Everyone,

    We have configured an audit policy in Imperva DAM to capture only DML operations (INSERT, UPDATE, and DELETE). However, we are observing that some additional queries are also being captured by the policy, specifically queries starting with DECLARE and BEGIN.

    Our expectation is that only DML statements should be logged under this policy. We would like to understand:

    • Is there a way to refine the policy so that only actual INSERT, UPDATE, and DELETE statements are captured?
    • Has anyone encountered a similar scenario and found a recommended solution or best practice?

    We have attached sample evidence for reference.

    Any guidance or suggestions would be greatly appreciated.

    Thank you for your support.


    #DatabaseActivityMonitoring

    ------------------------------
    Bhuvan Shyam M
    Admin
    Karnataka Bank Ltd.
    Chennai
    ------------------------------


  • 2.  RE: DAM Audit Policy Capturing Queries Other Than DML Statements

    Posted 24 days ago
    DECLARE and BEGIN. Yes, this is normal behavior, as these are functions, procedures, or views where the underlying DML operations are the reason the corresponding SQL statements are being captured.
    Please try updating the policy as outlined below and verify whether it produces the expected result.
    go to global Objects - General dictionay group - create the group with the required commands 
    Ex
    in the policy add the match criteria -> General dictionary  and add/select the above created group . locations:select "Parsed Query"
    Ex


    ------------------------------
    Revn
    ------------------------------



  • 3.  RE: DAM Audit Policy Capturing Queries Other Than DML Statements

    Posted 23 days ago

    Hi Revan,

    Thank you for your suggestion.

    We implemented the General Dictionary Group approach and configured it under Match Criteria → General Dictionary → Parsed Query.

    The policy is now producing the expected results and capturing only the required DML activities.

    Appreciate your support.



    ------------------------------
    Bhuvan Shyam M
    Admin
    Karnataka Bank Ltd.
    Chennai
    ------------------------------

    Original Message


  • 4.  RE: DAM Audit Policy Capturing Queries Other Than DML Statements

    Posted 18 days ago
    Edited by Reed Maly 18 days ago

    Gold!  Thanks for posting. 

    Would it be appropriate to include Privileged Operations within the same Policy?

    Much appreciate this.



    ------------------------------
    Reed Maly
    Computer Operations Analyst
    Assurity Life Insurance Company
    Lincoln NE
    ------------------------------

    Original Message


  • 5.  RE: DAM Audit Policy Capturing Queries Other Than DML Statements

    Posted 17 days ago
    If any additional match criteria are added, the condition changes to an AND operation, meaning both criteria must match in the query for the event to be captured. If you are looking for privileged operations, add the appropriate group. For any custom requirements, you will need to create a custom group. Please ensure that you test the policy and verify that it meets your requirements.


    ------------------------------
    Revn
    ------------------------------

    Original Message


Related Content