Data Security Community

 View Only
Back to discussions
Expand all | Collapse all

DAM Audit Policy Capturing Queries Other Than DML Statements

  • 1.  DAM Audit Policy Capturing Queries Other Than DML Statements

    Posted 08-18-2026 07:27

    Hello Everyone,

    We have configured an audit policy in Imperva DAM to capture only DML operations (INSERT, UPDATE, and DELETE). However, we are observing that some additional queries are also being captured by the policy, specifically queries starting with DECLARE and BEGIN.

    Our expectation is that only DML statements should be logged under this policy. We would like to understand:

    • Is there a way to refine the policy so that only actual INSERT, UPDATE, and DELETE statements are captured?
    • Has anyone encountered a similar scenario and found a recommended solution or best practice?

    We have attached sample evidence for reference.

    Any guidance or suggestions would be greatly appreciated.

    Thank you for your support.


    #DatabaseActivityMonitoring

    ------------------------------
    Bhuvan Shyam M
    Admin
    Karnataka Bank Ltd.
    Chennai
    ------------------------------


  • 2.  RE: DAM Audit Policy Capturing Queries Other Than DML Statements

    Posted 08-19-2026 09:22
    DECLARE and BEGIN. Yes, this is normal behavior, as these are functions, procedures, or views where the underlying DML operations are the reason the corresponding SQL statements are being captured.
    Please try updating the policy as outlined below and verify whether it produces the expected result.
    go to global Objects - General dictionay group - create the group with the required commands 
    Ex
    in the policy add the match criteria -> General dictionary  and add/select the above created group . locations:select "Parsed Query"
    Ex


    ------------------------------
    Revn
    ------------------------------



  • 3.  RE: DAM Audit Policy Capturing Queries Other Than DML Statements

    Posted 08-21-2026 02:02

    Hi Revan,

    Thank you for your suggestion.

    We implemented the General Dictionary Group approach and configured it under Match Criteria → General Dictionary → Parsed Query.

    The policy is now producing the expected results and capturing only the required DML activities.

    Appreciate your support.



    ------------------------------
    Bhuvan Shyam M
    Admin
    Karnataka Bank Ltd.
    Chennai
    ------------------------------

    Original Message


  • 4.  RE: DAM Audit Policy Capturing Queries Other Than DML Statements

    Posted 08-25-2026 14:40
    Edited by Reed Maly 08-25-2026 15:16

    Gold!  Thanks for posting. 

    Would it be appropriate to include Privileged Operations within the same Policy?

    Much appreciate this.



    ------------------------------
    Reed Maly
    Computer Operations Analyst
    Assurity Life Insurance Company
    Lincoln NE
    ------------------------------

    Original Message


  • 5.  RE: DAM Audit Policy Capturing Queries Other Than DML Statements

    Posted 08-26-2026 09:23
    If any additional match criteria are added, the condition changes to an AND operation, meaning both criteria must match in the query for the event to be captured. If you are looking for privileged operations, add the appropriate group. For any custom requirements, you will need to create a custom group. Please ensure that you test the policy and verify that it meets your requirements.


    ------------------------------
    Revn
    ------------------------------

    Original Message


Related Content