Imperva Cyber Community

communities_1.jpg
 View Only

  • 1.  DAM Audit Policy Capturing Queries Other Than DML Statements

    Posted 6 days ago

    Hello Everyone,

    We have configured an audit policy in Imperva DAM to capture only DML operations (INSERT, UPDATE, and DELETE). However, we are observing that some additional queries are also being captured by the policy, specifically queries starting with DECLARE and BEGIN.

    Our expectation is that only DML statements should be logged under this policy. We would like to understand:

    • Is there a way to refine the policy so that only actual INSERT, UPDATE, and DELETE statements are captured?
    • Has anyone encountered a similar scenario and found a recommended solution or best practice?

    We have attached sample evidence for reference.

    Any guidance or suggestions would be greatly appreciated.

    Thank you for your support.


    #DatabaseActivityMonitoring

    ------------------------------
    Bhuvan Shyam M
    Admin
    Karnataka Bank Ltd.
    Chennai
    ------------------------------


  • 2.  RE: DAM Audit Policy Capturing Queries Other Than DML Statements

    Posted 5 days ago
    DECLARE and BEGIN. Yes, this is normal behavior, as these are functions, procedures, or views where the underlying DML operations are the reason the corresponding SQL statements are being captured.
    Please try updating the policy as outlined below and verify whether it produces the expected result.
    go to global Objects - General dictionay group - create the group with the required commands 
    Ex
    in the policy add the match criteria -> General dictionary  and add/select the above created group . locations:select "Parsed Query"
    Ex


    ------------------------------
    Revn
    ------------------------------



  • 3.  RE: DAM Audit Policy Capturing Queries Other Than DML Statements

    Posted 3 days ago

    Hi Revan,

    Thank you for your suggestion.

    We implemented the General Dictionary Group approach and configured it under Match Criteria → General Dictionary → Parsed Query.

    The policy is now producing the expected results and capturing only the required DML activities.

    Appreciate your support.



    ------------------------------
    Bhuvan Shyam M
    Admin
    Karnataka Bank Ltd.
    Chennai
    ------------------------------

    Original Message


Related Content