Data Security Community

 View Only
Back to discussions
Expand all | Collapse all

Logic to block using exclude all in criteria

  • 1.  Logic to block using exclude all in criteria

    Posted 09-08-2026 12:59

    Good morning.
    I am testing a blocking scenario using security policies. I have two criteria: the user and the application. Based on these criteria, I expect everything to be blocked unless a user named "peter" connects to the database using SQL Management Studio. However, if I use the user "peter" with Toad, for example, the connection still succeeds. It is not respecting both criteria. I am unsure if I have correctly implemented the policy logic-specifically, that both conditions must be met to allow the connection.


    #DatabaseActivityMonitoring
    #ImpervaAgent

    ------------------------------
    Gerson Acevedo
    Ingeniero De Implementación Y Soporte
    SISAP - Sistemas Aplicativos, S.A.
    Guatemala
    ------------------------------


  • 2.  RE: Logic to block using exclude all in criteria

    Posted 09-08-2026 14:33
    Edited by Cezmi Cal 8 days ago

    Hi,

    For blocking to work, related server group must first be in active mode, and the "Block" option must be enabled in the Agent settings.

    Do you have any alert for your Toad connection on MX GUI?



    ------------------------------
    Cezmi Cal
    Consultant
    Barikat Internet Guvenligi Bilisim Ticaret A.S.
    Ankara
    ------------------------------



  • 3.  RE: Logic to block using exclude all in criteria

    Posted 09-08-2026 15:23

    It blocks communication if both criteria are met. However, if one criterion matches but the other does not, the policy is not triggered and the traffic passes through

    If Peter attempts to connect using an application other than SQL Studio, the system should block him; however, because the connection matches the database username criteria but not the application criteria, the policy does not trigger a match, and the connection is allowed.



    ------------------------------
    Gerson Acevedo
    Ingeniero De Implementación Y Soporte
    SISAP - Sistemas Aplicativos, S.A.
    Guatemala
    ------------------------------

    Original Message


  • 4.  RE: Logic to block using exclude all in criteria

    Posted 09-09-2026 02:32

    Can you share the policy criterion here?

    Additionally, if you select 2 different criteria, they are ANDed and both conditions should be met to trigger policy.



    ------------------------------
    Cezmi Cal
    Consultant
    Barikat Internet Guvenligi Bilisim Ticaret A.S.
    Ankara
    ------------------------------

    Original Message


  • 5.  RE: Logic to block using exclude all in criteria

    Posted 09-09-2026 03:34

    Following policy worked on my lab environment. when I try to login any application other than sql server management studio, the policy triggers.



    ------------------------------
    Cezmi Cal
    Consultant
    Barikat Internet Guvenligi Bilisim Ticaret A.S.
    Ankara
    ------------------------------

    Original Message


Related Content