# What Is Database Activity Monitoring (DAM)? How Is Database Activity Monitored?

**URL:** https://securesys.com.tr/en/learning/database-security/what-is-database-activity-monitoring-dam

![What Is Database Activity Monitoring (DAM)? How Is Database Activity Monitored?](/images/bilgi-merkezi/covers/cover-veritabani-08.webp)

In corporate database security, knowing only who the users are is not sufficient.

What really matters is this:

#### What did this user actually do inside the database?

A DBA may technically hold access to the customer database.

However, this question must still be answered:

Was this access really made for a business purpose?

Why did a support user query millions of customer records at 03:00 at night?

Why did a service account connect to a table it had never reached before?

Why did a user who normally views 100 records suddenly pull 2 million records?

Why did an administrator change the audit setting?

These are the questions classic access control systems cannot answer on their own.

Authentication verifies who the user is.

Authorization determines what the user is permitted to do.

However:

#### Database Activity Monitoring – DAM

focuses on monitoring what the user actually did.

For this reason DAM is an important visibility and detection layer in modern database security architecture.

### What Is DAM?

DAM means:

#### Database Activity Monitoring

that is:

#### the monitoring of database activity

in full.

DAM solutions monitor and analyse activity taking place on the database such as;

login,

query,

privileged activity,

sensitive data access,

DDL,

DML,

configuration change

as their scope.

The purpose is not merely to collect logs.

The purpose is:

**to make sense of and detect suspicious database behaviour.**

### Are DAM and Database Audit the Same Thing?

No.

Database Audit mostly rests on the DBMS's own logging mechanism.

DAM, meanwhile, analyses this activity more centrally and with a security focus.

Simplified:

Database Audit:

#### What happened?

DAM:

#### Is this event normal or suspicious?

tries to answer this question.

### Why Is DAM Necessary?

As the number of databases in an organization grows, examining every system's audit logs one by one is not possible.

For example, let us imagine the organization has;

50 PostgreSQL,

30 MSSQL,

20 Oracle

databases.

Each database can produce millions of events a day.

DAM helps monitor this activity centrally.

### Which Problem Does DAM Solve?

The core problem is:

#### the lack of visibility inside the database

as the gap.

The firewall sees network traffic.

EDR sees endpoint behaviour.

The WAF sees web requests.

DAM, meanwhile:

**sees database query behaviour**

as its domain.

### What Kinds of Activity Can DAM Monitor?

For example:

Successful Login

Failed Login

SELECT

INSERT

UPDATE

DELETE

CREATE USER

GRANT

REVOKE

DROP TABLE

Database Export

Backup Activity

Sensitive Table Access

### Does DAM Only Monitor SQL Queries?

No.

Depending on the platform;

session,

authentication,

user,

role,

configuration,

database object

activity such as this can also be monitored.

### On Which Database Systems Can DAM Be Used?

DAM solutions can mostly support common systems such as;

PostgreSQL,

Microsoft SQL Server,

Oracle Database,

MySQL,

MariaDB

as their coverage.

Some solutions also support cloud database platforms.

### What Is DAM Architecture?

It expresses how the DAM solution collects and analyses database activity.

Different deployment models can exist.

### What Is Network-Based DAM?

It analyses database traffic at the network level.

This approach can provide visibility without installing an agent on the database server.

### What Is the Advantage of Network-Based DAM?

It can reduce the need to install a software agent on the production database.

### What Is the Disadvantage of Network-Based DAM?

Encrypted database traffic or local database activity may not be fully visible.

For this reason an additional method may be needed depending on the architecture.

### What Is Agent-Based DAM?

It is the monitoring of activity by installing an agent on the database or the operating system.

### What Is the Advantage of Agent-Based DAM?

It can provide higher visibility about local activity and encrypted sessions.

### Is There a Risk in Agent-Based DAM?

An agent on a production database;

performance,

compatibility,

availability

must be tested carefully in these respects.

### What Is Native Audit Integration?

DAM can read the database's native audit records.

### Can Native Audit and DAM Be Used Together?

Yes.

The database's native audit produces the events.

DAM analyses these events centrally.

### What Is Proxy-Based DAM?

It is database connections being passed through a proxy and analysed there.

### What Is the Advantage of the Proxy-Based Model?

Database traffic can pass through a central enforcement point.

### What Is the Disadvantage of the Proxy-Based Model?

It adds a new dependency to the database connection path.

For this reason high availability must be designed correctly.

### Can DAM Work Inline?

On some products, yes.

Queries can be examined before they reach the database.

### Can DAM Work Out-of-Band?

Yes.

It can perform monitoring only, without blocking the traffic.

### Are Blocking and Monitoring the Same?

No.

Monitoring:

detects suspicious behaviour.

Blocking:

tries to prevent the operation.

### Should DAM Block Queries?

This is determined according to the organization's risk.

On a production database, a critical query being blocked because of a false positive can create a serious outage.

For this reason monitor-only can be used at the start.

### What Is a DAM Policy?

They are the rules determining which database activity will be;

monitored,

alarmed,

blocked

as the outcome.

### A DAM Policy Example

For example:

DBA → Customer_PII table → SELECT

in this case an alert can be generated.

### Should Every SELECT Generate an Alarm?

No.

This creates far too many false positives.

Context is required.

### What Is DAM Context?

It is assessing together;

by whom,

at which hour,

from which IP,

from which application,

on which table,

with how much data

the query was executed.

### What Is Privileged User Monitoring?

It is the detailed monitoring of highly privileged users such as DBAs and administrators.

### Why Does DAM Monitor the DBA?

Because the DBA can hold a technical access right.

However, not every access may be business justified.

### If the DBA Can See Everything, How Is Security Provided?

If the privilege cannot be removed entirely;

audit,

DAM,

PAM,

session monitoring

accountability can be increased with these.

### Can DAM Record DBA Queries?

Yes.

Depending on the platform and product support, executed queries can be recorded.

### Can an Alarm Be Generated If the DBA Reads Sensitive Data?

Yes.

For example, if a DBA who normally works with system tables reaches the customer PII table, an alert can be generated.

### What Is Sensitive Data Access Monitoring?

It is the specific monitoring of access to database tables containing personal or critical data.

### How Is Sensitive Data Determined?

With data discovery and classification;

national ID numbers,

IBANs,

credit cards,

e-mail,

phone,

salary,

health data

fields such as these can be identified.

### Can DAM Perform Data Discovery?

Some DAM solutions can offer database discovery and sensitive data discovery features.

### What Is Database Discovery?

It is the identification of unknown database systems over the network or through the inventory.

### What Is a Shadow Database?

It is a database system running without the knowledge of the IT or security team.

### Why Is a Shadow Database Risky?

This system;

unpatched,

unbacked-up,

exposed to the internet,

outside audit

can be any of these.

### Can DAM Help Detect a Shadow Database?

On some platforms network discovery features can be used.

### What Is Sensitive Data Discovery?

It is the automatic or manual determination of which tables or columns inside the database contain sensitive data.

### Why Is Data Classification Critical for DAM?

DAM must not assess all tables at the same risk level.

For example, the product catalogue and customer PII do not carry the same sensitivity.

### What Is a Critical Table?

It is a database table carrying high risk from a corporate perspective.

For example:

Customer

Employee_Salary

Payment

User_Credential

### Should Critical Table Access Have Higher Severity?

Yes.

The alert risk score can be raised with data classification.

### What Is DAM Query Analysis?

It is the analysis of the queries executed on the database from a security perspective.

### What Does Query Analysis Examine?

For example:

Query Type

Source User

Target Table

Row Count

Execution Time

Time of Day

Application

### What Is a Query Pattern?

It is the SQL behaviour normally executed by an application or a user.

### What Is a Query Baseline?

It is the determination of the normal query pattern.

### Is Anomaly Detection Difficult Without a Baseline?

Yes.

Without knowing the normal behaviour, detecting abnormal behaviour becomes difficult.

### What Is DAM Anomaly Detection?

It is the detection of a user's deviation from their normal database behaviour.

### A Sample Database Anomaly

Normal:

The user queries 500–1,000 records between 09:00 and 18:00 during the day.

Abnormal:

They query 4 million records at 02:45 at night.

This can be a high-risk anomaly.

### What Is Behavioral Analytics?

It is the method analysing users' behaviour profiles.

### Can DAM Integrate with UEBA?

Yes.

User and Entity Behavior Analytics systems can assess database activity together with other identity behaviour.

### Can DAM Create a User Risk Score?

Some solutions can turn user activity into a risk score.

### Sample Risk Score Factors

Privileged Account

New Source IP

Night Access

Sensitive Table Access

Bulk Data Read

Database Export

when these come together a high risk score can arise.

### What Is Bulk Data Access?

It is far more records than normal being read in a short time.

### Is Bulk Data Access Always an Attack?

No.

ETL,

backup,

reporting

operations can read large volumes too.

### How Does DAM Distinguish Normal ETL from Data Exfiltration?

It uses context.

For example;

the service account,

the source IP,

the schedule,

the query pattern

can be compared.

### What Is Data Exfiltration Detection?

It is the detection of behaviour relating to database data being taken out without authorization.

### How Can Database Data Exfiltration Look?

For example;

a high-volume SELECT,

a database export,

a dump,

suspicious application access

it can be seen in these forms.

### Does DAM Detect Data Exfiltration with Certainty?

No.

Whether an activity is malicious requires context.

DAM provides the signal for detection and investigation.

### Why Is Database Export Monitoring Critical?

An export operation can take millions of records out in a single file.

### Can CSV Exports Be Monitored?

They can be monitored according to the audit and DAM capabilities on the application or database side.

### Should Database Dump Activity Be Monitored?

Yes.

On a production database in particular it can be a high-risk operation.

### Is Backup Activity Important for DAM?

Yes.

A backup can create a full copy of the production data.

### Why Should Restore Activity Be Monitored?

Production data being restored onto a different server can be a data leakage path.

### What Is an Alternate Restore Alarm?

It is the security alarm generated when the database is restored onto an unexpected system.

### Can DAM Detect Credential Abuse?

It can help through behaviour.

For example, if a stolen DBA credential is used from an unusual IP or at an unusual time, an anomaly can arise.

### How Are Credential Compromise and Insider Threat Distinguished?

It is not always easy.

For this reason identity, endpoint and database logs must be analysed together.

### How Do DAM and EDR Work Together?

Example:

EDR → Credential Dumping Alert

↓

DAM → A privileged database login by the same user

↓

DAM → Sensitive Table Bulk Read

These events can be a strong incident indicator.

### What Is the Difference Between DAM and SIEM?

DAM provides database-specific visibility.

SIEM collects and correlates many security sources centrally.

### Does DAM Replace SIEM?

No.

It is complementary.

### Does SIEM Replace DAM?

Not always.

Native database logs may not produce sufficient detail.

DAM can provide database-specific telemetry.

### Which Events Can DAM Send to SIEM?

For example:

Privileged Login

Failed Login Spike

Sensitive Data Access

Bulk Query

Audit Disabled

New DBA User

Suspicious Export

### Why Is DAM Valuable for the SOC?

The SOC can see database behaviour as well as endpoint and network activity.

### What Is Database Security Monitoring?

It is the continuous monitoring and analysis of database security events.

DAM can be one of the core tools of this process.

### Can DAM Provide Real-Time Monitoring?

Yes.

Depending on the capabilities of the product and the architecture, near real-time or real-time alerting can be done.

### Why Is a Real-Time Database Alert Important?

In a data exfiltration incident, responding hours later can be too late.

### How Should Alert Severity Be Determined?

The user's privilege level,

database criticality,

data sensitivity,

activity type,

anomaly score

it can be determined according to factors such as these.

### What Is DAM Policy Tuning?

It is the optimization of the alarm rules according to the real behaviour of the environment.

### Should DAM Block Everything on the Day It Is Installed?

No.

Learning the normal behaviour first and doing policy tuning is generally safer.

### What Is Learning Mode?

It is the DAM solution observing normal database behaviour for a defined period.

### How Long Should the Learning Period Be?

It varies according to the system's workload.

Special periods such as month-end closing and weekend operations must also be taken into account.

### What Is a False Positive?

It is normal database activity being flagged by mistake as an attack.

### What Happens If There Are Too Many False Positives?

The SOC can start ignoring the alarms.

This creates alert fatigue.

### What Is a False Negative?

It is a real attack failing to be detected.

### What Is the Purpose of DAM Tuning?

While false positives are reduced, the detection coverage of real attacks must be preserved.

### What Is a Known Application Baseline?

It is knowing which queries a particular application account normally executes.

### Can an Alarm Be Generated If the Application Account Reaches a New Table?

Yes.

It can be assessed particularly if it is outside the normal pattern.

### What Should Happen If a Service Account Logs In from a Different IP?

The application service account must come only from certain servers.

Another IP can be a high-risk event.

### What Is Source Application Monitoring?

It is monitoring which application made the database connection.

### Is Connection String Information Visible to DAM?

Depending on the product and the architecture, some client metadata can be visible.

### What Is Database User Mapping?

It is matching the database user with the real human or application identity.

### Why Is a Shared Account a Problem for DAM?

DAM sees the dbadmin account.

But it may not know which person is using the account.

For this reason personal accounts matter.

### Should PAM and DAM Be Used Together?

In critical environments it is very useful.

PAM:

#### Who opened the privileged session?

DAM:

#### What did they do inside the database?

each answers its own question.

### A Sample PAM + DAM Flow

The DBA opens an access request.

↓

The manager approves.

↓

PAM starts the session.

↓

DAM monitors the database queries.

↓

SIEM correlates the events.

This provides strong accountability.

### Does JIT Access Complement DAM?

Yes.

JIT limits the access duration.

DAM monitors the operations performed during the access.

### Are a Database Firewall and DAM the Same?

No.

A Database Firewall can focus on blocking certain queries or connections.

DAM provides broader monitoring and analytics.

### Can DAM Blocking Be Used?

On some solutions, yes.

For example;

a forbidden query,

an unexpected user,

critical table access

can be blocked.

### Why Must the Blocking Policy Be Used Carefully?

A false positive can create a production outage.

### What Is the Monitor First, Block Later Approach?

Behaviour is monitored first.

The policy is verified.

Then high-confidence rules can be moved into blocking mode.

### DAM and SQL Injection

DAM can see some signs of SQL Injection at the query level.

### Does DAM Prevent SQL Injection?

On its own, no.

Secure coding is the core control.

DAM is the detection layer.

### What Can DAM See After SQL Injection?

It can show the application account's;

table,

query type,

data volume

access differing from normal.

### DAM and Ransomware

Ransomware may not attack the database directly through SQL.

However, mass deletes or destructive database activity can be monitored.

### Should a Mass DELETE Alarm Be Generated?

On critical production systems, yes.

### Why Is a Mass UPDATE Risky?

A large amount of data being changed in a short time can be an integrity incident.

### Should DROP TABLE Be a Real-Time Alert?

On critical systems it can be assessed as a high-severity event.

### What Is Database Schema Change Monitoring?

It is the monitoring of CREATE, ALTER and DROP operations.

### What Can an Unexpected Schema Change Indicate?

It can be unauthorized administrator activity or the possibility of a compromise.

### Can DAM See the Audit Disable Event?

Depending on the product architecture, audit/configuration changes can be monitored.

### Why Is Audit Disable a Critical Event?

An attacker can disable logging so as to leave no trace.

### Can DAM Be Bypassed?

Like every security control, if an appropriate architecture is not built there can be a bypass risk.

For this reason DAM agents, collectors and policies must be protected too.

### Who Should Be the DAM Administrator?

Being managed as far as possible by a security team independent of the DBA can provide Separation of Duties.

### Should the DBA Be Able to Delete DAM Logs?

Where possible, no.

### Should DAM Logs Be Immutable?

For critical audit data, protection against modification can be evaluated.

### What Is DAM Retention?

It determines how long database activity records will be kept.

### How Should DAM Retention Be Determined?

Risk,

forensic requirements,

storage,

regulatory need

must be assessed together.

### Does DAM Produce Very Large Volumes of Data?

Yes.

On high-transaction databases a very high event volume can arise.

### Is Full Query Capture Suitable for Every Database?

Not always.

Risk-based capture can be applied.

### What Is Sensitive Query Capture?

It is the detailed recording of the activity of only certain critical users, databases or tables.

### Should Query Parameters Be Logged?

They can contain sensitive data.

For this reason masking or filtering must be applied.

### Can DAM Create a Privacy Risk?

Yes.

The monitoring system itself can also store sensitive database queries.

For this reason the DAM repository must be protected too.

### How Should the DAM Repository Be Protected?

Encryption,

RBAC,

MFA,

audit,

backup

must be applied.

### Why Is DAM High Availability Important?

If the monitoring system goes down, a loss of visibility can occur.

### Should a DAM Outage Stop the Database?

The decision must be made according to the deployment model.

On inline systems the fail-open/fail-close design can be critical.

### What Is Fail-Open?

It is database traffic continuing when DAM fails.

Availability is preserved but monitoring loss can occur.

### What Is Fail-Close?

When DAM fails the traffic is blocked.

Security can increase but there is a production outage risk.

### Which Should Be Preferred?

It must be determined according to business impact and risk assessment.

### What Is DAM Health Monitoring?

It is the monitoring of DAM's own;

collector,

agent,

storage,

policy

health.

### Is an Agent Offline Alarm Necessary?

Yes.

When database activity suddenly drops to zero it may not mean “there is no attack” but “there is no telemetry”.

### What Is DAM Coverage?

It shows how many of the organization's databases are monitored with DAM.

### What Is the DAM Coverage KPI?

For example:

Critical Database DAM Coverage = 100%

can be targeted.

### What Is Sensitive Database Coverage?

It shows how many of the databases containing sensitive data are under monitoring.

### What Is Privileged User Monitoring Coverage?

It shows what percentage of DBA accounts have their activity monitored with DAM.

### What Is DAM Policy Coverage?

It measures how many of the defined security use cases are monitored with an active policy.

### What Is a DAM Use Case?

It is the detection scenario created to detect a specific database security risk.

### Important DAM Use Cases

Examples:

Privileged user unusual access

Sensitive table bulk SELECT

New superuser creation

Mass DELETE

Database export outside schedule

Dormant user login

Service account from new IP

Audit disabled

Schema change outside maintenance window

### DAM Use Case 1 – DBA Sensitive Data Access

The DBA normally performs database maintenance.

One day they query millions of rows on the customer PII table.

DAM can detect this as a behavioural anomaly.

### DAM Use Case 2 – Compromised Service Account

The application account normally connects only from the application server IP.

One day it logs in from a different workstation IP.

A high-risk alert can be generated.

### DAM Use Case 3 – Bulk Data Exfiltration

A normal user reads an average of 1,000 rows.

Within one session 5 million rows are read.

DAM can generate a high-volume data access alarm.

### DAM Use Case 4 – Privilege Escalation

A DBA or elevated role is assigned to a normal user.

This can be sent to SIEM as a high-severity event.

### DAM Use Case 5 – Audit Evasion

The audit or monitoring configuration is changed.

This can be assessed as defence evasion behaviour.

### DAM Use Case 6 – Production Export

The entire production database is exported outside working hours.

If this operation does not match a change or backup job it can be investigated.

### DAM and Ticket Integration

Change or access ticket information can be added to the alert context.

### Why Is Ticket Context Useful?

A schema change made at night can look like an attack.

However, if there is an approved maintenance ticket it can be normal.

### DAM and CMDB Integration

The database asset's;

owner,

criticality,

environment

information can be obtained from the CMDB.

### How Does the CMDB Affect DAM Severity?

A production payment database alert and a development test database alert must not have the same severity.

### DAM and Data Classification Integration

Sensitive table information can be obtained from the DLP or data classification system.

### The Difference Between DAM and DLP

DAM monitors access inside the database.

DLP monitors the movement of data over endpoints, e-mail or the cloud.

### How Do DAM and DLP Work Together?

DAM:

The user read 2 million customer records.

DLP:

The same user tried to send a CSV file outside.

SIEM:

Correlated the events.

This provides far stronger detection.

### DAM and NDR Integration

NDR can detect an unusual network connection coming to the database.

DAM can show the query behaviour after the connection.

### DAM and EDR Integration

EDR shows the endpoint compromise.

DAM can show the database access from that endpoint.

### DAM and IAM Integration

Identity information can be used for database user mapping.

### DAM and Active Directory

If the relationship between the AD user and the database login can be established, incident investigation becomes easier.

### DAM and Cloud IAM

In cloud database access, cloud identity and database activity can be assessed together.

### What Is Cloud Database DAM?

It is the central monitoring of activity on managed database services.

### Is DAM Necessary on a Cloud Database?

Being managed does not eliminate database activity risk.

### Should the Cloud Control Plane and DAM Be Monitored Together?

Yes.

For example:

Cloud IAM → Public Access Enabled

DAM → Unknown IP Login

DAM → Bulk Data Read

together these events form a very strong signal.

### Is Database Public Exposure Detected with DAM?

DAM can show the activity.

Network and cloud security tools determine the exposure better.

### Is DAM a Database Vulnerability Scanner?

No.

DAM performs activity monitoring.

A vulnerability scanner looks for configuration issues and vulnerabilities.

### The Difference Between DAM and a Database Security Assessment

Assessment:

#### How securely is the system configured?

DAM:

#### What is happening on the system?

each answers its own question.

### DAM Does Not Do Patch Management

Correct.

DAM does not apply patches.

However, it can help detect abnormal activity after an exploit.

### DAM Does Not Replace Backup

Correct.

DAM provides data activity monitoring.

It does not provide recovery.

### DAM Does Not Replace Encryption

Correct.

Encryption protects the data.

DAM monitors the access.

### DAM Does Not Replace PAM

Correct.

PAM controls privileged access.

DAM monitors behaviour inside the database.

### A Strong Database Security Stack

Sample structure:

#### IAM

↓

#### MFA

↓

#### PAM / JIT

↓

#### RBAC / Least Privilege

↓

#### Database Hardening

↓

#### Encryption

↓

#### DAM

↓

#### SIEM / SOC

↓

#### Backup / Recovery

All of these layers reduce different risks.

### How Is a DAM Deployment Project Started?

The first step must not be installing a product.

First;

the database inventory,

criticality,

data classification,

use cases

must be determined.

### Sample Stages for a DAM Project

- The database inventory is produced.
- Critical databases are identified.
- Sensitive data is classified.
- Privileged accounts are listed.
- The monitoring architecture is chosen.
- The DAM collector/agent is installed.
- The learning period is started.
- Policy tuning is performed.
- The SIEM integration is made.
- SOC use cases are put into service.

### Which Databases Should Be Brought into DAM First?

On a risk basis;

customer,

finance,

personnel,

payment,

authentication

production systems containing such data can be prioritized.

### How Should a DAM Proof of Concept Be Done?

Merely showing that the product produces logs is not enough.

Real use cases must be tested.

### What Can Be Tested in a DAM POC?

For example:

DBA login detection

Sensitive table access

Bulk SELECT

User creation

Role grant

SIEM alert latency

### Is a DAM Performance Test Necessary?

Yes.

Its effect must be measured under a workload close to production.

### What Is DAM Alert Latency?

It is the time between the database activity and the alert being generated.

### Why Is Latency Important in the Data Exfiltration Use Case?

Millions of records can leave within minutes.

### Can a DAM SLA Be Defined?

Yes.

Within what time critical events will reach the SOC can be defined.

### How Should DAM Be Connected to the Incident Response Process?

A critical DAM alert can automatically create an incident.

### A Sample DAM Incident Flow

DAM Alert

↓

SIEM Correlation

↓

SOC Triage

↓

User/Asset Context

↓

Database Investigation

↓

Containment

↓

Incident Response

### Should the Account Be Closed Automatically After a DAM Alert?

Not for every event.

On high-confidence use cases, automation with SOAR can be evaluated.

### Can SOAR Be Used with DAM?

Yes.

### What Is SOAR?

Security Orchestration, Automation and Response provides automatic or semi-automatic response to events.

### A DAM + SOAR Example

Critical DAM alert:

Unexpected DBA + Bulk PII Read.

SOAR:

Terminate the PAM session.

Increase the user risk.

Create an incident.

Notify the SOC.

This can be controlled automation.

### Is Automatic Blocking Risky?

Yes.

A false positive can halt a critical business process.

For this reason an approval mechanism can be used.

### The DAM Maturity Model

#### Level 1 – No Visibility

Database activity is not monitored centrally.

#### Level 2 – Native Logs

Database audit logs exist.

#### Level 3 – Central Monitoring

DAM or central monitoring is used.

#### Level 4 – Behavioral Detection

Anomaly and sensitive data use cases exist.

#### Level 5 – Automated Response

DAM + SIEM + PAM + SOAR work integrated.

### What Are the DAM KPIs?

For example:

Critical Database Coverage

Privileged User Coverage

Sensitive Data Coverage

Alert Response Time

False Positive Rate

Policy Coverage

DAM Availability

### What Is the False Positive Rate?

It measures how many of the alerts generated do not represent a real risk.

### Is a Very Low Alert Count Good?

Not always.

The monitoring may be incomplete or the policy too narrow.

### Is a DAM Coverage Report Useful for Management?

Yes.

For example:

Critical Database: 24

DAM Monitored: 22

Coverage: 91.7%

a report along these lines can be created.

### Questions Management Should Ask About DAM

Management must be able to get answers to these questions:

How many critical databases do we have?

How many of them are under DAM?

Can we monitor DBA activity?

Do we know our sensitive data tables?

If a user pulls millions of records, do we receive an alarm?

When a database is exported, do we notice it?

Who manages the DAM logs?

Do DAM events go to SIEM/SOC?

### The Most Common Mistakes in Database Activity Monitoring

The mistakes frequently seen in organizations are as follows:

- Installing DAM only for compliance
- Deploying without producing a database inventory
- Not classifying sensitive data
- Giving every query the same risk level
- Not monitoring privileged users specifically
- Using a shared DBA account
- Not running a learning period
- Not doing policy tuning
- Producing far too many false positives
- Not integrating DAM with SIEM
- Giving the DAM administrator the same role as the DBA
- Not protecting the DAM logs
- Not monitoring agent health
- Covering only on-prem databases
- Leaving DR databases outside monitoring

### The PostgreSQL DAM Approach

In PostgreSQL environments DAM;

native logs,

an audit extension,

network or agent-based telemetry

can collect activity through these.

Particularly;

superuser,

role changes,

critical table access,

connection behaviour

can be monitored.

### The MSSQL DAM Approach

In Microsoft SQL Server environments;

SQL Server Audit,

Extended Events,

network activity

sources such as these can be associated with DAM.

### The Oracle DAM Approach

In Oracle environments, native audit, Unified Auditing and database activity sources can be used with DAM.

### Why Is Multi-Platform Support Important for DAM?

In large organizations different database technologies can be present.

By providing a common monitoring layer, DAM can offer security teams a single view.

### What Can a Central DAM Dashboard Show?

For example:

Top Privileged Users

Critical Alerts

Sensitive Database Access

Failed Login Trend

Top Data Volume Users

New Database Discovery

### What Should a Database Security Dashboard Look Like for Management?

Rather than SQL query detail;

risk,

coverage,

incidents,

trends

it must show these.

### DAM and KVKK

On databases containing personal data, access being traceable contributes to the data security process.

DAM;

who,

when,

which sensitive data

can support tracking the answer to these.

However, DAM on its own does not provide KVKK compliance.

### DAM and ISO/IEC 27001

From an ISO/IEC 27001 perspective, logging, monitoring, access control and security event management are important areas.

DAM supports these controls at the database level.

### DAM and PCI DSS

In environments containing card data, privileged access and data activity monitoring are among the important security needs.

### DAM and Forensic Investigation

After an incident, which account ran which queries can be investigated.

### Does DAM Contribute to the Forensic Timeline?

Yes.

Database events can be placed in chronological order with other logs.

### A Sample Forensic Timeline

02:58 → EDR credential alert

03:02 → Privileged DB login

03:04 → Customer table access

03:08 → 2.8 million rows read

03:11 → Database export

03:13 → Outbound network anomaly

This chain makes understanding the incident scope easier.

### What Do We Lose If There Are No DAM Logs?

We can lose the detail of the activity performed on the database.

This in turn makes incident investigation harder.

### Frequently Asked Questions

#### What is DAM?

Database Activity Monitoring is the approach that centrally monitors and analyses database activity for security purposes.

#### Are DAM and database audit the same?

No. While native audit records the events, DAM can analyse them centrally and produce anomalies and security alerts.

#### Does DAM monitor the DBA?

Yes. Privileged user monitoring is one of DAM's most important use cases.

#### Does DAM prevent SQL Injection?

On its own, no. However, it can help detect abnormal query behaviour.

#### Does DAM detect data leakage?

It can help detect signals such as bulk reads, exports and unusual sensitive data access.

#### Does DAM replace SIEM?

No. DAM provides database-specific visibility; SIEM correlates different sources centrally.

#### Should DAM and PAM be used together?

In critical environments it is quite useful. PAM controls the access, DAM monitors the activity performed inside the database.

#### Does DAM affect performance?

Depending on the deployment method it can. For this reason a performance test must be done before production.

#### Should DAM record all queries?

Not always. An audit policy must be created according to risk and data sensitivity.

#### Can DAM be used on cloud databases?

Yes. Depending on the product and cloud service support, managed database activity can be monitored.

### Conclusion: Being Authorized Does Not Mean Every Activity Is Normal

One of the most important realities of database security is this:

A user being technically authorized does not mean every operation they perform is secure or necessary for the business.

The DBA can reach the customer database.

But querying millions of pieces of personal data at night may not be normal.

The application account can connect to the database.

But connecting from a different IP may not be normal.

The reporting user can perform a SELECT.

But exporting the entire database may not be normal.

For this reason modern database security must not be limited to:

#### Access Control

as its only measure.

The behaviour performed after the access must be monitored too.

This is the core purpose of DAM.

A strong Database Activity Monitoring architecture;

**Database Discovery,**

**Sensitive Data Classification,**

**Privileged User Monitoring,**

**Query Analysis,**

**Behavioral Analytics,**

**Anomaly Detection,**

**Data Exfiltration Detection,**

#### SIEM Integration

and **Incident Response**

brings these processes together.

The most important security chain can be thought of as follows:

#### IAM

↓

#### MFA

↓

#### PAM

↓

#### RBAC

↓

#### Database

↓

#### DAM

↓

#### SIEM

↓

#### SOC

↓

#### Incident Response

Here DAM sits at a critical point.

Because it makes what is actually happening inside the database visible to the security team.

For this reason, from a corporate database security perspective, the right question is not only:

**“Is the user authorized to reach this data?”**

on its own;

but at the same time:

**“Is this access normal, necessary and consistent with usual behaviour?”**

is what it must be.

If an organization can answer this question reliably:

**“If the DBA queries sensitive customer data outside a business purpose, would we notice it?”**

then it has reached an important maturity level in database security.

The real DAM approach can be summarized in four words:

**Visibility + Context + Detection + Response**

#### Next Chapter

#### PostgreSQL, MSSQL and Oracle Security: Critical Configurations and Differences

In the next chapter we will move from the vendor-independent database security approach to three important enterprise database platforms.

**We will address PostgreSQL Security, Microsoft SQL Server Security, Oracle Database Security, Authentication, Superuser/SA/SYS Accounts, Network Security, TLS, Auditing, Encryption, Patch Management, Backup and Hardening comparatively.**

We will also answer this question:

**“Is the security approach the same for PostgreSQL, MSSQL and Oracle, or does each platform have its own critical points?”**