Database Audit and Log Management: Who Accessed What, and When?

Controlling access is very important in database security.

However, restricting access alone is not sufficient.

Once a user has been permitted to reach the database, these questions must be answerable too:

Who connected?

When did they connect?

From which IP address did they come?

Which database did they reach?

Which table did they read?

Which data did they change?

Did they create a new user?

Did they grant a privilege?

Did they pull bulk data?

Did they change the audit settings?

If there are no answers to these questions, the organization's real visibility over the database is limited.

For this reason one of the most important parts of the modern database security approach is the:

Database Audit and Log Management

processes.

Database audit enables security-relevant activity taking place on the database to be recorded.

Log management, meanwhile, covers these records being;

collected,

stored,

protected,

analysed

and investigated when needed.

The core principle is this:

If a critical operation is being performed on a database, that operation must leave a trace.

However, a strong audit system does not merely produce logs.

Those logs need to be;

moved to a central system,

protected against deletion,

held with correct time information,

kept for a sufficient period

and genuinely analysed.

What Is a Database Audit?

A Database Audit is the recording of user and system activity carried out on the database for security and traceability purposes.

Audit records;

the user,

the time,

the operation,

the target object,

the result

can contain information such as this.

Are Database Logging and Database Audit the Same Thing?

Not exactly.

Database logging is a broader concept.

For example;

startup,

shutdown,

performance,

error,

checkpoint

it can contain technical events such as these.

An audit, meanwhile, focuses more on the:

Who did what?

question.

What Is an Operational Log?

They are the records relating to the technical operation of the database.

For example:

Service started

Backup failed

Replication disconnected

Disk error

events such as these can fall within the scope of the operational log.

What Is a Security Audit Log?

It records user and security activity.

For example:

Login successful

Login failed

User created

Privilege granted

Sensitive table accessed

What Is a Query Log?

It is the recording of the queries executed on the database.

Recording every query for every database may not be appropriate in terms of performance and storage.

For this reason risk-based logging must be used.

Why Is a Database Audit Critical?

When a security incident occurs, the organization has to answer this question:

What happened?

The questions that follow it:

Who did it?

With which user was it done?

From which system did it come?

Which data was affected?

How long did it take?

Audit records enable these questions to be answered.

Is Incident Investigation Possible Without an Audit?

It can be very difficult.

Network or application logs can provide some clues.

However, the real activity inside the database may be unknown.

For Which Purposes Is a Database Audit Used?

The main purposes:

Security Monitoring

Incident Response

Forensic Investigation

Compliance

Privileged User Monitoring

Data Access Tracking

Fraud Detection

Whose Database Activity Should Be Audited?

On a risk basis;

DBA,

privileged user,

application service account,

developer,

support user,

external consultant

the activity of these can be monitored.

Why Should DBA Activity Be Monitored in Particular?

The DBA holds high privileges.

They can read data.

They can change privileges.

They can create users.

They can change database objects.

For this reason DBA audit is one of the core controls of database security.

Is the “The DBA Is Trusted, No Need to Log” Approach Correct?

No.

An audit is not carried out only to catch a malicious employee.

It is also necessary for human error, wrong operations and incident investigation.

What Is Privileged User Monitoring?

It is the specific monitoring of highly privileged users' database activity.

Which Events Should Be Monitored for a Privileged User?

For example:

Privileged login

Role change

User creation

Database configuration change

Sensitive data query

Audit disable

Backup/restore operation

What Is Database Login Audit?

It is the recording of users' successful or failed connections to the database.

Why Should a Successful Login Be Logged?

At what hours and from which sources critical users connect can be seen.

Why Can a Failed Login Be More Critical?

More than one failed login;

brute force,

credential stuffing,

a wrong password,

an application configuration error

can be an indicator of these.

What Is a Failed Login Threshold?

It is an alarm being generated according to the number of failed logins occurring in a defined time interval.

For example, while there are normally a few errors a day, hundreds of failed logins occurring in one minute is abnormal.

Why Can a Dormant Account Login Generate an Alarm?

An account unused for six months suddenly logging in can be an indicator of a compromise.

Should Break-Glass Account Usage Be Monitored?

Absolutely.

Use of the break-glass account must be a high-priority security event.

Is a DBA Out-of-Hours Login Alarm Useful?

Yes.

However, on its own it does not mean malicious behaviour.

It can be on-call or maintenance.

For this reason it must be assessed with context.

Should the Source IP Be Logged?

Yes.

Knowing from which IP address the user connected is valuable for incident investigation.

Should the Hostname Be Logged?

Where possible, yes.

It helps identify the source device.

Can the Application Name Be Logged?

Some database platforms can record client application information.

This helps separate normal from abnormal access.

Should the Authentication Method Be Logged?

Where possible, yes.

For example;

password,

certificate,

SSO

authentication types such as these can be useful for investigation.

What Is a Session ID?

It is the value uniquely identifying the database connection.

It can help correlate the activity within one session.

Why Are Session Start and End Times Important?

They show how long the user remained active on the database.

What Is DDL Audit?

DDL is:

Data Definition Language

which expresses the operations changing the database structure.

For example:

CREATE

ALTER

DROP

these operations.

Why Should DDL Operations Be Audited?

Because schema changes;

an application outage,

data loss,

a security change

can create these.

Is DROP TABLE a Critical Event?

Yes.

On a production database, DROP operations can be a high-priority audit event.

Should CREATE USER Be Logged?

Absolutely.

The creation of a new user changes the database access surface.

Should GRANT and REVOKE Be Logged?

Yes.

Authorization changes are critical events from a security perspective.

Why Should Role Assignment Be Monitored?

Granting a privileged role to a user can be a privilege escalation.

What Is DML Audit?

DML is:

Data Manipulation Language

which expresses the operations performed on the data.

For example:

INSERT

UPDATE

DELETE

SELECT

operations such as these.

Should All DML Operations Be Logged?

Not always.

On high-transaction systems an enormous log volume can arise.

For this reason risk-based audit can be applied for critical tables and users.

Why Should SELECT Be Audited?

Because a data breach is not only data modification.

An attacker can read millions of customer records without changing a single record.

What Is Sensitive Table Access?

It is access made to tables containing sensitive data.

For example;

Customer_PII

Salary

Payment

Health_Data

these tables.

How Is Sensitive Table Access Determined?

Which tables are sensitive can be determined through data classification and discovery processes.

What Is a Bulk SELECT?

It is a query reading far more data than normal.

Why Can a Bulk SELECT Be Suspicious?

If a normal user reads 100 records but suddenly pulls 5 million records, the possibility of data exfiltration can be assessed.

Is Every Large Query an Attack?

No.

Reporting or ETL operations can read large volumes too.

For this reason user and workload baselines matter.

What Is a Query Baseline?

The profile of normal query behaviour on the database is established.

For example;

which account,

which hour,

which tables,

the average row count

is known.

How Is Anomaly Detection Used in Database Audit?

Significant deviations from normal behaviour are detected.

For example:

The DBA queried the customer table for the first time.

The service account connected from a different IP.

The reporting user performed a DELETE.

Are Database Audit and DAM the Same?

No.

Database audit is generally the DBMS's own logging mechanism.

DAM, meanwhile, is a separate security layer monitoring and analysing activity centrally.

Does DAM Complement Database Audit?

Yes.

It provides a strong advantage particularly for centrally monitoring a large number of databases.

The Relationship Between Database Audit and SIEM

Database audit events can be sent to SIEM.

SIEM can correlate with different security sources.

A Sample SIEM Correlation

EDR:

Credential theft detected.

↓

Firewall:

An unusual database connection from the application server.

↓

Database Audit:

Privileged login.

↓

DAM:

Bulk customer table read.

↓

SIEM:

Critical incident.

This structure provides far stronger visibility than a single log source.

What Is Log Correlation?

It is relating events coming from different systems through time and context.

Where Should Database Audit Logs Be Stored?

They must not be kept only on the database server.

Critical logs can be transferred to a central log server or SIEM system.

Why Must the Audit Log Be Sent Outside the Database Server?

If the database is compromised, the attacker can delete the local logs.

Changing the copy in the central system is harder.

What Is Log Tampering?

It is audit records being changed or deleted maliciously.

How Is Audit Log Integrity Protected?

For example;

append-only storage,

immutable storage,

restricted access,

hashing

can be used.

What Is an Immutable Audit Log?

They are audit records that cannot be changed or deleted for a defined period.

Can WORM Storage Be Used for Audit?

Yes.

The Write Once Read Many approach can support log integrity.

Should the DBA Reach the Audit Logs?

There can be a need to read them.

However, the privilege to change or delete the logs must be restricted as far as possible.

Should the DBA Be Able to Turn Off Audit?

This is a critical security control.

Where possible, audit configuration changes must be logged separately and must generate an alert.

Why Is the Audit Disabled Alarm Important?

An attacker or an insider can turn off audit so as to leave no trace.

For this reason audit disable can be a high-severity event.

Should an Audit Policy Change Be Logged?

Yes.

Narrowing the audit scope can also be a security event.

What Is Database Log Retention?

It is the policy determining how long the logs will be kept.

How Long Should the Audit Log Be Kept?

There is no single period.

The organization's;

risk,

regulation,

forensic need,

storage capacity

must be taken into consideration.

Why Is Very Short Retention Risky?

If the attack is noticed months later, the necessary logs may have been deleted.

Can Very Long Retention Create a Problem?

Yes.

Storage cost and privacy requirements can arise.

What Are Hot, Warm and Cold Log Storage?

Hot

Recent logs that can be queried quickly.

Warm

Lower-cost but still accessible logs.

Cold

Long-term archive.

This model can optimize log cost.

Why Does the Database Audit Log Size Grow?

If every query or every row is logged, a very high volume can arise.

What Is Audit Flood?

It is the log system being overloaded because too many audit events are produced.

Does Audit Affect Performance?

Yes.

Heavy audit operations can consume CPU, IO and storage.

How Is an Audit Performance Problem Solved?

Instead of turning audit off;

risk-based event selection,

asynchronous logging,

centralized processing

can be used.

What Is Risk-Based Logging?

It is prioritizing critical activity instead of logging every event at the same level.

Which Database Events Are Generally High-Risk?

For example:

Privileged Login

User Creation

Role Grant

Audit Disabled

Sensitive Data Export

Mass Delete

Backup Restore

Configuration Change

Should a Database Configuration Change Be Audited?

Yes.

Authentication or logging configuration changes can be particularly critical.

Should a Database Restart Be Audited?

Yes.

An unexpected restart can be an indicator of an availability and security event.

Should It Be Known Who Performed a Database Shutdown?

On critical production systems, yes.

Should Backup Operations Be Audited?

Yes.

Because a backup can create a full copy of the production data.

Should Database Backup Downloads Be Audited?

Absolutely.

The backup file being taken out can be a data exfiltration path.

Should Restore Operations Be Audited?

Yes.

Restores made to a different server or environment in particular must be monitored.

Is an Alarm Needed If the Production Database Is Restored to the Test Environment?

In critical environments this operation must be controlled and approved.

Should Database Export Operations Be Monitored?

Yes.

A CSV, dump or bulk export can take sensitive data out in a single file.

Should Stored Procedure Creation Be Logged?

Yes.

New code can start running inside the database.

Why Should Trigger Creation Be Audited?

A trigger can perform data changes automatically.

A malicious or wrong trigger can create a serious impact.

Should Scheduled Jobs Be Audited?

Yes.

Code running through a database job or scheduler can be critical.

Why Should Database Link Creation Be Monitored?

It can create a connection to another database and widen the attack surface.

Why Should a Linked Server Be Audited?

When one database is compromised, a pivot risk to another server can arise.

Should Extension or Plugin Installation Be Audited?

Yes.

It can change the database's capabilities and attack surface.

Should Superuser Creation Generate an Alarm?

Absolutely.

A new highly privileged user is a critical event.

Should a Password Change Be Logged?

Password changes on privileged accounts in particular can be audited.

Should the Credential Itself Be Logged?

No.

Passwords and secrets must never be written to the logs in plaintext.

Can Sensitive Data Be Present in SQL Query Logs?

Yes.

Query parameters;

national ID numbers,

passwords,

tokens,

credit cards

can contain sensitive values such as these.

What Is Log Masking?

It is the hiding of sensitive fields in audit or application logs.

Does Database Query Logging Carry a Privacy Risk?

Yes.

Excessively detailed logging can create a new sensitive data store.

Should Logging and Data Minimization Be Considered Together?

Yes.

The information necessary for security must be kept, but unnecessary personal data must not be logged.

Is Parameter Logging Always Necessary?

No.

Some sensitive query parameters can be masked.

What Should Be in the Database Audit Log?

Sample fields:

Timestamp

User

Source IP

Database

Schema

Object

Action

Result

Session ID

Application Name

Why Is the Timestamp Critical?

Correct time information is needed so that events on different systems can be correlated.

What Is Time Synchronization?

It is servers synchronizing their clocks to a common and accurate time source.

What Is NTP?

Network Time Protocol is the widespread protocol used in synchronizing system clocks.

What Happens If the Database and SIEM Clocks Differ?

Building the incident timeline becomes difficult.

Is Using UTC Logs Useful?

In large, multi-location structures UTC can provide standardization.

Should the Log Timezone Be Stated?

Yes.

Which timezone the timestamp belongs to must be known.

What Is a Forensic Timeline?

It is the events during an incident being arranged in chronological order.

What Is Database Forensic Investigation?

It is the investigation of events on the database through audit, logs and other evidence.

Which Sources Are Used in a Forensic Investigation?

For example:

Database Audit

Transaction Logs

Operating System Logs

Application Logs

WAF Logs

EDR Logs

Firewall Logs

SIEM

Can the Transaction Log Be Used for Forensic Purposes?

In some cases it can provide information about transaction changes.

However, appropriate tools and a process are required for this.

Are Database Audit and the Transaction Log the Same?

No.

The transaction log is created for database consistency and recovery.

Audit, meanwhile, is designed for security and accountability.

How Is Database Audit Used in Incident Response?

During the incident;

the compromised account,

the accessed tables,

the changed data,

the event timeline

can be determined.

What Should the First Question Be After an Incident?

Which account was used?

Then:

From which IP did it come?

How long did it remain active?

Which objects did it reach?

What Is Data Breach Scope?

It is determining how much data and how many users the unauthorized access affected.

Does the Audit Log Help Determine the Scope?

Yes.

Sensitive table and query activity records in particular are very valuable.

Does KVKK Breach Analysis Become Harder Without a Database Audit?

On systems containing personal data, determining who reached which data can become difficult.

For this reason traceability is an important technical control.

Database Audit and KVKK

If there is personal data inside the database, access and security events being traceable supports the data security process.

Audit on its own does not provide compliance but it is an important part of the technical security measures.

Database Audit and ISO/IEC 27001

In the ISO/IEC 27001 approach, logging, monitoring, privileged access and security event management are important control areas.

Database audit supports the technical foundation of these processes.

Database Audit and PCI DSS

In environments containing card data, user activity and privileged access logging are particularly important.

The Relationship Between Database Audit and Non-Repudiation

An audit can make it harder for a user to later deny an operation they performed.

However, strong authentication and log integrity are also required.

Does a Shared Account Break Non-Repudiation?

Yes.

If more than one person uses the same account, tying an operation to a single person becomes difficult.

Should Audit and Personal Accounts Be Used Together?

Absolutely.

For the audit to be meaningful, the identity must be correct.

How Can a Database Audit Architecture Be Built?

Example:

Database

↓

Native Audit / Activity Logs

↓

Log Collector

↓

SIEM

↓

Correlation & Detection

↓

SOC Investigation

↓

Immutable Archive

In this architecture the log can be used both for real-time monitoring and for long-term forensic purposes.

What Is a Log Collector?

It is the component gathering logs from different systems and sending them to a central platform.

Should the Log Collector Be Highly Available?

In critical environments, yes.

If the collector goes down, log loss can occur.

What Is Log Buffering?

It is logs being held temporarily when SIEM is unreachable and sent when the connection returns.

How Is Log Loss Detected?

Heartbeat, event count or sequence checks can be used.

What Is Audit Pipeline Monitoring?

It is monitoring not only the database but the log transfer chain as well.

Why Is the “No Logs Arriving” Alarm Important?

There being no security events at all and the log source being broken must not look the same.

Should Database Log Source Health Be Monitored?

Yes.

If SIEM receives no events from the database source for a long time, it can generate an alarm.

Should the Audit Configuration Be Backed Up?

Yes.

The audit policy and SIEM integration configurations must be documented.

Should Audit Be Checked After a Database Upgrade?

Absolutely.

The audit configuration may have changed after the upgrade.

Should It Be Checked Whether Audit Works After a Failover?

Yes.

The same logging level needs to be active on the secondary node.

Should DR Database Audit Be Forgotten?

No.

When the DR environment is activated the same audit policy must be applied.

How Is Cloud Database Audit Done?

Managed cloud database services;

native audit,

activity logs,

cloud monitoring

can offer these features.

They can be transferred to a central SIEM.

What Is a Cloud Control Plane Log?

It shows activity on the database service's cloud management layer.

For example;

database created,

public access enabled,

backup policy changed

it can show events such as these.

What Is the Difference Between Data Plane and Control Plane Logs?

Control Plane:

The service's management operations.

Data Plane:

Data access inside the database.

Both must be monitored.

Is a Cloud IAM Change Included in Database Audit?

Yes.

An IAM change can change database access privileges.

Should the Public Access Enabled Event Be an Alarm?

For a critical database it can certainly be evaluated.

Why Is the Cloud Snapshot Shared Event Critical?

If the snapshot is shared with another account, a data leakage risk can arise.

Database Audit and UEBA

UEBA is:

User and Entity Behavior Analytics

which analyses users' normal behaviour.

What Can UEBA Do for Databases?

For example;

normal login hours,

query volume,

the tables reached

it can perform anomaly detection through these.

Can a Database User Risk Score Be Created?

Yes.

For example;

a privileged account,

an out-of-hours login,

a bulk query,

a new source IP

events such as these can raise the risk score.

What Is a Detection Rule?

It is the logic generating a security alert when a certain behaviour occurs.

Sample Database Detection Scenarios

• 100 failed DBA logins in 10 minutes
• Creation of a new superuser
• The audit policy being turned off
• A privileged login from an IP seen for the first time
• An unusual bulk SELECT on a sensitive table
• An out-of-hours database dump
• A dormant account login
• The production database being restored in a different environment

How Should Alert Severity Be Determined?

The event;

account privilege,

database criticality,

data sensitivity,

time,

source

must be assessed with context information such as this.

Is New User Creation Always Critical?

No.

It can be an approved change.

However, privileged user creation can be high severity.

How Are False Positives Reduced?

Maintenance window, approved service account and normal workload information can be included in the detection rules.

What Is Alert Suppression?

It is preventing unnecessary alarms on known and approved activity.

Is Alert Suppression Risky?

If applied too broadly it can hide real attacks.

Why Is Maintenance Window Context Important?

A DBA login at 03:00 can normally be suspicious.

However, during a planned patch window it is expected behaviour.

Is Ticket Integration Useful?

Yes.

Whether the audit event is associated with a planned change ticket can be seen.

Should Database Audit and Change Management Be Used Together?

Yes.

For example, if there is a production schema change, the audit record must be matchable with the relevant change record.

What Is the “No Ticket, No Change” Approach?

It is the approach of planned critical changes not being made without a formal change record.

What Happens If the Audit Event Does Not Match a Change Record?

The possibility of an unauthorized change can be investigated.

What Is Audit Review?

It is audit logs not merely being stored but being analysed regularly.

By Whom Should the Audit Log Be Reviewed?

A security or SOC team independent of the DBA can examine critical events.

Is a Daily Audit Review Necessary?

On critical systems real-time monitoring is more suitable.

On low-risk systems there can be a periodic review.

For Which Events Should Real-Time Alerting Be Used?

For example:

Audit disabled

New privileged account

Mass deletion

Sensitive database export

Break-glass account usage

What Is a Database Audit Report?

It is the summary of the important activity in a given period.

What Can the Audit Report Include?

Successful privileged login

Failed login trend

Permission changes

Sensitive data access

Database configuration changes

Critical alerts

What Should Management See in the Audit Report?

Rather than technical SQL lines;

risk,

trends,

critical events,

unresolved incidents

they must see these.

What Are the Database Audit KPIs?

For example:

Audit Coverage

SIEM Integration Coverage

Privileged Activity Coverage

Sensitive Database Coverage

Log Retention Compliance

Critical Alert Response Time

Log Source Availability

What Is Audit Coverage?

It shows on how many of the databases the audit mechanism is active.

What Is Sensitive Database Audit Coverage?

It shows what percentage of the databases holding critical and sensitive data are under detailed audit.

What Is SIEM Integration Coverage?

It measures what percentage of the database log sources are transferred to the central SIEM.

What Is Log Source Availability?

It shows for how long the audit sources send logs without interruption.

Is Mean Time to Detect – MTTD Used for Databases?

Yes.

It can measure the time between a database security event occurring and being detected.

What Is Mean Time to Respond – MTTR?

It can measure the time from the event being detected until it is responded to.

Database Audit Checklist

A corporate checklist can include these headings:

• Is login audit active?
• Are failed logins monitored?
• Is privileged user activity logged?
• Are user/role changes recorded?
• Are DDL operations monitored?
• Is sensitive table access logged?
• Are backup/restore activities monitored?
• Is there an audit disable alert?
• Are the logs sent to SIEM?
• Are the logs protected against modification?
• Is time synchronization correct?
• Is log retention defined?
• Is sensitive data masked in the logs?
• Is the DR environment under audit too?
• Is audit pipeline health monitored?

DBA Audit Checklist

From the DBA's perspective:

Is the audit service active?

Is the logging disk capacity sufficient?

Does the audit configuration match the baseline?

Are the critical tables defined?

Is audit on across the failover nodes?

SOC Database Audit Checklist

From the SOC's perspective:

Is the database log source healthy?

Is there a privileged login alarm?

Is the new admin rule active?

Is there bulk query detection?

Is there an audit disabled alarm?

Are database alerts tied to the incident process?

Questions Management Should Ask About Database Audit

Management must be able to get answers to these questions:

How many of our critical databases are under audit?

Are DBA operations monitored?

Do database logs go to the central SIEM?

Can the DBA delete the audit logs?

Can we determine which user viewed which customer data?

If a database is exported, do we receive an alarm?

How long are our logs kept?

When was the last database audit review performed?

The Most Common Mistakes in Database Audit

The mistakes frequently seen in organizations are as follows:

• Keeping audit turned off entirely
• Collecting only error logs
• Not monitoring successful logins
• Not logging DBA activity
• Using a shared DBA account
• Not monitoring sensitive SELECT queries
• Keeping audit logs on the same server
• Giving the DBA the privilege to delete logs
• Not turning the audit disable operation into an alarm
• Keeping log retention too short
• Breaking performance by logging all queries without control
• Writing sensitive data to the logs in plaintext
• Not synchronizing server clocks
• Not monitoring log source health after the SIEM integration
• Forgetting audit on DR and secondary databases

The PostgreSQL Audit Approach

On the PostgreSQL side;

connection logging,

disconnection logging,

statement logging,

role activity

records such as these can be evaluated.

For more detailed auditing, appropriate audit mechanisms can be used.

However, in a production environment the logging level must be set considering the performance and privacy impact.

Should PostgreSQL log_statement Always Be Turned On?

It must not be applied the same way for every environment.

On busy systems it can create a large log volume.

Risk-based configuration is required.

The MSSQL Audit Approach

In Microsoft SQL Server environments;

SQL Server Audit,

login auditing,

Extended Events

mechanisms such as these can be used.

Why Are MSSQL Login Failure Logs Important?

They can show brute force or wrong application credential problems.

The Oracle Audit Approach

In Oracle Database environments the audit mechanisms;

login,

privileged operations,

object access

can enable the monitoring of activity such as this.

What Is Unified Auditing?

It is the approach that, in some Oracle environments, helps manage audit policies centrally.

Even If the Vendor Differs, Is the Audit Logic the Same?

Yes.

Even if the platform changes, the core questions do not:

Who?

When?

From where?

What did they do?

On which data?

Did it succeed?

A Sample Database Security Event Flow

A user connected to the production database at 03:12 at night.

Database audit:

Privileged Login

SIEM saw this.

Then the user ran a high-volume SELECT query on the sensitive customer table.

DAM detected 50 times more row access than normal.

Afterwards a database export operation took place.

By relating these three events, SIEM generated a:

Potential Data Exfiltration

alarm.

The SOC opened an incident.

In this scenario the login log alone would not have been enough.

The real value is that the events can be tied to each other.

What Should Happen If a Million Customer Records Are Read at 03:00?

In a well-designed database security architecture this chain can run:

Sensitive Table Access

↓

Bulk Query Detection

↓

User Behavior Deviation

↓

DAM Alert

↓

SIEM Correlation

↓

SOC Investigation

↓

Incident Response

This way the event can be detected as close to real time as possible rather than hours or days later.

Frequently Asked Questions

What is a database audit?

It is the recording of security-relevant activity carried out by users and systems on the database.

What is the difference between a database log and an audit?

A log covers technical events too. An audit focuses more on user activity and accountability.

Should DBA activity be monitored?

Yes. The DBA is a highly privileged user and their critical operations must be audited.

Should SELECT queries be audited?

For critical tables containing sensitive data they can be monitored on a risk basis.

Should database logs be sent to SIEM?

On critical systems central SIEM integration is strongly recommended.

Can audit logs be kept on the database server?

A local copy can exist, but sending critical logs to an independent central system is safer.

How long should audit log retention be?

It must be determined according to the organization's risk, operational, regulatory and forensic needs.

Does a database audit affect performance?

Very heavy logging can affect it. For this reason a risk-based and optimized audit policy must be used.

Should the audit log be immutable?

In critical environments preserving log integrity and preventing unauthorized deletion is important.

Are Database Activity Monitoring and audit the same?

No. Native audit is the database's own recording mechanism. DAM is the security layer analysing activity centrally.

Conclusion: You Cannot Protect Database Activity You Cannot See

A mistake frequently made in database security is focusing only on controlling access.

Access control is of course critical.

However, if you do not know what the user does after access is granted, your visibility is incomplete.

For this reason one of the core principles of database security is this:

Authentication tells you who logged in.

Authorization tells you what they are allowed to do.

Audit tells you what they actually did.

Real security emerges when these three layers work together.

Organizations need to be able to monitor, in particular;

Privileged Login,

Failed Login,

User Creation,

Role Changes,

DDL Operations,

Sensitive Data Access,

Bulk Queries,

Backup/Restore,

Database Export

and Audit Configuration Changes

events such as these.

At the same time audit records must not merely be produced;

they must be collected centrally,

analysed with SIEM,

protected against modification,

kept for a sufficient period

and used in incident response processes.

The real test of database security is this question:

“If a user connects to the production database at 03:00 and queries a million customer records, would we notice it?”

If the answer is:

“We don't know.”

then the problem is not only a lack of monitoring.

It also means corporate database security visibility is incomplete.

In a good audit architecture the answer:

“Yes; we can see which user it was, from which IP they came, which query they ran, which data they reached and the traces of the event in our other security systems.”

is what it must be.

This is exactly the purpose of a real Database Audit:

Accountability + Visibility + Detection + Investigation