Features
Features:

Product Tour >

Edraw AI >

Paid Plans:

Individuals >

Business >

Eduaction >
Resources
Blog

History

How-tos & Tips

Discovery

Biography

Business Analysis

Examples

AI concept Map

Free AI Mind Map Generator

Onenote Mind Map

Bcg Matrix Examples

Nike Marketing Strategy

Unilever SWOT Analysis

Make Mind Maps in Google Docs

Guide

FAQs

What's New

Resource Center
Templates
All Templates

Brain Storming Templates

Strategy and Planning Templates

Project Management Templates

Product Management Templates

Human Resources Templates

Agile Workflow Templates

Marketing Templates

Education Templates

Fun and Games Templates

User Gallery
Download
Pricing
Enterprise

MindMap Gallery Alibaba Cloud Database Audit

Alibaba Cloud Database Audit

The database audit service is a professional, proactive, real-time audit product that monitors database security. The database audit service combines database monitoring and audit technology with the public cloud environment to record and alert against database risk behaviors such as database SQL injection and risky operations. Form security protection for core data and provide complete security diagnosis, maintenance, and management functions for your cloud database.

Edited at 2024-01-16 21:09:38

PlotWizard

Recent works View more works>>

Alibaba Cloud Database Audit

PlotWizard

Recent works View more works>>

Recommended to you
Outline

Alibaba Cloud Database Audit

Product introduction

What is database auditing

Database audit service is a professional, proactive, and real-time audit product that monitors database security. It can be used to audit Alibaba Cloud's native databases and self-built databases.

The database audit service combines database monitoring and auditing technology with the public cloud environment to record and alert against database risk behaviors such as database SQL injection and risky operations, forming security protection for core data and providing complete security diagnosis for your cloud database. , maintenance and management functions.

Application scenarios

Database audit services can help you solve the following problems:

Help enterprises successfully pass the compliance audit of the Class A guarantee and provide the basis for the compliance audit of Level 3 Class A guarantee and other industries.

Supports incremental backup of audit data and meets the requirements for retention period of audit data according to the classification guarantee regulations.

It has real-time monitoring capabilities for risk status, operating status, performance status, and statement distribution.

Help you record, analyze, and trace database security incidents.

Track dangerous events and unsafe operations with database performance diagnostics.

Effectively discover program backdoors and reduce the risk of data leakage.

Provides real-time database risk warning capabilities and timely protection against database attacks.

working principle

The database audit service supports deployment completely independent of the database through the bypass listening mode. Achieve flexible auditing and monitoring without affecting the daily operation performance of the database.

Conduct audits based on database operation statements, monitor database login and access behaviors, and effectively implement audit policies. The database audit service also has powerful database activity audit and analysis capabilities, which can flexibly present the activity status of the database from multiple angles and help you effectively implement security policies.

Adopting a new human-computer interaction operation mode, the product interface is designed based on the three levels of humanization, professionalism and usability. In terms of statistical analysis of audit logs, the database audit service uses comprehensive statistical analysis reports, based on basic business reports such as daily, weekly, and monthly reports (which can be set to be sent automatically at scheduled times), combined with specialized pattern analysis reports, to enable database auditing A new era in product report presentation.

The audit query method supports audit queries at two levels: single database (single database) level and full database (all databases) level. The multi-page drill-down function is used to guide you step by step to complete the query and analysis of audit logs. At the same time, to facilitate you to customize audit rules, a top-down priority rule hit mechanism is used to define database audit rules from multiple levels.

Features

User behavior audit

Supports access operations associated with the application layer and database layer. You can use the application identity function in C/S architecture and B/S architecture.

Support tracing the identity and behavior of users.

Multi-dimensional clue analysis

Risk and Hazard Clues

Supports analysis of SQL behaviors such as high, medium and low-level risks, SQL injection, blacklist statements, violation of authorization policies, etc.

conversation thread

Supports multi-angle analysis of sessions based on time, client IP, client port, server IP, server port, database account, asset information, database instance, client tool, database type, host name, etc.

Detailed sentence clues

Supports time, message retrieval, asset information, database account, SQL template, client IP, client port, server IP, server port, database instance, number of affected rows, execution duration, operation type, execution success or failure and other search criteria.

Multi-dimensional alarm mechanism

safety rules

It has 900 built-in security rules, covering common application scenarios, and the built-in rules are constantly being enriched. Supports custom security rules.

Built-in security rules contain characteristic information of discovered unsafe SQL statements. The database audit service determines whether the SQL statements contain suspicious behavior by matching the audited SQL statements with security rules.

Abnormal operational risks

It supports fine-grained definition of risky access behaviors that require monitoring through IP, users, database client tools, time, sensitive objects, number of returned rows, system objects, high-risk operations and other elements.

SQL injection

Provides a systematic SQL injection library, as well as SQL injection description based on regular expressions or syntax abstraction, and alerts immediately when abnormal database behavior is discovered.

Black and white list

In an accurate and abstract way, specific access SQL statements in the system are described, and alerts are issued immediately when these SQL statements appear.

Refined reporting

Comprehensive analysis report

Conduct a comprehensive analysis of the database situation from four perspectives: SQL statement execution analysis, session connection analysis, risk event analysis and SQL performance analysis.

Performance analysis report

Analyze the performance of the database from five aspects: performance change trend, database/SID with the worst performance, SQL that takes the longest time, SQL with the worst performance, and SQL that executes the most.

Class Bao Reference Analysis Report

Combined with the requirements of the current information security technology network security graded protection evaluation requirements GB/T 28448-2019 (referred to as graded protection 2.0), the intrusion prevention, malicious code monitoring, security audit monitoring, etc. in the security audit focused on in graded protection 2.0 are targeted Sexual analysis and presentation.

Statement analysis reports

Analyze and display the current statement type information from five dimensions: SQL statement analysis, failed statement analysis, SQL statement change trend, audit trend analysis, and SQL template analysis with the most execution times.

Session analysis reports

Contains 4 reports: new session analysis, failed session analysis, concurrent session analysis, and session number change trend analysis.

Alarm analysis reports

Analyze the current alarm situation from four dimensions: alarm change trend, alarm source analysis, alarm object analysis, and rule hit analysis.

Other reports

It is mainly divided into 4 reports: client tool analysis, database account analysis, database or SID analysis, and database access source IP analysis.

Product advantages

Bypass deployment

Use bypass detection to achieve flexible auditing and monitoring without affecting database operation efficiency.

Security Compliance

Meet external audit requirements for incremental backup and storage duration of audit data content, and meet the requirements of the Cybersecurity Law for log data storage.

Full audit

Supports auditing of multiple databases such as RDS cloud database and ECS self-built database to meet the database audit needs of cloud users.

Quick identification

It can achieve 99% application correlation audit, complete SQL analysis, and precise protocol analysis.

Application scenarios

RDS cloud database audit

By deploying an Agent on the user's PC (the PC is directly connected to the RDS database through the database operation and maintenance tool) or the application system server that accesses the database, the access log data is obtained for log audit, and the audit of the RDS cloud database is realized.

ECS self-built database audit

By installing the database audit agent in ECS, you can obtain the database operation log and audit the self-built database of ECS. Supports all types of currently popular databases to ensure data auditing is compatible and effective.

Supported database types

C100 example

Database classification Database type Version Alibaba Cloud native database RDSMySQL 5.5, 5.6, 5.7, 8.0 RDS SQL Server 2008 R2 cloud disk version, 2012 Web, 2012 Enterprise Edition stand-alone, 2012 Enterprise Edition, 2012 Standard Edition, 2014 Enterprise Edition, 2014 Standard Edition, 2016 Web, 2016 Enterprise Edition, 2016 Standard Edition, 2017 Web, 2017 Enterprise Cluster Edition, 2017 Standard Edition, 2019 Web, 2019 Enterprise Cluster Edition, 2019 Standard Edition RDS PostgreSQL 10, 11, 12, 13, 14 RDS MariaDB 10.3 OceanBase 2.X PolarDB MySQL, PostgreSQL, compatible with Oracle syntax PolarDB-X 1.0/MySQL 5, 1.0/MySQL 8, 2.0/MySQL 5.7, PostgreSQL AnalyticDB MySQL, PostgreSQL Relational Oracle 8i, 9i, 10g, 11g, 12c, 18c, 19c, 21c MySQL 4.0, 4.1, 5.0, 5.1, 5.5, 5.6, 5.7, 8.0 SQL Server 2000, 2005, 2008, 2012, 2014, 2016, 2017, 2019 Sybase ASE 11.9, 12.5 DB2 v80, v81, v82, v95, v97, v10.5, v11.1, v11.5 Informix IDS9 Oscar 5.5, 5.7 Dameng (DM) DM7, DM8 Cache 2010, 2016 PostgreSQL 9, 10, 11, 12, 13, 14 Teradata All versions Kingbase V6, V7, V8 GBase 8.5a, 8.8s MariaDB 5.1, 5.2, 5.3, 5.5, 10.0, 10.1, 10.2, 10.3 Hana 1.0, 2.0 GaussDB 100, 200, 300 LibrA 6 K-DB 11 Sybase IQ 15.4 TiDB 4.X, 5.X Vertica 7, 8, 9, 10, 11 TBase V2 HighGo 6.0 TDSQL-C MySQL 5.7, 8.0 TDSQL-C PostgreSQL 10, 14 PerconaMySQL 5.6, 5.7, 8.0 Vastbase 2.x non-relational MongoDB 2.x, 3.x, 4.x, 5.x HBase(protobuf) All versions HBase (thrift) thrift1,thrift2 Hive 1.X, 2.X, 3.X Redis All versions Elasticsearch All versions Cassandra 3.X HDFS All versions Impala 3.X Graphbase 6 Greenplum 5, 6 Spark SQL (thrift) 1.x, 2.x Spark SQL (RESTful) 1.x, 2.x SSDB All versions ArangoDB 3.4.9 Neo4j 4.2.0 OrientDB 3.1.6 Percona MongoDB 4.x, 5.x Big Data HBase(protobuf) All versions HBase (thrift) thrift1,thrift2 Hive 1.X, 2.X, 3.X Cassandra 3.X HDFS All versions Impala 3.X Greenplum 5, 6 Spark SQL (thrift) 1.x, 2.x Spark SQL (RESTful) 1.x, 2.x SSDB All versions MAX COMPUTE All versions graphics Graphbase 6 ArangoDB 3.4.9 Neo4j 4.2.0 OrientDB 3.1.6 full text Elasticsearch All versions document MongoDB 2.x, 3.x, 4.x, 5.x ArangoDB 3.4.9 Percona MongoDB 4.x, 5.x key value Redis All versions other HTTP All versions TELNET All versions FTP All versions HTTPS All versions

D100 example

Database classification Database type Version Alibaba Cloud native database PolarDB MySQL 5.6, 5.7, 8.0 PostgreSQL 11 Oracle 9i, 10g, 11g, 12c PolarDB-X (formerly DRDS) MySQL 5.7, 8.0 PostgreSQL 11 RDS MySQL 5.5, 5.6, 5.7, 8.0 SQL Server 2008 R2, 2012, 2016, 2017, 2018, 2019 PostgreSQL 9.4, 10, 11, 12 MariaDB 10.3 AnalyticDB MySQL 5.7, 8.0 PostgreSQL 11 OceanBase MySQL 5.0, 5.1, 5.5, 5.6, 5.7 generic type Oracle 8i, 9i, 10g, 11g, 12c, 18c SQL Server 2005, 2008, 2012, 2014, 2016, 2017, 2018, 2019 MySQL 4.0, 4.1, 5.0, 5.1, 5.5, 5.6, 5.7, 8.0 DB2 8.1, 8.2, 9.1, 9.5, 9.7, 10.1, 10.5 SAP HANA 1.0, 2.0 PostgreSQL 8, 9, 10, 11, 12 MongoDB 3, 4 Dameng (DM) 6, 7 KingBase 7 NTU General (GBase) 8.8T Sybase ASE 12, 15 Sybase IQ 16 Magic database (Oscar) 7, 8 Percona 5.5, 5.6, 5.7 MariaDB 5.1, 5.2, 5.3, 5.5, 10.0, 10.1, 10.2, 10.3 Redis 2.8, 3.0, 3.2, 4.0, 5.0 SG-RDBMySQL 1.0, 2.0, 3.0 SG-RDB PostgreSQL 1.0, 2.0, 3.0 Greenplum 5.0~5.11 Informix 9, 10, 11, 12 Intersystems Cache 8 Hbase 1.2 Elasticsearch 2.4.2, 6.3.0 GaussDB T 1.0.1 GaussDB A 6.5.1 TIDB 1.0, 2.0, 2.1, 3.0 Spark SQL 1.5.1, 2.3.3, 2.4.3 Vertica 8.1, 9.0, 9.1, 9.2, 9.3 Hive 2.1.1, 1.1.0 Teradata 16, 15, 14 Impala 2.11.0, 2.10.0, 2.9.0, 2.8.0, 2.7.0 Sentry 2.0.0, 1.8.0, 1.7.1, 1.7.0, 1.6.0, 1.5.1, 1.4.0, 1.3.0, 1.2.0 HDFS 2.8, 2.7, 2.6, 2.5, 2.4, 2.3, 2.2, 1.2, 1.1