Imperva Cyber Community

communities_1.jpg
 View Only

  • 1.  Custom policy to alert Select * operations

    Posted 10-27-2021 04:03
    Hi community friends, hope everything is fine.

    I am trying to create a security policy that alerts when a database user executes the Select * (Select all) operation on a database.

    I tried to generate a policy of the type db service custom, adding a Generic Dictionary Search containing a simple select * expression, but it did not work, the policy was alerted every second by the use of any select operation. I followed this procedure:
    https://docs.imperva.com/howto/15dccc63

    Has any of you configured a policy similar to my case?
    Is it possible to generate such a policy in Imperva SecureSphere DBF version 13.6.51?

    I will appreciate any thoughts, support or ideas provided.

    Best regards friends.
    #DatabaseActivityMonitoring

    ------------------------------
    Erick Reyes Torres
    Consultant
    Mexico
    ------------------------------


  • 2.  RE: Custom policy to alert Select * operations

    Posted 11-04-2021 09:10
    Hello Erick,

    Thank you for reaching out.

    Have you tired to configured a DB Service Signature policy, which uses a Manual Dictionary, and intercept the "select*" queries as a regex?

    BR,
    Refael

    ------------------------------
    Refael Elashvili (csp)
    Product Support Engineer
    Ottawa ON
    ------------------------------

    Original Message