Imperva Cyber Community

I am lookin for a criteria to check a value inside of a Query and create an audit policy for that value.

In the first example I need to look for VWCODIGO = 5. If the query has a 5 for that value is going to trigger the audit policy. But so far I cant find the match criteria needed to Check the table first then check parameter VWCODIGO and then check if the value =5

#DatabaseActivityMonitoring
#ImpervaAgent

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala
------------------------------

Hi Gerson,

You can follow the steps described at here https://community.imperva.com/discussion/alert-to-be-generated-based-on-a-sql-query#bm531820df-8a68-4c82-a5f8-019010cc7cf5

The procedure is similar but described for security policy. I mean, you should create an audit policy at last step.

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 08-22-2024 08:39
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

I am lookin for a criteria to check a value inside of a Query and create an audit policy for that value.

In the first example I need to look for VWCODIGO = 5. If the query has a 5 for that value is going to trigger the audit policy. But so far I cant find the match criteria needed to Check the table first then check parameter VWCODIGO and then check if the value =5

#DatabaseActivityMonitoring
#ImpervaAgent

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala
------------------------------

My Query

But the audit policy is not returning a single match

Hi Gerson,

You can follow the steps described at here https://community.imperva.com/discussion/alert-to-be-generated-based-on-a-sql-query#bm531820df-8a68-4c82-a5f8-019010cc7cf5

The procedure is similar but described for security policy. I mean, you should create an audit policy at last step.

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 08-22-2024 08:39
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

I am lookin for a criteria to check a value inside of a Query and create an audit policy for that value.

In the first example I need to look for VWCODIGO = 5. If the query has a 5 for that value is going to trigger the audit policy. But so far I cant find the match criteria needed to Check the table first then check parameter VWCODIGO and then check if the value =5

#DatabaseActivityMonitoring
#ImpervaAgent

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala
------------------------------

Hello Gerson,

What do you mean by single match? What is your exact goal?

based on your policy, if raw query contains "R00011" string, it will be audited. And the last screenshot shows that it is working as expected if i am not wrong.

My Query

But the audit policy is not returning a single match

Hi Gerson,

You can follow the steps described at here https://community.imperva.com/discussion/alert-to-be-generated-based-on-a-sql-query#bm531820df-8a68-4c82-a5f8-019010cc7cf5

The procedure is similar but described for security policy. I mean, you should create an audit policy at last step.

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 08-22-2024 08:39
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

I am lookin for a criteria to check a value inside of a Query and create an audit policy for that value.

In the first example I need to look for VWCODIGO = 5. If the query has a 5 for that value is going to trigger the audit policy. But so far I cant find the match criteria needed to Check the table first then check parameter VWCODIGO and then check if the value =5

#DatabaseActivityMonitoring
#ImpervaAgent

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala
------------------------------

Hello Gerson,

What do you mean by single match? What is your exact goal?

based on your policy, if raw query contains "R00011" string, it will be audited. And the last screenshot shows that it is working as expected if i am not wrong.

My Query

But the audit policy is not returning a single match

Hi Gerson,

You can follow the steps described at here https://community.imperva.com/discussion/alert-to-be-generated-based-on-a-sql-query#bm531820df-8a68-4c82-a5f8-019010cc7cf5

The procedure is similar but described for security policy. I mean, you should create an audit policy at last step.

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 08-22-2024 08:39
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

I am lookin for a criteria to check a value inside of a Query and create an audit policy for that value.

In the first example I need to look for VWCODIGO = 5. If the query has a 5 for that value is going to trigger the audit policy. But so far I cant find the match criteria needed to Check the table first then check parameter VWCODIGO and then check if the value =5

#DatabaseActivityMonitoring
#ImpervaAgent

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala
------------------------------

My exacto goal is audit the query when the parameter R00011 appears in the query. Very simple but for some reason is not working

Hello Gerson,

What do you mean by single match? What is your exact goal?

based on your policy, if raw query contains "R00011" string, it will be audited. And the last screenshot shows that it is working as expected if i am not wrong.

My Query

But the audit policy is not returning a single match

Hi Gerson,

You can follow the steps described at here https://community.imperva.com/discussion/alert-to-be-generated-based-on-a-sql-query#bm531820df-8a68-4c82-a5f8-019010cc7cf5

The procedure is similar but described for security policy. I mean, you should create an audit policy at last step.

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 08-22-2024 08:39
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

I am lookin for a criteria to check a value inside of a Query and create an audit policy for that value.

In the first example I need to look for VWCODIGO = 5. If the query has a 5 for that value is going to trigger the audit policy. But so far I cant find the match criteria needed to Check the table first then check parameter VWCODIGO and then check if the value =5

#DatabaseActivityMonitoring
#ImpervaAgent

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala
------------------------------

could you change your dictionary like the screenshot below and inform me about the results please

My exacto goal is audit the query when the parameter R00011 appears in the query. Very simple but for some reason is not working

Hello Gerson,

What do you mean by single match? What is your exact goal?

based on your policy, if raw query contains "R00011" string, it will be audited. And the last screenshot shows that it is working as expected if i am not wrong.

My Query

But the audit policy is not returning a single match

Hi Gerson,

You can follow the steps described at here https://community.imperva.com/discussion/alert-to-be-generated-based-on-a-sql-query#bm531820df-8a68-4c82-a5f8-019010cc7cf5

The procedure is similar but described for security policy. I mean, you should create an audit policy at last step.

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 08-22-2024 08:39
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

I am lookin for a criteria to check a value inside of a Query and create an audit policy for that value.

In the first example I need to look for VWCODIGO = 5. If the query has a 5 for that value is going to trigger the audit policy. But so far I cant find the match criteria needed to Check the table first then check parameter VWCODIGO and then check if the value =5

#DatabaseActivityMonitoring
#ImpervaAgent

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala
------------------------------

or like below

could you change your dictionary like the screenshot below and inform me about the results please

My exacto goal is audit the query when the parameter R00011 appears in the query. Very simple but for some reason is not working

Hello Gerson,

What do you mean by single match? What is your exact goal?

based on your policy, if raw query contains "R00011" string, it will be audited. And the last screenshot shows that it is working as expected if i am not wrong.

My Query

But the audit policy is not returning a single match

Hi Gerson,

You can follow the steps described at here https://community.imperva.com/discussion/alert-to-be-generated-based-on-a-sql-query#bm531820df-8a68-4c82-a5f8-019010cc7cf5

The procedure is similar but described for security policy. I mean, you should create an audit policy at last step.

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 08-22-2024 08:39
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

I am lookin for a criteria to check a value inside of a Query and create an audit policy for that value.

In the first example I need to look for VWCODIGO = 5. If the query has a 5 for that value is going to trigger the audit policy. But so far I cant find the match criteria needed to Check the table first then check parameter VWCODIGO and then check if the value =5

#DatabaseActivityMonitoring
#ImpervaAgent

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala
------------------------------

I just tried but didn't work. Not sure where is the issue

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala

Original Message:
Sent: 09-19-2024 11:13
From: Cezmi Cal
Subject: Criteria to verify one parameter in the query

or like below

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 09-19-2024 11:09
From: Cezmi Cal
Subject: Criteria to verify one parameter in the query

could you change your dictionary like the screenshot below and inform me about the results please

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 09-18-2024 16:51
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

My exacto goal is audit the query when the parameter R00011 appears in the query. Very simple but for some reason is not working

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala

Original Message:
Sent: 09-18-2024 06:16
From: Cezmi Cal
Subject: Criteria to verify one parameter in the query

Hello Gerson,

What do you mean by single match? What is your exact goal?

based on your policy, if raw query contains "R00011" string, it will be audited. And the last screenshot shows that it is working as expected if i am not wrong.

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 09-17-2024 11:59
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

My Query

But the audit policy is not returning a single match

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala

Original Message:
Sent: 08-22-2024 09:11
From: Cezmi Cal
Subject: Criteria to verify one parameter in the query

Hi Gerson,

You can follow the steps described at here https://community.imperva.com/discussion/alert-to-be-generated-based-on-a-sql-query#bm531820df-8a68-4c82-a5f8-019010cc7cf5

The procedure is similar but described for security policy. I mean, you should create an audit policy at last step.

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 08-22-2024 08:39
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

I am lookin for a criteria to check a value inside of a Query and create an audit policy for that value.

In the first example I need to look for VWCODIGO = 5. If the query has a 5 for that value is going to trigger the audit policy. But so far I cant find the match criteria needed to Check the table first then check parameter VWCODIGO and then check if the value =5

#DatabaseActivityMonitoring
#ImpervaAgent

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala
------------------------------

Are you sure about the policy is applied to correct SG? I have tested on my lab environment and it is working as expected.

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 09-20-2024 11:19
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

I just tried but didn't work. Not sure where is the issue

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala

Original Message:
Sent: 09-19-2024 11:13
From: Cezmi Cal
Subject: Criteria to verify one parameter in the query

or like below

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 09-19-2024 11:09
From: Cezmi Cal
Subject: Criteria to verify one parameter in the query

could you change your dictionary like the screenshot below and inform me about the results please

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 09-18-2024 16:51
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

My exacto goal is audit the query when the parameter R00011 appears in the query. Very simple but for some reason is not working

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala

Original Message:
Sent: 09-18-2024 06:16
From: Cezmi Cal
Subject: Criteria to verify one parameter in the query

Hello Gerson,

What do you mean by single match? What is your exact goal?

based on your policy, if raw query contains "R00011" string, it will be audited. And the last screenshot shows that it is working as expected if i am not wrong.

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 09-17-2024 11:59
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

My Query

But the audit policy is not returning a single match

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala

Original Message:
Sent: 08-22-2024 09:11
From: Cezmi Cal
Subject: Criteria to verify one parameter in the query

Hi Gerson,

You can follow the steps described at here https://community.imperva.com/discussion/alert-to-be-generated-based-on-a-sql-query#bm531820df-8a68-4c82-a5f8-019010cc7cf5

The procedure is similar but described for security policy. I mean, you should create an audit policy at last step.

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 08-22-2024 08:39
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

I am lookin for a criteria to check a value inside of a Query and create an audit policy for that value.

In the first example I need to look for VWCODIGO = 5. If the query has a 5 for that value is going to trigger the audit policy. But so far I cant find the match criteria needed to Check the table first then check parameter VWCODIGO and then check if the value =5

#DatabaseActivityMonitoring
#ImpervaAgent

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala
------------------------------

Can you show your LAB dictionary and criteria please. 

Are you sure about the policy is applied to correct SG? I have tested on my lab environment and it is working as expected.

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 09-20-2024 11:19
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

I just tried but didn't work. Not sure where is the issue

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala

Original Message:
Sent: 09-19-2024 11:13
From: Cezmi Cal
Subject: Criteria to verify one parameter in the query

or like below

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 09-19-2024 11:09
From: Cezmi Cal
Subject: Criteria to verify one parameter in the query

could you change your dictionary like the screenshot below and inform me about the results please

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 09-18-2024 16:51
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

My exacto goal is audit the query when the parameter R00011 appears in the query. Very simple but for some reason is not working

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala

Original Message:
Sent: 09-18-2024 06:16
From: Cezmi Cal
Subject: Criteria to verify one parameter in the query

Hello Gerson,

What do you mean by single match? What is your exact goal?

based on your policy, if raw query contains "R00011" string, it will be audited. And the last screenshot shows that it is working as expected if i am not wrong.

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 09-17-2024 11:59
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

My Query

But the audit policy is not returning a single match

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala

Original Message:
Sent: 08-22-2024 09:11
From: Cezmi Cal
Subject: Criteria to verify one parameter in the query

Hi Gerson,

You can follow the steps described at here https://community.imperva.com/discussion/alert-to-be-generated-based-on-a-sql-query#bm531820df-8a68-4c82-a5f8-019010cc7cf5

The procedure is similar but described for security policy. I mean, you should create an audit policy at last step.

------------------------------
Cezmi Cal
Consultant
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara

Original Message:
Sent: 08-22-2024 08:39
From: Gerson Acevedo
Subject: Criteria to verify one parameter in the query

I am lookin for a criteria to check a value inside of a Query and create an audit policy for that value.

In the first example I need to look for VWCODIGO = 5. If the query has a 5 for that value is going to trigger the audit policy. But so far I cant find the match criteria needed to Check the table first then check parameter VWCODIGO and then check if the value =5

#DatabaseActivityMonitoring
#ImpervaAgent

------------------------------
Gerson Acevedo
Ingeniero De Implementación Y Soporte
Sisap - Sistemas Aplicativos
Guatemala
------------------------------