Database Audit

DBSS provides database audit and encryption functions. It records user access to the database in real time, generates fine-grained audit reports, and sends real-time alarms for risky operations and attack behaviors. As an encryption proxy gateway, the system is deployed between the database and client applications. Any access must pass through the gateway to implement data encryption.

Notes and Constraints

DBSS cannot be used across regions and the database must be in the same region as the instance you purchased.
Ensure the VPC of the database audit instance is the same as that of the node (application side or database side) where you plan to install the database audit agent. Otherwise, the instance will be unable to connect to the agent or perform audit.

For details about how to choose the node, see How Do I Determine Where to Install an Agent?

Database Security Audit Functions

Database audit provides the following functions:

Database Configuration

Database audit supports databases built on ECS, BMS, and RDS on Huawei Cloud. After purchasing a database audit instance, you need to add the database to be audited to the instance. After a database is added, you can view its information, or disable or delete it.

Configuring an Agent

Add a new agent or choose an existing agent for the database to be audited, depending on your database type. The agent will obtain database access traffic, upload traffic statistics to the audit system, receive audit system configuration commands, and report database monitoring data. You can enable database audit only after the agent is installed. The agent can be installed in Linux and Windows. After adding an agent to the database, you can view, disable or delete the agent.

Configuring Security Group Rules

Configure TCP (port 8000) and UDP (ports 7000 to 7100) in the security group inbound rule of the database audit instance to allow the agent to communicate with the audit instance.

Configuring the Audit Scope

By default, database audit complies with a full audit rule, which is used to audit all databases that are connected to the database audit instance. You can also add audit scope and specify the databases to be audited. After adding an audit scope, you can view, enable, edit, disable, or delete the audit scope.

SQL Injection

SQL injection detection is enabled by default. You can disable or enable the detection rules. One piece of audited data can match only one SQL injection detection rule.

Privacy Protection

To mask sensitive information in entered SQL statements, you can enable the function of masking privacy data and configure masking rules to prevent sensitive information leakage.

Alarm Notifications

After configuring alarm notifications, you can receive DBSS alarms on database risks. If this function is not enabled, you have to log in to the management console to view alarms. Alarm notifications may be mistakenly blocked. If you have enabled notifications but not received any, check whether they have been blocked as spam. The system collects alarm statistics every 5 minutes and sends alarm notifications (if any).

Audit Logs

Database audit logs can be backed up to OBS buckets to achieve high availability for disaster recovery. You can back up or restore database audit logs as required. After backing up audit logs, you can view or delete backup audit logs.

Instance Management

After purchasing a database audit instance, you can view, enable, restart, and disable the instance.

Risky Operation Management

After adding a risky operation, you can view the risk, enable, edit, disable, or delete the risky operation, or set its priority.

Managing Reports

By default, database audit complies with a full audit rule, which is used to audit all databases that are successfully connected to the database audit instance. After connecting the database to the database audit instance, view report templates and report results.