<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-database-activity-monitoring
description: >-
  Deploy and configure Database Activity Monitoring (DAM) to capture, alert,
  and audit all database operations including queries, schema changes,
  privilege escalation, and anomalous access patterns in real time.
domain: cybersecurity
subdomain: data-security
tags:
  - database-security
  - dam
  - audit-logging
  - sql-monitoring
  - privileged-access
  - compliance
  - soc
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1213"]
---

# Implementing Database Activity Monitoring

## Overview

Database Activity Monitoring (DAM) provides real-time visibility into all
database operations — queries, schema modifications, privilege changes, and
data access patterns. DAM operates independently of native database audit logs,
providing tamper-resistant audit trails for compliance (PCI DSS 10.2, SOX,
HIPAA) and detecting SQL injection, privilege abuse, and unauthorized data access.

Mode: `[MODE: BLUE]` — Database monitoring and threat detection.

## Prerequisites

- Database platform access (PostgreSQL, MySQL, MSSQL, Oracle)
- Network tap or agent-based monitoring capability
- SIEM integration for alert correlation
- Baseline of normal query patterns and user behavior

## Key Concepts

### Monitoring Architecture

| Approach | Method | Pros | Cons |
|----------|--------|------|------|
| Network TAP | Passive packet capture | No DB performance impact | Cannot see encrypted traffic |
| Agent-based | Kernel/OS-level intercept | Sees all queries including local | Slight performance overhead |
| Native audit | Database audit log features | Built-in, no extra tools | DBA can disable, performance hit |
| Proxy-based | Inline SQL proxy | Full visibility, can block | Single point of failure |

### PostgreSQL Audit Configuration

```sql
-- Enable pgAudit extension
CREATE EXTENSION IF NOT EXISTS pgaudit;

-- Log all DDL and privileged operations
ALTER SYSTEM SET pgaudit.log = 'ddl, role, write';
ALTER SYSTEM SET pgaudit.log_catalog = on;
ALTER SYSTEM SET pgaudit.log_parameter = on;
ALTER SYSTEM SET pgaudit.log_statement_once = on;

-- Log all connections and disconnections
ALTER SYSTEM SET log_connections = on;
ALTER SYSTEM SET log_disconnections = on;

-- Reload configuration
SELECT pg_reload_conf();
```

### MySQL Audit Configuration

```sql
-- Install audit plugin
INSTALL PLUGIN audit_log SONAME 'audit_log.so';

-- Configure audit logging
SET GLOBAL audit_log_policy = 'ALL';
SET GLOBAL audit_log_format = 'JSON';
SET GLOBAL audit_log_rotate_on_size = 104857600;

-- Verify plugin status
SHOW PLUGINS WHERE Name = 'audit_log';
```

### Scanning CLI

```bash
# Analyze database audit logs for anomalies
node scripts/agent.js --action analyze --input /var/log/pg_audit.log \
  --output /tmp/dam_findings.json

# Check database configuration for audit compliance
node scripts/agent.js --action audit-config --dbtype postgresql \
  --config /etc/postgresql/postgresql.conf --output /tmp/audit_check.json

# Generate monitoring baseline from query logs
node scripts/agent.js --action baseline --input /var/log/pg_audit.log \
  --output /tmp/query_baseline.json
```

## Workflow

### Step 1: Enable Native Audit Logging

Configure database-native audit facilities as the foundation layer.

### Step 2: Deploy DAM Solution

```bash
node scripts/agent.js --action audit-config --dbtype postgresql \
  --config /etc/postgresql/postgresql.conf
```

### Step 3: Establish Query Baselines

```bash
node scripts/agent.js --action baseline --input /var/log/pg_audit.log \
  --output /tmp/query_baseline.json
```

### Step 4: Configure Alerts

Set alerts for DDL changes, privilege escalation, bulk data access, and off-hours queries.

## Detection

```yaml
title: Database Activity Monitoring Detection
id: 2a8ed37e-97c4-4323-8f41-647fd92230d1
status: experimental
description: Detects suspicious activity related to implementing database activity monitoring techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1213
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```

## Verification

- [ ] Audit logging enabled on all production databases
- [ ] DDL and privilege changes generate real-time alerts
- [ ] Query baselines established per application service account
- [ ] Off-hours and anomalous access patterns detected
- [ ] Audit logs forwarded to tamper-resistant storage
- [ ] DAM alerts integrated with SIEM and incident workflow
- [ ] Compliance reporting automated (PCI DSS 10.2, SOX)

## References

- [PCI DSS Requirement 10 — Log and Monitor Access](https://www.pcisecuritystandards.org/)
- [pgAudit Documentation](https://www.pgaudit.org/)
- [CIS PostgreSQL Benchmark](https://www.cisecurity.org/benchmark/postgresql)
- [NIST SP 800-53 AU-2 — Event Logging](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
