C100 quick start

Procedure

1. Log on to the Database Audit Service system. For more information, see Log on to the Database Audit Service system.

2. Add the database that you want to audit.

   1. In the navigation pane, choose Assets > Asset Management.

   2. On the Asset Management page, click Add.

   3. In the Add Asset panel, configure the database.

      We recommend adding an RDS database by selecting an existing instance from your Alibaba Cloud account.

      You can also add a self-managed database. For configuration details, see Configure a self-managed database on an ECS instance.

   4. Click Save.

3. Install the traffic collection tool (agent).

   If your database server is an ECS instance with Cloud Assistant installed, we recommend using Cloud Assistant to install the agent. Otherwise, download the agent for your server's operating system and install it manually. The following steps describe how to install the agent by using Cloud Assistant. For information about how to manually install the agent, see Install an agent.

   1. In the navigation pane, choose System Management > Agent Management.

   2. Click the Agent Installation tab.

   3. In the Install with Cloud Assistant section, click Start Installation.

   4. In the Install Agent to Directory via Cloud Assistant dialog box, find the instance where you want to install the agent.

   5. In the Actions column of the instance, click Install.

      After the installation is complete, the Agent Status changes to Running, Connected.

4. Verify that audit logs are being ingested.

   1. In the navigation pane, choose Query and Analysis > Audit Logs.

   2. Select the asset whose logs you want to query.

   3. Click Search and check the audit log information in the Log List.

      1. If audit logs are displayed, the asset is successfully integrated.

      2. If no audit logs are found, the integration has failed. Verify that the database information is correct and that the agent is installed on the correct server.

5. Configure security rules.

   For more information, see Configure security rules.

   Security rules help you identify risks in your database. Once auditing is enabled and logs are generated, an alert is triggered if a record matches a security rule.

6. Configure alert notifications.

   1. In the navigation pane, click Alert Notification.

   2. On the Email, SMS message, or DingTalk tab, click Add.

   3. In the Add Alert Notification Recipient Configuration panel, configure the alert notification settings.

      Configure the following parameters: Asset: Select the asset for which you want to receive alert notifications. Recipient: Enter the contact information for the recipient. Alert Severity Level: Select the alert severity levels for which you want to receive notifications, including low-risk, medium-risk, and high-risk. Notification Interval: Set the interval at which alert notifications are sent, in seconds. The maximum value is 86,400 (one day). If a rule is triggered multiple times within a notification interval, an alert is sent only for the first trigger.

   4. Click Save.

      Once configured, the specified recipient will receive a notification when an alert is triggered.

7. Subscribe to reports.

   After you create a report subscription, Database Audit Service periodically sends the subscribed audit reports to your specified email address to help you monitor your database status.

   1. In the navigation pane, choose Report Center > Report Subscription.

   2. Click Add. In the Add Subscription Task panel, configure the task parameters.

      For configuration details, see Subscription task configuration.

   3. Click Save.

      The subscription task is created.