What is DataBase Audit
DataBase Audit is a professional service that provides real-time security monitoring for databases. It audits both Alibaba Cloud cloud-native databases and self-managed databases.
The DataBase Audit service integrates database monitoring and auditing technologies into the public cloud environment. It records and sends alerts for database threats, such as SQL injections and risky operations, to help protect your core data. The service provides comprehensive security diagnosis, maintenance, and management for your cloud databases.
Security compliance
The DataBase Audit service complies with the Classified Protection of Cybersecurity Level 3 standard. It helps you meet compliance requirements, including but not limited to the following:
Article 18 of the Interim Measures for the Administration of Business Activities of Online Lending Information Intermediaries requires information security inspections and audits. This regulation was formulated by the China Banking Regulatory Commission, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the Cyberspace Administration of China.
Cybersecurity Law
Article 21 (3): Take technical measures to monitor and record network operations and cybersecurity events. Relevant network logs must be retained for at least six months as required.
Article 38: Operators of critical information infrastructure must conduct a security and risk assessment of their networks at least once a year. They can perform the assessment themselves or delegate it to a network security service provider. They must report the assessment results and improvement measures to the relevant departments responsible for critical information infrastructure security.
GB/T 22239-2019 Information Security Technology - Basic Requirements for Classified Protection of Cybersecurity requires that the audit system remains independent from the audited objects, such as databases. This is because deploying the audit system with the audited database creates a risk that audit data can be tampered with or deleted. This would compromise the authenticity and reliability of the audit.
How it works
The DataBase Audit service uses a bypass listener mode. This mode supports a deployment that is completely independent of your database, providing flexible auditing and monitoring without affecting your daily database performance.
Audits are based on database operation statements. DataBase Audit monitors database logons and access behaviors to effectively implement security policies. The service also has powerful database activity analysis capabilities and presents the status of database activity from multiple perspectives to help you enforce security policies.
It uses a modern human-computer interaction model. The product interface is designed to be user-friendly, professional, and usable. For statistical analysis of audit logs, DataBase Audit provides comprehensive reports. These reports combine basic business reports, such as daily, weekly, and monthly reports that can be sent automatically on a schedule, with specialized pattern analysis reports. This offers a new level of clarity for database audit product reports.
You can run audit queries at two levels: for a single database or for all databases. The service uses a multi-level drill-down feature to guide you through the query and analysis of audit logs. To help you customize audit rules, the service uses a top-down, rule-matching mechanism to define database audit rules at multiple levels.
Scenarios
The DataBase Audit service can help you with the following:
Passing compliance audits for Classified Protection of Cybersecurity. DataBase Audit provides evidence for Classified Protection Level 3 and other industry compliance audits.
Meeting the data retention period requirements of Classified Protection standards with support for incremental backup of audit data.
Monitoring threat status, operational status, performance status, and statement distribution in real time.
Recording, analyzing, and tracking database security events.
Tracking high-risk events and unsafe operations through database performance diagnosis.
Discovering program back doors to reduce the risk of data leaks.
Providing real-time database threat alerts to promptly protect against database attacks.
For more information, see Scenarios.
Features
DataBase Audit supports two instance types: C100 and D100. It provides audit services for different database types across various regions. Key features include user behavior auditing, multi-dimensional analysis, real-time alerting, and reporting. For more information, see Features.
C100 and D100 instances support different database types. For more information, see Supported database types.
C100 and D100 instances are available in different regions. For more information, see Supported regions.
Billing
DataBase Audit is a subscription-based service. C100 and D100 instances differ in the number of databases they can audit, their performance, and their price. The logic for dynamic log storage scale-out also differs between the two instance types. For more information, see Billing methods.
How to use
After you register an Alibaba Cloud account, you can use the following methods to create a C100 or D100 instance and start using the DataBase Audit service:
Alibaba Cloud Security DataBase Audit console: An interactive web-based service page.
To purchase a DataBase Audit instance, go to the purchase page. For more information about the configuration parameters, see Purchase a DataBase Audit instance (New purchases are discontinued).
For the user guides for C100 and D100 instances, see User Guide.
DataBase Audit API:
For the APIs supported by C100 instances, see API overview.
FAQ
Category | FAQ |
Pre-sales | |
Post-sales |