DocsICP FilingConsole
Documentation
Home Page Data Security Center Traditional data audit (stop new purchase) User Guide C100 Configure database assets for auditing Rule configuration Configure security rules

Configure security rules

Updated at:
Copy as MD
Product
My Favorites

This topic describes how to configure security rules for a database in Cloud Shield Database Audit.

Prerequisites

An asset has been added. For more information about how to add an asset, see Add an asset.

Background information

After you add a database to Database Audit, you can configure security rules for it. When an audit record matches an enabled security rule, an alert is triggered.

Security rules include system rules and user-defined rules.

  • System rules are built-in rules. Supported types include SQL injection, vulnerability attack, account security, data leak, and non-compliant operation rules. Each type contains multiple rules. The supported system rules vary by database. For the specific rules available, see the Rule Management page for your database. When you add an asset, you can choose whether to enable system rules.

  • You can create user-defined rules after adding a database. These rules apply only to the specific database for which they are created and cannot be shared.

Create a user-defined rule

  1. Log on to the Database Audit system. For more information, see Log in to the Database Audit system.

  2. In the left-side navigation pane, choose Rule Configuration > Security Rules.

  3. On the Rule Management tab, click Add.

  4. In the Add Rule panel, configure the rule parameters and click Save.

    Category

    Parameter

    Logical operators

    Description

    Basic information

    Name

    N/A

    The name of the rule. It must be 1 to 64 characters long. It can contain Chinese characters, uppercase letters, lowercase letters, digits, periods (.), underscores (_), and hyphens (-).

    Important

    The names of user-defined rules must be unique for each database.

    Description

    N/A

    A description of the rule.

    Risk level

    N/A

    The risk level of the alert triggered by a rule match. Valid values: High, Medium, and Low.

    Parent directory

    N/A

    The parent directory to which the rule belongs.

    Rule type

    N/A

    The type of the rule. Valid values: Standard Rule and Correlation Rule.

    Correlation period

    Important

    This parameter applies only to correlation rules.

    N/A

    The time window for a correlation rule. The allowed range is from 10 seconds to 30 minutes.

    Count

    Important

    This parameter applies only to correlation rules.

    N/A

    The number of rule matches required within the correlation period to trigger an alert. The value can range from 2 to 30.

    Correlation condition

    Important

    This parameter applies only to correlation rules.

    N/A

    The condition for data correlation. Valid values: Same Session, Same Client IP, Same Database Account, and Same Client Tool.

    Client

    Client source

    Equals, Not Equal to

    The IP address of the client. You can specify IP addresses or IP address groups. To specify multiple values, separate them with commas (,). For example, 192.168.1.2,192.168.1.3.

    Client tool

    Equals, Not Equal to

    The name of the tool used by the client. To specify multiple values, separate them with commas (,). For example, db2bp.exe,javaw.exe,plsqldev.exe.

    Client port

    N/A

    The client's port number. You can specify multiple values or ranges. To specify multiple values, separate them with commas (,). For example, 10-15,20,25,30-40.

    Client MAC address

    Equals, Not Equal to

    The client's MAC address. To specify multiple values, separate them with commas (,). For example, fe:58:c0:39:dd:cf,fe:58:c0:55:dd:cf.

    OS user

    Equals, Not Equal to

    The client's operating system username. To specify multiple values, separate them with commas (,). For example, user1,user2.

    Hostname

    Equals, Not Equal to

    The hostname of the client. To specify multiple values, separate them with commas (,). For example, host1,host2.

    Application IP

    Equals, Not Equal to

    The IP address of the client application. You can specify IP addresses or IP address groups. To specify multiple values, separate them with commas (,). For example, 192.168.0.1,192.168.0.2.

    Application username

    Equals, Not Equal to

    The username for the client application. You can specify a custom value or select from a group. To specify multiple values, separate them with commas (,). For example, app_user1,app_user2.

    Server

    Server IP

    Equals, Not Equal to

    The IP address of the server. To specify multiple values, separate them with commas (,). For example, 192.168.0.100,192.168.0.101.

    Server port

    N/A

    The port number of the server. You can specify multiple values or ranges. To specify multiple values, separate them with commas (,). For example, 10-15,20,25,30-40.

    Database account

    Equals, Not Equal to

    The logon username for the database. You can specify a custom value or select from a group. To specify multiple values, separate them with commas (,). For example, system,sys.

    Server MAC address

    Equals, Not Equal to

    The server's MAC address. To specify multiple values, separate them with commas (,). For example, fe:58:c0:39:dd:cf,fe:58:c0:55:ee:ff.

    Database name (SID)

    N/A

    The name of the database on the server. For Oracle databases, enter the SID. For other database types, enter the database name. To specify multiple values, separate them with commas (,).

    Action

    Object group

    N/A

    The object group to which the SQL statement belongs. Valid values: Match if any object is included and Match only if all objects are included.

    Operation type

    N/A

    The type of operation performed on the database. Valid values:

    • DDL: Truncate, Create, Alter, Drop, Comment, and Rename.

    • DML: Insert, Update, Delete, Call, Explain, Lock, and Merge. This group also includes the Select query operation (DQL).

    • DCL: Grant and Revoke.

    • Other: UNKNOWN, Savepoint, Commit, and Rollback.

    SQL template ID

    N/A

    The ID of the SQL template. To specify multiple values, separate them with commas (,).

    SQL keywords

    N/A

    Configure this parameter as follows:

    1. Add a condition.

      In the condition field, enter the content to match. You can use a regular expression. Click Add Condition to add multiple conditions.

      After you add a condition, you can perform a Regex Test to verify whether the specified content matches the regular expression. To do this, follow these steps:

      1. Click Regex Test below the condition.

      2. In the Regex Test dialog box, confirm the regular expression and enter the content to test.

      3. Click Test.

    2. Write a logical expression for conditions.

      Use AND (&), OR (|), NOT (~), and parentheses to describe the logical relationship between conditions. Conditions are represented by sequence numbers, for example, 1 represents Condition 1.

      Example: 1&2 indicates that both Condition 1 and Condition 2 must be met to trigger an alert.

    SQL length

    Greater than or equal to

    The length of the SQL statement. The allowed range is 1 to 65,536 bytes.

    Number of associated tables

    Greater than or equal to

    The number of tables involved in the SQL operation. Triggers an alert if the number of tables is greater than or equal to this value. The maximum allowed value is 255.

    WHERE clause

    N/A

    Specifies whether the statement must contain a WHERE clause. Valid values: Do not check, Has WHERE clause, and No WHERE clause.

    Result

    Execution time

    Greater than or equal to, Less than or equal to, Range

    The execution time of the SQL statement. Valid units: seconds, milliseconds, and microseconds. The value can range from 0 to 1,800 seconds. An alert is triggered if the execution time falls within the specified range.

    Affected rows

    Greater than or equal to, Less than or equal to, Range

    The number of rows affected by the SQL statement. The value can range from 0 to 999,999,999. An alert is triggered if the number of affected rows from the SQL operation falls within this range.

    Result set

    N/A

    Configure this parameter as follows:

    1. Add a condition.

      In the condition field, enter the content to match. You can use a regular expression. Click Add Condition to add multiple conditions.

      After you add a condition, you can perform a Regex Test to verify whether the specified content matches the regular expression. To do this, follow these steps:

      1. Click Regex Test below the condition.

      2. In the Regex Test dialog box, confirm the regular expression and enter the content to test.

      3. Click Test.

    2. Write a logical expression for conditions.

      Use AND (&), OR (|), NOT (~), and parentheses to describe the logical relationship between conditions. Conditions are represented by sequence numbers, for example, 1 represents Condition 1.

      Example: 1&2 indicates that both Condition 1 and Condition 2 must be met to trigger an alert.

    Execution status

    N/A

    The execution status of the operation. Valid values: All, Succeeded, and Failed.

    Execution result description

    Matches, Does not match

    Keywords in the execution result. You can use a regular expression.

    Other

    Effective period

    N/A

    The time period when the rule is active. You can specify a custom period or select from a group. Valid values: Any time, Daily, Weekly, and Monthly.

    When you create a user-defined rule, it is added to the rule list. By default, the new rule is not applied to any database (the Asset Count is 0). You can follow the steps in the next section to enable the rule for a database.

Enable rules

Enable a single rule

  1. On the Rule Management page, find the target rule and click the number in the Asset Count column.

    The rule list displays information for each rule, such as its Name, Description, Parent directory, and Allowlist count, and provides options such as Edit, Clone, and Delete.

  2. In the Set Assets for Rule <Rule Name> dialog box, select the database to which you want to apply the rule.

  3. Click OK.

Enable rules in batches

  1. On the Rule Management page, find the rules that you want to enable and select the checkboxes to the left of their Risk Level.

    After you select one or more rules, the Disable All button changes to Disable Selected.

    When you select the checkbox to the left of a rule's Level, Enable All in the Rule List automatically changes to Enable Selected.

  2. Click Enable Selected.

  3. In the Select Assets dialog box, select the databases for which you want to enable the selected rules.

  4. Click OK.

Enable all rules

  1. On the Rule Management page, click Enable All.

  2. In the Select Assets dialog box, select the databases for which you want to enable all rules.

  3. Click OK.

The procedure for disabling rules is similar to enabling them. You can disable a single rule, selected rules, or all rules.

Next steps

  • When an audit record for a target database matches an enabled security rule, an alert is triggered. You can then view alerts for the database. For more information, see Alert logs.

  • You can configure an allowlist for a user-defined rule. If an audit record meets the conditions specified in the allowlist, it does not trigger an alert even if it matches the user-defined rule. For more information, see Configure an allowlist.

Previous：Rule overviewNext：Configure whitelists