Use filter rules to define trusted operations that Database Audit should ignore. This improves alert accuracy and reduces storage usage for audit logs.
Background
Database Audit supports the following three types of filter rules:
Filter by IP: Excludes SQL requests from specified trusted IP addresses.
Filter by SQL Template: Excludes SQL requests that match enabled, built-in SQL templates.
Filter by Rule: Excludes SQL requests that match custom rules based on criteria like client details, server details, SQL requests, and SQL results.
Add IP filter rule
The IP addresses you add apply globally to all assets. After you save the rule, Database Audit will no longer audit requests from these IPs. Proceed with caution.
Log on to Database Audit. For more information, see Log on to Database Audit.
In the left-side navigation pane, choose .
On the Filter by IP tab, click Add.
In the Add IP Filter panel, enter a rule name and the IP addresses to exclude from auditing, and then click Save.
Filter by SQL Template
The Filter by SQL Template feature provides built-in templates for common, trusted SQL patterns, which apply to all databases by default. You cannot create custom SQL templates, but you can enable or disable the built-in ones.
Log on to Database Audit. For more information, see Log on to Database Audit.
In the left-side navigation pane, choose .
On the Filter Rules page, click the Filter by SQL Template tab.
Select one or more target SQL templates and click Enable Selected or Disable Selected.
To enable or disable all SQL templates, click Enable All or Disable All.
Filter by Rule
The Filter by Rule feature lets you create custom rules to prevent specific requests from being audited.
Log on to Database Audit. For more information, see Log on to Database Audit.
In the left-side navigation pane, choose .
On the Filter Rules page, click the Filter by Rule tab.
On the Filter by Rule tab, click Add.
In the Add Rule panel, configure the rule parameters, and then click Save.
Category
Parameter
Operators
Description
Basic Information
Name
N/A
The rule name. It must be 1 to 64 characters long and can include Chinese characters, letters, digits, periods (.), underscores (_), and hyphens (-).
ImportantRule names must be unique within the same database.
Description
N/A
A description for the rule.
Client
Client Source
Equals, Not equals
The client's IP address. You can specify an IP address or an IP group. Separate multiple values with commas. Example: 192.168.XX.XX,192.168.XX.XX.
Client Tool
Equals, Not equals
The client tool's name. Separate multiple values with commas. Example: db2bp.exe,javaw.exe,plsqldev.exe.
Client Port
N/A
The client's access port. Separate multiple ports or port ranges with commas. Example: 10-15,20,25,30-40.
Client MAC Address
Equals, Not equals
The client's MAC address. Separate multiple values with commas. Example: fe:58:c0:39::,fe:58:c0:55::.
OS Username
Equals, Not equals
The client's operating system logon username. Separate multiple values with commas. Example: user01,user02.
Hostname
Equals, Not equals
The client's hostname. Separate multiple values with commas. Example: HostUser01,HostUser02.
Application IP
Equals, Not equals
The client application's IP address. You can specify an IP address or an IP group. Separate multiple values with commas. Example: 192.168.XX.XX,192.168.XX.XX.
Application Username
Equals, Not equals
The username of the client application. You can specify a value by using Custom or Select from Group. Enter multiple values separated by commas. Example: TestUser01,TestUser02.
Server
Server IP
Equals, Not equals
The IP address of the server. You can specify multiple values, separated by commas. Example: 192.168.XX.XX,192.168.XX.XX.
Server Port
N/A
The port number of the server. You can specify multiple values or port ranges, separated by commas. Example: 10-15,20,25,30-40.
Database Account
Equals, Not equals
The database logon account. You can specify a value by using Custom or Select from Group. Enter multiple values separated by commas. Example: system,sys.
Server MAC Address
Equals, Not equals
The MAC address of the server machine. You can specify multiple values, separated by commas. Example: fe:58:c0:39::,fe:58:c0:55::.
Database Name (SID)
N/A
The database name. For Oracle, this is the SID. For other types, it is the database name. Separate multiple values with commas.
Behavior
Object Group
N/A
The object group to which the SQL statement belongs. Supported options: Match if any object is included and Match only if all objects are included.
Operation Type
N/A
The type of database operation. Valid values include:
DDL: Truncate, Create, Alter, Drop, Comment, and Rename.
DML: Select, Insert, Update, Delete, Call, Explain, Lock, and Merge.
DCL: Grant and Revoke.
Other: UNKNOWN, Savepoint, Commit, Rollback, and more.
SQL Template ID
N/A
The ID of the SQL template. You can specify multiple IDs, separated by commas.
SQL Keyword
N/A
Match requests based on keyword logic defined by one or more conditions and a conditional expression.
Add one or more conditions.
Enter the packet content to match. Regular expressions are supported. Click Add Condition to add multiple conditions.
After you add a condition, you can perform Regular Expression Validation to verify whether the specified content matches the configured regular expression. The steps are as follows:
Click Validate Regex below the condition.
In the Validate Regex dialog box, confirm the Regular Expression and enter the Content to Validate.
Click Validate.
Create a Conditional Expression.
Use AND (
&), OR (|), NOT (~), and parentheses to build a logical expression that references conditions by number.Example:
1&2indicates that both Condition 1 and Condition 2 must be met for the request to match the rule.
SQL Length
Greater than or equal to
The length of the SQL statement, in bytes. The valid range is 1 to 65,536.
Number of Associated Tables
Greater than or equal to
The number of tables involved in the SQL operation. If the number of tables is greater than or equal to this value, the operation is not audited. The maximum value is 255.
WHERE Clause
N/A
Checks if the statement contains a WHERE clause. Valid values: Do Not Check, With WHERE Clause, and Without WHERE Clause.
Result
Execution Duration
Greater than or equal to, Less than or equal to, Interval
The SQL statement's execution duration. Units: Second(s), Millisecond(s), and Microsecond(s). The valid range is 0 to 1,800 seconds. A request matches the rule if its execution duration is within the specified range.
Affected Rows
Greater than or equal to, Less than or equal to, Interval
The number of rows affected by the SQL statement. The valid range is 0 to 999,999,999. The operation is not audited if the number of affected rows falls within this range.
Result Set
N/A
Configure this parameter as follows:
Add one or more conditions.
In the condition box, enter the packet content to match. Regular expressions are supported. Click Add Condition to add multiple conditions.
After you add a condition, you can perform a Regular Expression Check to verify whether the specified content matches the configured regular expression. The steps are as follows:
Click Validate Regex below the condition.
In the Validate Regex dialog box, confirm the Regular Expression and enter the Content to Validate.
Click Validate.
Create a Conditional Expression.
Use AND (
&), OR (|), NOT (~), and parentheses to define the logical relationship between conditions. Conditions are referenced by their number, such as1for the first condition.Example:
1&2indicates that both Condition 1 and Condition 2 must be met for the request to match the rule.
Execution Status
N/A
The execution status returned in the result.
Execution Result Description
Match, Not match
Keywords in the execution result. You can use regular expressions for matching.
Other
Effective Time
N/A
The period during which the rule is active. You can specify a Custom time range or Select from Group.
Select the target rule and click Enable Selected.
A rule only takes effect after you enable it. To enable all rules, click Enable All.
In the Select Assets dialog box, select the assets to which the rule applies, and then click OK.