Configure audit rules-Data Security Center(DSC)-阿里云帮助中心

After you add a database to Database Audit, you can configure security rules, which are also known as audit rules. When an audit log matches an audit rule, Database Audit triggers an alert. This topic explains how to configure audit rules.

Rules

Database Audit supports two types of audit rules: built-in rules and custom rules.

Built-in rules are the default audit rules included in Database Audit. You can apply them directly to your databases.
You cannot modify built-in rules. However, you can copy a built-in rule to create a new custom rule, which you can then modify.
Add custom rules when the built-in rules do not meet your business requirements.

Prerequisites

You have added the database asset to Database Audit and enabled auditing for it, as described in Manage database assets.

Add a custom rule

Log on to the Database Audit system. For more information, see Log in to Database Audit Service.
In the left-side navigation pane, choose Rule Configuration > Security Rules.
On the security rule management tab, click the icon.

In the pane on the right, configure the basic rule information.

Parameter	Description
Rule name	A unique name for the rule.
Risk level	The risk level for alerts triggered by this rule.
Rule type	Custom rules are categorized into four types: injection attack, operation rule, access rule, and password attack. The settings to configure vary by rule type.
Rule group	A custom category for the rule.
Exception rule	Defines an allowlist for alerts. If configured, access from specified sources during a specific period is considered legitimate, and the system does not generate alerts for these operations. You can add up to three exception rules to a single custom rule. Note If you set Rule type to password attack, you cannot configure an exception rule. Rule name: The name of the exception rule. Access source: The legitimate access source. Conditions for different source types are combined with a logical AND. This means an access operation is considered legitimate only if all source conditions are met. If you specify multiple conditions for a single source type, they are combined with a logical OR. Example: Source IP is set to 192.168.0.1. Database user is set to user01 and TestUser01. When the exception rule is in effect, access operations from the source IP 192.168.0.1 with the database user name user01 or TestUser01 are considered legitimate. For access where the source IP is not 192.168.0.1, or the database name is not User01 or TestUser01, the database audit system determines whether the access operation is legitimate and whether to generate an alert based on existing audit rules. Time limit settings: The effective time period for the exception rule.

Configure the rule content based on the selected rule type, and then click Save.

If Rule type is set to injection attack, configure the following parameters:

Category	Parameter	Description
Access source	Source IP	The source IP address used to access the database. Example: 192.168.XX.1 to 192.168.XX.128. To allow access from any source, set the IP address range to 0.0.0.0-255.255.255.255.
	Database user	The username for the database. You can add multiple usernames.
	Client tool	The name of the client tool. You can add multiple client tools.
	MAC address	The MAC address of the device used to access the database.
	Operating system user	The operating system username used to access the database.
	Hostname	The hostname of the computer used to access the database.
	Instance name	The name of the database instance.
Operation	SQL operation	Select the SQL commands to match based on the SQL statement.
Conditional Control	Message keyword	Defines rules based on message keywords by using conditions such as Contains, Does not contain, or Regex match.
Conditional Control	Message keyword-template	Defines rules based on message keyword templates by using conditions such as Contains, Does not contain, or Regex match.
Execution Result	Affected rows limit	Applies to SELECT, UPDATE, and DELETE statements.
Injection signature	Injection signature	Specifies the command signature for an injection attack. The system matches operations against this signature.
Response action	Control action	No configuration is required. This item is for reference only.
	Audit	Select an audit method: Audit and Alert: The system audits events that match this rule and generates alerts. Audit Only: The system audits events that match this rule but does not generate alerts. No Audit: The system does not audit events that match this rule.
	Alert notification count	The maximum number of alerts that this rule can trigger per day.
	Audit result set	Specifies how to audit the result set of an operation. Follow audit option settings: Audits the result set based on the asset's result set audit switch setting. Audit: Audits the result set. You must set the maximum number of rows and characters to audit. The system stops auditing when either threshold is reached. Do not audit: Does not audit the result set.
Time Limit Settings	Time limit settings	Sets the effective time period for the rule.
Associated databases	Associated databases	Select the databases on which to enable this rule.
Other	Rule description	A description of the rule. Up to 1,000 characters are supported.

If Rule type is set to operation rule, configure the following parameters:

Category	Parameter	Description
Access source	Source IP	The source IP address used to access the database. Example: 192.168.XX.1 to 192.168.XX.128. To allow access from any source, set the IP address range to 0.0.0.0-255.255.255.255.
	Database user	The username for the database. You can add multiple usernames.
	Client tool	The name of the client tool used to access the database.
	MAC address	The MAC address of the device used to access the database.
	Operating system user	The operating system username used to access the database.
	Hostname	The hostname of the computer used to access the database.
	Instance name	The name of the database instance.
Application Identity	Application client IP	The client IP address associated with the application.
Application Identity	Application user	The username associated with the application.
Operation	Data operation	Configure matching rules for DDL, DML, DCL, and other operations.
Operation on specified objects	Object	The objects this rule applies to. By default, the rule applies to all audited database assets. Click Add to apply this rule only to specific objects. The following items describe the settings: Object relationship: The relationship between multiple objects that you add in the Add operation on specified objects panel. Object group: Select one or more database object groups from the drop-down list. Object: The details of the objects to which the rule applies. SQL operation: The scope of SQL operations to which the rule applies.
Operation on specified objects	Object collection relationship	The relationship between multiple object collections. The default is OR.
Conditional Control	Conditional Control	Matches the number of associated tables, message keywords, and WHERE clauses.
Execution Result	Execution Result	Matches the number of affected rows, response time, execution result, and response error code.
Response action	Control action	No configuration is required. This item is for reference only.
	Audit	Select an audit method: Audit and Alert: The system audits events that match this rule and generates alerts. Audit Only: The system audits events that match this rule but does not generate alerts. No Audit: The system does not audit events that match this rule.
	Alert notification count	The maximum number of alerts that this rule can trigger per day.
	Audit result set	Specifies how to audit the result set of an operation. Follow audit option settings: Audits the result set based on the asset's result set audit switch setting. Audit: Audits the result set. You must set the maximum number of rows and characters to audit. The system stops auditing when either threshold is reached. Do not audit: Does not audit the result set.
Time Limit Settings	Time limit settings	Sets the effective time period for the rule.
Associated databases	Associated databases	Select the databases where this rule will be active.
Other	Rule description	A description of the rule. Up to 1,000 characters are supported.

If Rule type is set to access rule, configure the following parameters:

Category	Parameter	Description
Access source	Source IP	The source IP address used to access the database. Example: 192.168.XX.1 to 192.168.XX.128. To allow access from any source, set the IP address range to 0.0.0.0-255.255.255.255.
	Database user	The username for the database. You can add multiple usernames.
	Client tool	The name of the client tool. You can add multiple client tools.
	MAC address	The MAC address of the device used to access the database.
	Operating system user	The operating system username used to access the database.
	Hostname	The hostname of the computer used to access the database.
	Instance name	The name of the database instance.
Response action	Control action	No configuration is required. This item is for reference only.
	Audit	Select an audit method: Audit and alert: The system audits matching statements and reports alerts. Audit only: The system audits matching statements but does not report alerts.
	Alert notification count	The maximum number of alerts that this rule can trigger per day.
Time Limit Settings	Time limit settings	Sets the effective time period for the rule.
Associated databases	Associated databases	Select the databases where this rule will be active.
Other	Rule description	A description of the rule. Up to 1,000 characters are supported.

If Rule type is set to password attack, configure the following parameters:

Category	Parameter	Description
Access source	Failed login control	Triggers an alert when the number of failed logins from an IP address, for a username, or both reaches a threshold.
Execution Result	Execution Result	Sets the tracking time window, login attempt threshold, and action duration for failed logins.
Response action	Control action	No configuration is required. This item is for reference only.
Response action	Audit	Select an audit method: Audit and alert: The system audits matching statements and reports alerts. Audit only: The system audits matching statements but does not report alerts.
Associated databases	Associated databases	Select the databases where this rule will be active.
Other	Rule description	A description of the rule. Up to 1,000 characters are supported.

Rule reference

You can view the rules associated with your databases and associate, disassociate, enable, or disable them as needed.

Log on to the Database Audit system. For more information, see Log in to Database Audit Service.
In the left-side navigation pane, click rule configuration > security rule.
On the rule reference tab, set the search conditions and click Search.
The rule configuration page shows an overview of enabled rule configurations.
If you select Unassociated for the Association status search condition, the search returns unassociated rules. You can click Associate in the Actions column to associate a rule.

Adjust rule priority

If multiple rules with the same configuration apply to the same database, you can adjust their priority. This ensures that audited SQL statements match the highest-priority rule.

Note

The system matches statement rules before security rules. Within each rule type, the system also processes rules in order of priority.

Log on to the Database Audit system. For more information, see Log in to Database Audit Service.
In the left-side navigation pane, choose Rule Configuration > Security Rules.
On the Rule reference tab, set the search conditions and click Query.
Move a rule up, down, to the top, or to the bottom of the list, and then click Apply Priority.
The index determines the rule priority. A lower index number indicates a higher priority.