Identifiers are the names given to database objects such as tables, columns, indexes, views, other objects, and the database itself.
Identifier Type | Description |
|---|---|
String-based | Types that are matched against strings. |
Number-based | Types that can be translated into a number representation. Numbers can be in a specific range. Number-based types can be enforced to equal only a fixed set of constants. |
Enumerated | Types that represent a fixed set of constants that can't be translated into a number representation. |
Database Security supports following identifiers.
Identifier | Type | Description | Example | Identifier Supported on Monitoring Type |
|---|---|---|---|---|
action | string | Displays the action the application took while connecting to the DBMS and executing statements. | action='Data modeler' | Memory and Network |
application | string | Identifies the application used to connect to the DBMS and execute statements. Example: SQL Developer, Microsoft SQL Server Management Studio - Query, sqlcmd, sqlplus etc. | application= ‘sqlplus@PP-RHEL81-VM7 (TNS V1-V3)’ application= ‘Microsoft SQL Server Management Studio - Query’ application= ‘SQL Developer’ | Memory and Network |
bindvar | string | Matches the actual values of bind variables used in SQL statements. Bind variables are placeholders in SQL statements, represented by a colon (:) followed by a variable name, that allow values to be passed at runtime. For example, bindvar='123' will detect statements that contain a bind variable where the resolved bind variable value is '123'. | bindvar=’7902’ | Network |
client_acctstr | string | Refers to the DB2 client account string. Use this identifier with DB2 only. | client_acctstr='db2' | Memory and Network |
client_appl_name | string | Refers to the Sybase client application name. Use this identifier with Sybase DBMS only. | client_appl_name =’sentrigo’ | Memory and Network |
client_host_name | string | Refers to the Sybase client host name. Use this identifier with Sybase DBMS only. | client_host_name =’hedgehog’ | Memory and Network |
client_info | string | Supplies additional information about the client application. | client_info='str4' | Memory and Network |
client_ip | IP Address | Displays the IP address of the database client application. For IPV4: IP addresses must be in the form of - XXX.XXX.XXX.XXX (single IP address) or XXX.XXX.XXX.XXX/YYY.YYY.YYY.YYY (IP address with subnet). For IPV6: IP addresses must be in the form of - [XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX] (single IP address) or [XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX]/Y (IP address with prefixlen). Each IP address is validated by the Database Security system to prevent errors.
| IPv4 client_ip=10.45.40.43/255.255.255.0 IPv6 client_ip=[XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX]/64 or [XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX]/96 where 64 and 96 are prefixlen. TERMINAL = 'pts/0' AND HOST = '763RHEL9401.CDA.BEA.LAB' AND client_ip = [2607:8d40:42:3606:ffff:ffff:ffff:cb13] AND APPLICATION = 'sqlplus@763RHEL9401.CDA.BEA.LAB (TNS V1-V3)' | Memory and Network |
client_name | string | Refers to the Sybase client name. Use this identifier with Sybase DBMS only. | client_name=’sybase’ | Memory and Network |
client_wrkstnname | string | Displays the hostname of the client system attempting to connect to the DB2 DBMS. | client_wrkstnname='cwrkstation1337' | Memory and Network |
clientid | string | Displays the application-set clientid accessing the Oracle and DB2 DBMS. | clientid=’str1’ | Memory and Network |
cmdtype | string | Shows the type of command used in the executed statement, such as select, declare, insert, update, delete, grant, revoke, create, drop, or truncate. It can also be 'batch' for a batch of statements. | cmdtype=’batch’ cmdtype=’insert’ | Memory and Network |
connection_type | string | Indicates the type of connection the application used to execute the statement on the DBMS (e.g., encrypted or not encrypted). For Oracle DBMS without encryption, the connection type uses the Bequeath protocol. For alerts captured via network monitoring the connection type is Not encrypted. When a client application uses encryption while connecting to the Database, that connection is Encrypted. | connection_type=‘Encrypted’ or connection_type=‘Not encrypted’ | Memory and Network |
context_info | string | Captures Microsoft SQL context information. Use this identifier with Microsoft SQL DBMS only. | Memory and Network | |
date | number | Captures the date when the statement was executed. It uses the MM/DD/YYYY format (US Date Format). | date=01/25/2025 | Memory and Network |
day | number | Captures the day of the month (ranging from 1-31) when the statement was executed on the DBMS. | day=31 | Memory and Network |
db_container | string | Indicates whether the statement was executed in the Container Database (CDB) or a Pluggable Database (PDB) in an Oracle CDB/PDB database. CDBs are indicated by CDB$ROOT and PDBs by names like ORCLPDB. Container database (CDB) is indicated by CDB$ROOT and Pluggable database (PDB) is indicated by ORCLPDB. This provides specific database context information when using the Pluggable Database functionality (Oracle 12c only). | db_container=‘ORCLPDB’ | Memory |
dbms_host | string | Displays the hostname of the system where the DBMS is monitored. | dbms_host=‘PP-RHEL81-VM7’ | Memory and Network |
dbms_name | string | Stands for the name of the DBMS (e.g., ORCLPDB). | dbms_name=‘ORCLPDB’ | Memory and Network |
duration | number | Captures the time taken (in seconds) for the statement to execute on the DBMS. | duration=20 | Memory and Network |
enduser_action | string | Captures the action used by the remote application when a user logs in to the DBMS instance from another host. This uses the same format as the action identifier. | enduser_action=‘GETr’ | Memory and Network |
enduser_ip | ip address | Captures the end user's IP address or real IP used for remote login when a user logs in to the DBMS instance from another host. This follows the same syntax and type as the ip and client_ip identifiers. For IPV4: IP addresses must be in the form of - XXX.XXX.XXX.XXX (single IP address) or XXX.XXX.XXX.XXX/YYY.YYY.YYY.YYY (IP address with subnet). For IPV6: IP addresses must be in the form of - [XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX] (single IP address) or [XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX]/Y (IP address with prefixlen). Each IP address is validated by the Database Security system to prevent errors. Example:
| IPv4 enduser_ip=10.45.40.43/255.255.255.0 IPv6 enduser_ip=[XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX]/64 or [XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX]/96 where 64 and 96 are prefixlen. TERMINAL = 'pts/0' AND HOST = '763RHEL9401.CDA.BEA.LAB' AND enduser_ip= [2607:8d40:42:3606:ffff:ffff:ffff:cb13] AND APPLICATION = 'sqlplus@763RHEL9401.CDA.BEA.LAB (TNS V1-V3)' | Memory and Network |
enduser_module | string | Captures the module used for remote login when a user logs in to the DBMS instance from another host. This uses the same format as the module identifier. | enduser_module=‘MDULE’ | Memory and Network |
enduser_name | string | Captures the login name used for remote login when a user logs in to the DBMS instance from another host. | enduser_name=‘mary’ | Memory and Network |
error code | number | Captures the error code generated when an incorrect statement executes on the DBMS. For example, when the user tries to access a table that does not exist. | error_code>=923 | Network |
exec_user | string | Displays the new user if the original logged-in user changes to another user. If the user does not change, this identifier is the same as the user identifier. | exec_user=‘C##ADS_TESTING’ | Memory and Network |
host | string | Displays the hostname of the operating system from which the application executed the query. For network monitoring of a remote login, it displays the remote machine's hostname. For local memory monitoring, it displays the hostname of the OS where the DBMS instance is installed. | host=‘PP-RHEL81-VM7’ | Memory and Network |
hour | number | Displays the hour during which the statement executed on the DBMS. The format is HH (0-23 in a 24-hour format), and it can optionally include minutes (MM from 0-59). | Example: hour=23 | Memory and Network |
inflow | string | The inflow PL/SQL object that originated the current executing statement. Same format as object. | inflow=‘ZMUH001.ORDERS’ (In Oracle DBMS) inflow=‘master.dbo.employee’ (In MSSQL DBMS) | Memory |
inflowsql | string | Displays the SQL statement that originated the currently executing statement. This uses the same format as the statement identifier. | inflowsql like ‘%select * from zmuh001.orders%’ inflowsql matches 'select.*from.*[a-z]*[A-Z]*[0-9]*.*orders' | Memory |
instance | string | The instance where the execution takes place. In Oracle, this value is the SID of the database instance. In Sybase, this value is the instance name. In MS SQL, it is the full instance name including the host (for example, MYHOST\SQLSERVER). | instance=‘ORCLPDB’ | Memory and Network |
ip | number | Indicates the IP address from which the statement executed on the DBMS. For network-executed statements, it displays the remote host's IP address. IP addresses for IPv4 must be in the form of - XXX.XXX.XXX.XXX (single IP address) or XXX.XXX.XXX.XXX/YYY.YYY.YYY.YYY (IP address with subnet). For IPv6 IP addresses must be in the form of - [XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX] (single IP address) or [XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX]/Y (IP address with prefixlen). Each IP address is validated by the Database Security system to prevent errors.
| IPv4 ip=10.45.40.43/255.255.255.0 IPv6 ip=[XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX]/64 or [XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX]/96 where 64 and 96 are prefixlen. TERMINAL = 'pts/0' AND HOST = '763RHEL9401.CDA.BEA.LAB' AND IP = [2607:8d40:42:3606:ffff:ffff:ffff:cb13] AND APPLICATION = 'sqlplus@763RHEL9401.CDA.BEA.LAB (TNS V1-V3)' | Memory and Network |
module | string | Displays the module the application used for statement execution on the DBMS. This applies to Oracle, MSSQL, and SAP HANA DBMS. | module=‘SQL Developer’ | Memory and Network |
month | number | Displays the month of the year when the statement was executed on the DBMS. It accepts full month names (e.g., JANUARY) or short forms (e.g., JAN). | month=JANUARY | Memory and Network |
nethost | string | Displays the hostname of the remote machine's operating system when a user logs in from a remote machine during network monitoring. | nethost=‘10.45.40.153’ | Network |
netip | number | Displays the IP address of the remote machine from which the user executed the statement after logging in to the application. Use this only when network monitoring is enabled. | netip=10.45.40.153 | Network |
object | string | Displays the name of the object or table that the statement accessed. Supports syntax of the form [owner.]objectname. DBMS objects include such as, tables, triggers, or stored procedures. In Oracle, the format is In MS SQL and Sybase, it is | object=‘ZMUH001.ORDERS’ (In Oracle DBMS) object=‘master.dbo.employee’ (In MSSQL DBMS) | Memory and Network |
osuser | string | Displays the operating system user. The visibility of this information depends on the database type and authentication method. | osuser=‘BASE-WIN2019\Administrator’ | Memory and Network |
schema | string | Indicates the schema of the DBMS. In Oracle, the schema is a collection of logical data structures (schema objects) and has the same name as the user account that owns it. | schema=‘C##ADS_TESTING’ | Memory |
session_state | string | Captures the state of the session or login. Use it to detect new sessions, ended sessions, new logins, ended logins, schema changes, and statement execution.
| session_state=NEW_SESSION session_state=END_SESSION session_state=NEW_LOGIN session_state=END_LOGIN session_state=CHANGE_SCHEMA session_state=EXECUTE | Memory |
postgres_sqlstate | string | Displays the alphanumeric code returned by a PostgreSQL DBMS after a statement executes. | Memory and Network | |
statement | string | Displays the SQL statement the executing user ran on the DBMS instance. Use operators like CONTAINS or NOT CONTAINS or matches and not matches for regex expressions. | statement like ‘%select * from zmuh001.orders%’ statement matches 'select.*from.*[a-z]*[A-Z]*[0-9]*.*orders' | Memory and Network |
terminal | string | Displays the pseudo terminal where the user logged on to the OS while executing the statement on the DBMS. On Unix/Linux, this information is available via the w or who command on the SSH terminal. | terminal=‘pts/1’ | Memory and Network |
user | string | Displays the user details when a user logs into an application and executes a statement on the DBMS. This identifier is similar in format to the executing user identifier. | user=‘C##ADS_TESTING’ | Memory and Network |
version_dbtwo | number | Displays the DB2 version, including the minor version (e.g., DB2 11.5.6). This identifier is rarely used. | version_dbtwo=11.5.6 | Memory and Network |
version_mssql | number | Displays the MSSQL version, including the minor version (e.g., 9.0.4053). This identifier is rarely used. | version_mssql=9.0.4053 | Memory and Network |
version_oracle | number | Displays the full 5-digit Oracle DBMS version, including the minor version (e.g., 19.0.0.0.0). This identifier is rarely used. | version_oracle=19.0.0.0.0 | Memory and Network |
version_sybase | number | Displays the Sybase DBMS version, including the minor version (e.g., 16.0.0). This identifier is rarely used. | version_sybase=16.0.0 | Memory and Network |
weekday | value | Displays the day of the week (e.g., SUNDAY, MONDAY) when the statement executed on the DBMS. Short forms (e.g., TUE) are also accepted. | weekday=SUNDAY | Memory and Network |
Note
All rules are case insensitive. An identifier can be specified in lowercase letters, uppercase letters, or a combination of both. For example, user, User, USER, uSEr are all legal for the user identifier. In addition, constant values are case insensitive so SUNDAY and SunDAy are equivalent.