These examples illustrate the rule syntax.
Example 1
OSUSER = 'mycompany\john' AND APPLICATION CONTAINS 'sqlplus' AND HOST = 'johnlaptop.localdomain' AND IP = 192.168.1.7
Action: Allow
The above rule allows john to use SQL*Plus from his station (defined by host name and IP address), thereby bypassing many of the rules that come later (such as preventing SQL*Plus from being used).
Example 2
APPLICATION CONTAINS 'sqlplus' OR APPLICATION CONTAINS 'toad'
Action: Log-high, e-mail-high, terminate
This rule terminates any access by the applications Toad or SQL*Plus. It also sends a high-severity alert and email message to the Trellix Database Security administrator.
Example 3
STATEMENT CONTAINS 'emps'
Action: log-medium
This example assumes that the emps.* columns include sensitive data that require protection, and that emps.salary and emps.cc are particularly sensitive.
This rule provides an alert every time an SQL statement includes the string emps, alerting on any access attempt to columns containing the name emps (or any other SQL statement component that includes the string emps). Even when the user is not actually accessing the objects (for example, the DBMS prohibits access based on authorization rules), this rule generates alerts (in contrast to using object, see example 4 below).
Example 4
OBJECT = 'emps.salary' OR OBJECT = 'emps.cc'
Action: log-high, email-high
This example assumes that emps.salary and emps.cc tables are particularly sensitive.
This rule provides a high-level alert and an email each time the specified objects are accessed. An alert appears whether the object is accessed in a view, a stored procedure, a trigger, or another database. In this case, if the DBMS successfully restricts the user from accessing the objects, an alert is not generated because the object is not accessed.
Example 5
Statement contains 'drop session' Alert low
Statement contains 'alter DBMS' Alert low
Statement contains 'drop table' Alert Low
Statement contains 'grant' Alert low
Statement contains 'grant dba' Alert medium
Statement contains 'grant sysdba' Alert medium
Statement contains 'noaudit' and osuser <> 'mycompany\johnd'
Action: Alert-high email-high
In this example, the user receives alerts when various DDL commands are executed, and a high importance email is sent to the administrator when someone other than the DBA attempts to stop auditing.