Set up database audit trails

Set up an audit trail to track access and changes made to the database or to tables associated with specific database events. The Trellix ESM compliance report lists audit trails associated with each event.

To generate audit trail events, you must add:

Data Access rules
Privileged User Audit Trails report

From the dashboard, click and select Policy Editor.
In the Rule Types pane, select DEM → Data Access.
Highlight DEM - Template Rule - Trusted Use Access From IP Range.
Click Edit → Copy, then click Edit → Paste.
Change the name and properties of the new rule.
1. Highlight the rule, then select Edit → Modify.
2. Name the rule, then type the user name.
3. Select the Untrusted action type, then click OK.
Click the Rollout icon .
Set up the report:
1. On System Properties, click Reports → Add.
2. Fill in sections 1–3, and 6.
3. In section 4, select Report PDF or Report HTML
4. In section 5, select Compliance → SOX → Privileged User Audit Trails (Database).
5. Click Save.
To generate the report, click Run Now.