IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Alert for specific query and specific field

    Posted Fri November 18, 2022 12:17 AM
    Hi Team,

    Do we have an option for creating alert for particular Query?

    Is that possible to create an alert for the particular value in field?

    Sample Query:

    update tbaadm.gam set del_flg='N' where foracid='0015020315550001' - Need an alert

    update tbaadm.gam set del_flg='N' where foracid='1111111111111111' - not Need an alert

    Object: tbaadm.gam
    Field: foracid

    Thanks,
    Panendar Rao.C


    ------------------------------
    PHANENDRA RAO CHAVANA
    ------------------------------


  • 2.  RE: Alert for specific query and specific field

    Posted Tue November 29, 2022 12:35 AM
    Hi All,

    Any update on below request?

    Thanks,
    Panendar Rao.C

    ------------------------------
    PHANENDRA RAO CHAVANA
    ------------------------------

    Original Message


  • 3.  RE: Alert for specific query and specific field

    Posted Tue November 29, 2022 08:19 AM
    Try using the SQL criteria of
    - Command = update
    - Field = del_flg
    - Pattern = 'N'
    - Field = foracid
    - Pattern = '0015020315550001'

    This is untested and imprecise but limits what is matched
    Original Message


  • 4.  RE: Alert for specific query and specific field

    Posted Tue November 29, 2022 09:48 AM
    Hi @PHANENDRA RAO CHAVANA,

    You could explore a session level policy using the ​Statement criteria. That way you could potentially avoid log full details in your data security policy.

    https://www.ibm.com/docs/en/guardium/11.4?topic=policies-session-level-advanced-session-level-guide

    https://www.ibm.com/docs/en/guardium/11.4?topic=guide-criteria
    • Statement (STATEMENT)

      Use with wildcards to search the SQL statement.



    ------------------------------
    Wendy
    Converge Technology Solutions
    Formerly Information Insights
    ------------------------------

    Original Message