There is a scenario to detect and warn when someone executes the INSERT command multiple times (eg 10 times in 5 minutes). If someone enters multiple INSERT commands, the Guardium alerts well. However, if they use SCRIPT to run a group of INSERT commands in a single pass, does Guardium will be able to detect it? Does Guardium counts this as one command execution in fact they ran a lot of INSERT commands inside SCRIPT. Is there any way that can help alert the case of policy avoidance like above?

Thanks
Anbu S V

------------------------------
S V Anbu Security Consultant
------------------------------

Anbu,

If the script is a stored procedure the answer is no, Guardium does not audit the SQL commands in stored procedures, but if the script is a batch that run like a client the answer is yes.

you can contact me directly for any other Guardium question you have at nati@pelican-tech.com or www.linkedin.com/in/nati-shapira-8726aab/

------------------------------
Nati Shapira
------------------------------

Original Message:
Sent: Fri October 14, 2022 03:20 AM
From: S V Anbu
Subject: Alert on multiple DML commands when using script

There is a scenario to detect and warn when someone executes the INSERT command multiple times (eg 10 times in 5 minutes). If someone enters multiple INSERT commands, the Guardium alerts well. However, if they use SCRIPT to run a group of INSERT commands in a single pass, does Guardium will be able to detect it? Does Guardium counts this as one command execution in fact they ran a lot of INSERT commands inside SCRIPT. Is there any way that can help alert the case of policy avoidance like above?

Thanks
Anbu S V

------------------------------
S V Anbu Security Consultant
------------------------------