Try with actions: S-GATE ATTTACH, S-GATE TERMINATE, and ALERT PER MATCH (so you know when the rule triggers).
The firewall STAP parameters also determine how it responds. firewall_fail_close=0, for example, will allow some occurrence's to go through until a verdict is made, verses firewall_fail_close=1 where the block will occur until the verdict is made. firewall_fail_close=1 is less common because latency is introduced. You can tune the latency with the firewall_timeout parameter, but I think that could get tricky with a records affected condition.
------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.comNeed help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.
------------------------------
Original Message:
Sent: Wed May 21, 2025 09:16 PM
From: Duc Tran Anh
Subject: Configure the limit of records returned in a single query statement
Hi Wendy,
Thank you for your attention.
I set a policy with the action 'quarantine' using Reset interval = 1, Severity = Info, Quarantine for = 1, and Records affected threshold = 100/query, and Guardium successfully works and quarantines the session. However, with the same rule, when I change the action to 'S-TAP Terminate' or 'S-GATE Terminate', it only logs a warning when the condition is matched, but the session is not terminated.
------------------------------
Duc Tran Anh
Original Message:
Sent: Wed May 21, 2025 03:09 PM
From: Wendy Zemba
Subject: Configure the limit of records returned in a single query statement
Hi Duc Tran Anh,
It would be helpful to share your policy rule, but you mentioned the action is set to terminate. Are you using S-TAP TERMINATE or S-GATE TERMINATE? If S-GATE, is S-GATE ATTACH also part of the rule actions?
------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.com
Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.
Original Message:
Sent: Tue May 20, 2025 09:35 AM
From: Duc Tran Anh
Subject: Configure the limit of records returned in a single query statement
Wishing a great day to the experts and engineers at IBM.
I am currently using Guardium with the GIM and STAP agents installed on the DB server, and the firewall mode is enabled.
Policies designed to block specific commands or access to sensitive tables are successfully being terminated. However, I need to configure a policy that blocks queries based on the number of records retrieved per query, according to our company's policy - but this is not working as expected.
(I have already enabled the 'Log Records Affected' option in the inspection engine on the Collector.)
The attached screenshot shows the configuration for limiting 100 records per query with the action set to terminate, but when using a SELECT * ... LIMIT 100 query, it is not being blocked.
Thanks for all your help
------------------------------
Duc Tran Anh
------------------------------