Hello all,

please can anyone  tell me how can I configure my Guardium policy to not send mail notification for the SQL string starting with "begin" see the examples below

SQL String: begin :Result := SYS_CONTEXT (?, ?);end;
SQL String: begin dbms_output.get_lines(:lines,:num); end;
SQL String: begin dbms_output.get_lines(?,null); end;

Regards.

------------------------------
cherbani samir
------------------------------

Hi Cherbani,

I suppose you can use regular expression as below example:
^(?!begin)

In the rule --> SQL Criteria , select "Pattern", and set it = ^(?!begin). Hope it helps.


------------------------------
Jonathan LU
Security Support Engineer
IBM
------------------------------

Original Message:
Sent: Tue May 11, 2021 09:10 AM
From: cherbani samir
Subject: filter based on SQL string

Hello all,

please can anyone  tell me how can I configure my Guardium policy to not send mail notification for the SQL string starting with "begin" see the examples below

SQL String: begin :Result := SYS_CONTEXT (?, ?);end;
SQL String: begin dbms_output.get_lines(:lines,:num); end;
SQL String: begin dbms_output.get_lines(?,null); end;

Regards.

------------------------------
cherbani samir
------------------------------

Hi Jonathan,

Thank you very  much, your proposal solved the issue.

Regards.

------------------------------
cherbani samir
------------------------------

Original Message:
Sent: Sat May 15, 2021 09:04 AM
From: Jonathan LU
Subject: filter based on SQL string

Hi Cherbani,

I suppose you can use regular expression as below example:
^(?!begin)

In the rule --> SQL Criteria , select "Pattern", and set it = ^(?!begin). Hope it helps.


------------------------------
Jonathan LU
Security Support Engineer
IBM

Original Message:
Sent: Tue May 11, 2021 09:10 AM
From: cherbani samir
Subject: filter based on SQL string

Hello all,

please can anyone  tell me how can I configure my Guardium policy to not send mail notification for the SQL string starting with "begin" see the examples below

SQL String: begin :Result := SYS_CONTEXT (?, ?);end;
SQL String: begin dbms_output.get_lines(:lines,:num); end;
SQL String: begin dbms_output.get_lines(?,null); end;

Regards.

------------------------------
cherbani samir
------------------------------

Good to hear that. Thanks for the feedback.

------------------------------
Jonathan LU
Security Support Engineer
IBM
------------------------------

Original Message:
Sent: Tue May 18, 2021 10:43 AM
From: cherbani samir
Subject: filter based on SQL string

Hi Jonathan,

Thank you very  much, your proposal solved the issue.

Regards.

------------------------------
cherbani samir

Original Message:
Sent: Sat May 15, 2021 09:04 AM
From: Jonathan LU
Subject: filter based on SQL string

Hi Cherbani,

I suppose you can use regular expression as below example:
^(?!begin)

In the rule --> SQL Criteria , select "Pattern", and set it = ^(?!begin). Hope it helps.


------------------------------
Jonathan LU
Security Support Engineer
IBM

Original Message:
Sent: Tue May 11, 2021 09:10 AM
From: cherbani samir
Subject: filter based on SQL string

Hello all,

please can anyone  tell me how can I configure my Guardium policy to not send mail notification for the SQL string starting with "begin" see the examples below

SQL String: begin :Result := SYS_CONTEXT (?, ?);end;
SQL String: begin dbms_output.get_lines(:lines,:num); end;
SQL String: begin dbms_output.get_lines(?,null); end;

Regards.

------------------------------
cherbani samir
------------------------------