Database Firewall Policy for Capturing Return Row Count
Learn to capture return number of rows for SELECT queries.
When a Database Firewall is deployed in a Monitoring/Blocking (Proxy) or Monitoring (Host Monitor) deployment mode, it can capture the returned number of rows for SELECT SQL statements. If deployed in Monitoring/Blocking (Proxy) mode this requires no additional configuration, but if deployed in Monitoring (Host Monitor) mode, you need to enable it to capture database responses. See Enabling Database Response Monitoring in the Oracle DBSecCentral Administrator’s Guide for more information. The details for the returned number of rows are displayed in All Activity and Database Firewall Reports under the column Row Count. This field can be used in Alert policies to detect attempts to retrieve more than expected amount of data.
The field Capture number of rows returned for SELECT queries is available in the Oracle Database Security Central console when defining the Database Object rule of the Database Firewall policy. It is available when the target type is an Oracle Database and when Select is selected in the Statement Classes field. When this option is enabled, the Database Firewall captures the returned number of rows for SELECT queries.
| Step | Process | Reference |
|---|---|---|
| 1 | Configuring Database Firewall policy to capture return row count | Database Object Rule |
| 2 | Configuring alert policy based on row count | Writing an Alert Condition |
| 3 | Viewing row count in reports |