About Database Firewall Policy Rules

Learn about types of Database Firewall policy rules.

The following are the Database Firewall rule types:

Policy Evaluation by Database Firewall Figure 1: Order of Evaluation of Rules

Description of image follows

Description of the illustration fwadm_vm_006a.png

Database Firewall is a multi stage engine that analyses and inspects SQL traffic to the database, extracts SQL statement from the traffic, and with a high precision determines whether to allow, alert, or block the SQL statement as specified in the policy. The SQL statement goes through different stages of analysis in the Database Firewall. This includes checks for originating IP address, database user name, OS user name, client program name, SQL statement category (DDL, DML, etc.), database tables, or views being accessed. This information can be used to determine whether the SQL statement can be allowed, requires raising an alert, or requires blocking.

Every stage has actions specified and checks carried out. In case there is a match, then the evaluation of the rule stops. Session Context rules are evaluated first. This is followed by SQL Statements and Database Object rules. In the last is the Default rule.

Note: Profiles for Database Object rule in Database Firewall policy are now supported.