Data Security Center:Configure and enable audit alert rules

Prerequisites

The log auditing feature is enabled for data assets that require access to audit logs and support this feature. For more information, see Enable data auditing.

Background information

After enabling data auditing, DSC collects operation audit logs based on the selected audit mode. It then uses enabled audit alert rules to detect abnormal operations, data leaks, vulnerability exploits, SQL injection, and other threats in your data assets, and reports alert information.

Usage notes

• Built-in audit alert rules: Apply to data sources such as OSS, MaxCompute, RDS, and PolarDB. These rules are enabled by default and apply to supported asset types.

• Custom audit rules: Allow you to define rules based on multiple dimensions, such as sensitivity type of accessed content, sensitivity level, database, table, field, access source, and database instance. This provides flexible, fine-grained monitoring. Customize rules based on your application scenarios to precisely control database access information.

View built-in audit rules

Built-in audit rules fall into the following categories: database policies, OSS policies, and MaxCompute policies. Follow these steps to view rule types and details.

1. Log on to the Data Security Center console.

2. In the navigation pane on the left, choose Data Audit > Native Data Auditing.

3. On the Policy Management tab, click the Database Policy, OSS Policy, or MaxCompute Policy subtab. In the Rule classification list on the left, view audit rule types.

   Select the check box next to a rule to view its specific rules.

   Rule classifications include Abnormal Operation Rules, Data Leak Rules, Vulnerability Exploit Rules, and SQL Injection Rules. The rule list shows information such as Rule Name, Rule Type, Risk Level, Status, and Hit Count. You can filter by Asset Type or Risk Level, or search by rule name.

4. In the rule list on the right, view details such as Rule Name, Rule Type, Risk Level, Status, and Hits.

5. Click Details in the Actions column of a rule to view the supported Asset Type and Details.

   The basic information section of the details panel includes fields such as Rule Name, Rule Source, Compliance Type, Risk Level, Asset Type, Status, and Hit Count. The details section includes content such as Remediation Recommendations.

Add a custom audit rule

If built-in audit rules do not meet your needs, you can create a custom audit rule. After you create a custom audit rule, it is enabled by default.

1. On the Custom Policy tab, click Add Rule.

2. In the Add Rule panel, configure the audit rule and click Submit.

   Configuration Item	Description
   Basic Information	Rule Name: Enter a meaningful name to help identify the rule. Rule Type: Select a rule type from the drop-down list. Options include the following: SQL injection attempt exploitation, SQL injection attempt bypass, stored procedure abuse, buffer overflow, error-based SQL injection, Boolean-based SQL injection, time-based SQL injection, denial-of-service vulnerability, database probing, database dump attack, covert channel attack, application account risky operation, O&M engineer risky operation, abnormal statement, high-volume response, configuration operation, sensitive data audit, UNION-based SQL injection, and others. Risk Level: Select High, Medium, or Low from the drop-down list. Asset Type: Select the asset type to which the rule applies. Important Ensure the selected Rule Type supports the chosen Asset Type. Otherwise, the custom audit rule will not take effect. Rule Description: Enter a description for the audit rule.
   Sensitive Data Model	When Asset Type is RDS, PolarDB, or Self-Managed Database, you can configure sensitive data identification templates and models.
   Asset	Select the specific asset object to which the rule applies, based on the selected asset type.
   Client	Configure client conditions under which the rule applies, based on the selected asset type.
   Behavior	Configure the operation types and status code conditions that trigger the rule.
   Result	Configure result conditions under which the rule applies, based on the selected asset type. This configuration item is not supported when Asset Type is Redis.

Enable or disable audit alert rules

If you do not need to use a specific built-in rule or an enabled custom audit rule, you can turn off the audit alert rule Status toggle. To reuse the specified audit alert rule, you can turn on the audit alert rule Status toggle.

1. On the Policy Management tab, click the Database Policy, OSS Policy, MaxCompute Policy, or Custom Policy subtab.

2. In the rule list, find the target rule and click the toggle in the Status column.

Configure alert notifications

To receive audit alerts promptly, in the navigation pane on the left, choose System Settings > Alert Notification. On the Alert Notification tab, add an alert notification configuration. For details, see Configure email, text message, and phone call alert notifications.

What to do next

After you enable audit alert rules, DSC reports behaviors that match the rule conditions to the audit alerts of DSC. You can analyze and handle the associated risks based on the alert information and audit logs. For more information, see View and handle audit alerts.

References

DSC provides a system whitelist feature that lets you add trusted accounts and IP addresses from your data assets to a whitelist. DSC does not generate audit alerts for risky behaviors from whitelisted accounts or IP addresses, helping reduce false positives. For details, see Manage whitelists.