Audit Guide

DataSunrise Centralized Console Overview DataSunrise Rules Best Practices Lua script discovers sensitive data in JSON files Security Guide Security Rules Against SQL Injections Audit Guide Learning Rules and Audit Rules Priority

Data auditing enables real-time database activity monitoring by logging detailed information about every database query, including read, update, and delete operations. It also records user activity as well as modifications to database configurations and system settings. This guide describes how to configure DataSunrise to audit all queries executed against a specified target database.

DataSunrise database security proxy architecture — DataSunrise Database Security operates in proxy mode, providing secure database access through dedicated proxy ports. The solution features an AI-assisted web console for intuitive management.

Audit logs are stored either in the DataSunrise-integrated SQLite database or in an external database. This logged data helps organizations meet requirements from regulatory standards such as SOX, HIPAA, PCI DSS, and other applicable regulations.

Data Audit functionality operates in both Sniffer and Proxy deployment modes. Within the Data Audit section, administrators can configure audit rules to monitor database activity and apply filters based on database users, client IP addresses, or application sources.

To enhance your understanding of data auditing, we highly recommend visiting our YouTube channel to watch our videos on this topic. These videos not only showcase our auditing solution but also familiarize you with alternative data auditing methods using native DBMS features.

The Importance of Database Auditing

Database auditing is essential for detecting unauthorized access, monitoring administrative operations, and preserving a detailed record of activity involving sensitive data. For organizations subject to regulations such as GDPR, SOX, HIPAA, and PCI DSS, maintaining comprehensive visibility into database access and user activity is a key compliance requirement.

With comprehensive auditing policies provided by platforms such as DataSunrise, security teams can identify suspicious activity more quickly, investigate incidents more efficiently, and generate audit evidence required for regulatory assessments. Without effective auditing mechanisms, unauthorized actions, policy violations, and insider threats can go unnoticed, increasing the likelihood of financial losses and reputational damage.

What is DataSunrise Data Audit?

DataSunrise Data Audit is a central platform capability that gives organizations detailed visibility into database activity and user actions. Using proxy or sniffer deployment modes, it monitors database traffic continuously and records SQL queries, data modifications, authentication events, and connection attempts in real time.

These features help organizations apply least-privilege principles, supervise privileged users, and meet compliance requirements under regulations such as HIPAA, SOX, and PCI DSS. Built-in filtering, reporting, and alerting tools also support incident investigations, forensic reviews, and continuous compliance monitoring.

Creating an Audit Rule

Let’s assume that you’ve already created the target database profile. Then to audit our test database, it is necessary to create and configure an Audit Rule. In this case, the sequence of actions is the following:

Navigate to Audit → Rules. Then click Add Rule to create a new Audit Rule.
Configure your Audit Rule to log all queries to the database (see notes below).

Database audit rule general settings — Configure audit rule settings with a custom name while the database type is automatically determined based on the selected instance.

In the Main section subsection, the target database information is specified. It includes database type (PostgreSQL), database instance (as the target database entry is named in the Configurations) and the Rule’s logical name.

Audit rule action settings — The ‘Save Event in Audit Storage’ option enables event logging and can be toggled to pause logging while keeping the rule active.

By default, the “Audit” action is selected. It means that DataSunrise will audit user queries when the rule is triggered. To log database responses (the output), the Log Data checkbox is checked.

Since the current scenario requires all user queries to be audited, Filter Sessions are left as by default. Thus, any query to the database regardless of its source IP address will trigger the rule.

Audit rule filter settings — Specify database objects to audit using filter statements. In this case it’s left empty to capture all queries.

Filter Statements settings are as by default as well. Thus, DataSunrise will audit all queries directed to all database objects.

Viewing Database Audit Results

This stage includes demonstration of auditing results. The Audit Rule which was created at the previous stage is configured to be triggered by any incoming user query. Here’s what happens when DataSunrise receives a user query.

Let’s send the following query via PGAdmin:

SELECT * FROM public.customers;

The database outputs the table contents:

Now let’s check the auditing results in the DataSunrise’s Web Console. Navigate to the Data Audit → Transactional Trails subsection.
To view detailed information about some event, click event’s ID. In a new tab, the event’s details will be displayed: code of the query, basic information, session information, database objects involved in the query and the query results.

Each event logs comprehensive metadata including IP addresses, application names, timestamps, and execution details.

Database audit event details showing transaction information — Transaction trails contain clickable events, with detailed information available for each event.

Scrolling down reveals additional event details, including the complete SQL query statement and database objects the query touches. The query accessed sensitive data fields including credit card numbers, email addresses, and ZIP codes.

Database audit event query details — Detailed SQL query view showing the executed transaction statement.

Query results can be displayed, but enabling this feature significantly impacts audit database storage consumption.

Database query results view — Query results are displayed below the event when result logging is enabled.

Real-World Use Cases: Applying DataSunrise Data Audit

The DataSunrise Data Audit engine isn’t just a logging tool—it’s a compliance enabler and incident response ally. Here’s how organizations use it to meet regulatory and operational requirements in live environments:

Use Case	How DataSunrise Helps
SOX Compliance	Tracks privileged user activity on financial systems and logs changes to critical configurations. Supports external audit reviews with detailed transaction histories.
HIPAA Monitoring	Audits all queries involving PHI, including read access to medical records. Captures session metadata for accountability and breach investigation.
PCI DSS Enforcement	Monitors credit card data access in real time and logs queries that touch PAN fields. Supports alerting on unauthorized access attempts.
Data Exfiltration Detection	Flags suspicious query volumes, DUMP statements, and unapproved exports—especially from new IPs or clients.
Insider Threat Visibility	Captures admin actions, schema modifications, and unusual object access—all correlated with user identities and timestamps.

Because DataSunrise works at the proxy layer, it can enforce auditing even when the database’s native logging is disabled or bypassed. This makes it an essential part of modern data security and governance strategies.

Conclusion

Database auditing plays a vital role in protecting sensitive information by giving organizations the visibility required to oversee database activity, detect suspicious actions, and comply with regulatory obligations. Without detailed audit trails, organizations may struggle to determine who accessed confidential data, what operations were performed, and whether security policies were consistently enforced. A comprehensive auditing strategy enhances transparency, reinforces accountability, and supports faster, more effective security investigations.

DataSunrise supports these objectives through centralized auditing of database sessions, SQL activity, user actions, and transactions. Leveraging proxy-based monitoring, flexible policy configuration, and comprehensive session analysis, the platform provides detailed visibility into how sensitive data is accessed, updated, and used across diverse database environments.

Centralizing audit information within a single platform enables organizations to accelerate incident response, simplify compliance reporting, and detect unauthorized access or abnormal activity more efficiently. Security teams can review user activity, examine audit events, investigate suspicious behavior, and produce compliance evidence for regulations such as SOX, HIPAA, PCI DSS, and GDPR without relying solely on native database auditing capabilities.

Whether securing a small number of mission-critical databases or managing large-scale hybrid and multi-cloud infrastructures, DataSunrise delivers the centralized visibility, scalability, and management capabilities required for effective database auditing. Continuous monitoring, policy-based controls, and detailed audit reporting help organizations strengthen governance, reduce security risks, and improve the protection of sensitive information.