Databases often contain some of an organisation’s most sensitive information, from customer records and financial data to intellectual property and operational systems. Yet database activity can be difficult to monitor consistently, particularly across hybrid estates combining on-premises databases, cloud platforms and third-party services.
Database activity monitoring software helps security teams understand who is accessing sensitive information, what actions they are taking and whether that behaviour appears legitimate.
The strongest platforms go beyond simple log collection. They can identify unusual queries, monitor privileged users, generate alerts, maintain tamper-resistant audit trails and feed security events into wider SOC and SIEM workflows.
For buyers, the challenge is determining how much visibility is required, how alerts will be investigated and whether the platform can support both security monitoring and compliance requirements without overwhelming analysts.
This guide explains the main capabilities security teams should compare when evaluating database activity monitoring software.
At a Glance: Database Activity Monitoring
| Capability | What Security Teams Should Compare |
|---|---|
| Activity monitoring | User, application and administrator activity |
| Privileged access | Visibility over elevated and administrative actions |
| Alerts | Real-time detection of suspicious behaviour |
| Audit trails | Searchable and protected records of database activity |
| Coverage | On-premises, cloud, managed and hybrid databases |
| Analytics | Behaviour baselines and anomaly detection |
| Compliance | Reporting and evidence for audits |
| Integrations | SIEM, SOC, IAM, PAM and ticketing platforms |
| Performance | Monitoring overhead and deployment architecture |
| Retention | Log storage, protection and availability |
What Is Database Activity Monitoring?
Database activity monitoring is the process of observing and analysing interactions with databases to identify suspicious, inappropriate or unauthorised activity.
A monitoring platform may record information such as:
- User identity
- Login attempts
- Source device or IP address
- Database accessed
- Query executed
- Records viewed
- Data changed
- Permissions modified
- Administrative commands
- Failed access attempts
This creates visibility into activity that may otherwise be difficult to detect through network or endpoint monitoring alone.
The National Cyber Security Centre (NCSC) describes logging as the foundation of security monitoring and recommends that organisations collect logs that allow them to understand, trace and respond to security events.
NCSC – Logging and Monitoring – https://www.ncsc.gov.uk/collection/10-steps/logging-and-monitoring
Database Activity Monitoring Software
Database activity monitoring software typically collects and analyses database events continuously.
Depending on the platform, monitoring can be delivered through:
- Database agents
- Network monitoring
- Native database logs
- Cloud APIs
- Audit integrations
- Hybrid approaches
The platform may then apply policies or analytics to identify suspicious activity.
For example:
Normal activity:
A finance application runs its usual reporting queries during business hours.
Potential anomaly:
A privileged account suddenly exports a large quantity of customer information late at night.
The second activity may be legitimate, but it warrants investigation because it differs from established behaviour.
Security Insight
The value of DAM is not simply that it records more information. The value is helping security teams identify which database activity is unusual enough to require attention.
DAM Monitoring
DAM monitoring should provide security teams with visibility over both ordinary users and privileged accounts.
Privileged activity deserves particular scrutiny because administrators may have the ability to:
- Read sensitive information
- Change permissions
- Create accounts
- Alter database structures
- Disable controls
- Delete records
- Modify audit settings
The NCSC specifically recommends monitoring administrative activity because misuse of privileged accounts can have serious consequences. It advises organisations to collect enough information to establish who carried out an action, when, from where and what the action did.
NCSC – Log and Audit Administration Activities – https://www.ncsc.gov.uk/collection/secure-system-administration/log-and-audit-administration-activities
DAM platforms may also integrate with Privileged Access Management (PAM) systems so that database activity can be linked to individual administrative sessions.
Monitor Actual and Attempted Data Access
Security teams should be interested in failed access as well as successful activity.
Repeated attempts to access information may indicate:
- Privilege escalation
- Compromised credentials
- Misconfigured applications
- Insider activity
- Automated attacks
The NCSC recommends that organisations handling sensitive personal information maintain persistent records of actual and attempted access and monitor those records for inappropriate or unusual behaviour.
NCSC – Monitoring Access to Sensitive Personal Information – https://www.ncsc.gov.uk/collection/security-principles-protecting-most-sensitive-personal-information-in-datasets/principle-3-ensure-you-know-who-is-accessing-data-which-contains-spi
This makes database monitoring particularly relevant where systems contain high-value or regulated information.
Database Activity Monitoring Solutions
Different database activity monitoring solutions provide varying levels of coverage.
Buyers should establish which database technologies are supported.
These might include:
- Microsoft SQL Server
- Oracle
- PostgreSQL
- MySQL
- MongoDB
- Cloud-native databases
- Managed database services
- Data warehouses
Hybrid organisations should pay particular attention to consistency.
A platform providing excellent visibility over traditional on-premises databases may offer less detail for a cloud-managed service, while cloud-native tools may provide limited coverage for legacy environments.
The buyer should therefore map the entire database estate before evaluating suppliers.
Alerts and Suspicious Behaviour
Real-time alerting is one of the main differences between monitoring and simple audit logging.
Potential alert scenarios include:
- Unusual login locations
- Excessive failed logins
- Large data exports
- Access outside normal hours
- Privileged account use
- Permission changes
- Suspicious queries
- Access to unusually sensitive tables
- Attempts to disable auditing
The NCSC advises organisations to use logs to create detection alerts based on relevant threats and expected system behaviour.
NCSC – Logging and Monitoring – https://www.ncsc.gov.uk/collection/10-steps/logging-and-monitoring
Buyer Tip
Ask suppliers to demonstrate what a real alert looks like.
A platform that generates thousands of low-value notifications may create more work than value. The best systems provide enough context for analysts to decide quickly whether an event requires investigation.
Audit Trails
A strong audit trail helps organisations answer fundamental incident-response questions:
- Who accessed the database?
- When did it happen?
- Which records were affected?
- What action was performed?
- Where did the request originate?
- Were permissions changed?
The NCSC says logging should help organisations understand what happened during an incident, determine its impact and assess whether remediation has worked.
NCSC – Introduction to Logging for Security Purposes – https://www.ncsc.gov.uk/guidance/introduction-logging-security-purposes
Audit records should also be protected from tampering.
If an attacker can modify the logs after accessing a database, investigators may lose the evidence required to understand the incident.
Protect the Monitoring Data
Database activity logs may themselves contain sensitive information.
Security teams should therefore consider:
- Encryption
- Access permissions
- Log integrity
- Retention
- Backup
- Segregation
- Administrative access
The NCSC recommends protecting logs from modification and ensuring they remain available long enough to support investigations. For important logs, it recommends considering retention of at least six months because incidents may not be detected immediately.
NCSC – Logging and Monitoring – https://www.ncsc.gov.uk/collection/10-steps/logging-and-monitoring
Retention requirements should ultimately reflect the organisation’s risk profile, regulatory obligations and storage strategy.
Database Activity Monitoring Tools and SIEM
Database activity monitoring tools should normally complement rather than replace broader security monitoring.
Many organisations integrate DAM with:
- SIEM
- Security Operations Centres
- Privileged Access Management
- Identity and Access Management
- SOAR
- Ticketing platforms
- Cloud security tools
This allows database activity to be correlated with other events.
For example:
IAM: User account compromised
Endpoint: Suspicious process detected
DAM: Large database export initiated
When analysed together, those signals provide a much stronger indication of compromise than any one event in isolation.
The NCSC recommends centralised analysis where appropriate so security teams can compare logs across multiple systems.
NCSC – Logging and Monitoring – https://www.ncsc.gov.uk/collection/10-steps/logging-and-monitoring
Database Activity Monitoring Products and Cloud Databases
Modern database activity monitoring products increasingly need to operate across cloud environments.
Cloud database services can change the monitoring model because organisations may not control the underlying infrastructure.
Buyers should establish:
- Which cloud services are supported
- Which audit data is available
- How information is collected
- How quickly alerts are generated
- Where logs are stored
- Who controls retention
The NCSC’s Cloud Security Principles state that cloud providers should provide customers with sufficient audit information and alerts to identify and investigate inappropriate or malicious activity.
NCSC – Cloud Security Principle 13: Audit Information and Alerting – https://www.ncsc.gov.uk/collection/cloud/the-cloud-security-principles/principle-13-audit-information-and-alerting-for-customers
Compliance Reporting
Database monitoring can also support compliance and audit processes.
Depending on the organisation and sector, teams may need evidence showing:
- Who accessed sensitive information
- Whether privileged activity is monitored
- How long logs are retained
- Whether unusual behaviour generates alerts
- How incidents are investigated
DAM software can simplify this by creating predefined and custom reports.
However, buyers should avoid assuming that purchasing a monitoring platform automatically creates compliance.
Technology provides evidence and controls; organisational policies and processes still determine whether those controls are effective.
Database Activity Monitoring Best Practices
Effective database activity monitoring best practices begin with risk rather than technology.
Identify critical databases
Not every database requires identical monitoring.
Prioritise systems containing:
- Personal data
- Financial information
- Authentication data
- Intellectual property
- Critical operational records
Understand normal behaviour
Security teams need a baseline before anomalies can be identified reliably.
Monitor privileged accounts
Administrative access should receive particular attention.
Create meaningful alerts
Tune detection rules around realistic threats rather than collecting notifications indiscriminately.
Protect audit logs
Logs should be difficult for attackers or administrators to modify without detection.
Integrate with the SOC
Database events should feed into wider investigation workflows.
Review monitoring regularly
New databases, applications and user roles can create gaps over time.
The NCSC recommends using risk assessment and threat modelling to determine which administration activities need monitoring and which data needs to be collected.
NCSC – Log and Audit Administration Activities – https://www.ncsc.gov.uk/collection/secure-system-administration/log-and-audit-administration-activities
Managing False Positives
Automated detection inevitably produces some false positives.
For example, an administrator may legitimately:
- Run a large export
- Access a system overnight
- Change permissions
- Perform unusual maintenance
Security teams need enough context to distinguish legitimate exceptions from suspicious activity.
Useful capabilities include:
- Behaviour baselines
- Risk scoring
- Approved maintenance windows
- User context
- Asset sensitivity
- Alert suppression
The NCSC notes that automated monitoring rules can generate both false positives and false negatives unless they are continually developed and tuned.
NCSC – Log and Audit Administration Activities – https://www.ncsc.gov.uk/collection/secure-system-administration/log-and-audit-administration-activities
Think Analyst Efficiency
A database monitoring platform should reduce investigative effort, not simply increase alert volume.
Ask suppliers how the system helps analysts prioritise events and understand why an alert was generated.
Deployment and Performance
Database monitoring should not create unacceptable application performance issues.
Buyers should compare:
- Agent-based versus agentless monitoring
- Network requirements
- Database overhead
- Cloud architecture
- High-availability design
- Failover
- Update processes
The monitoring architecture should also remain operational if a database becomes unavailable.
Otherwise the organisation could lose useful forensic information at exactly the point it is most needed.
What Should Buyers Compare?
Coverage
Which database technologies and cloud services are supported?
Visibility
Can activity be linked to specific users and applications?
Privileged access
How are administrator actions monitored?
Alerts
How quickly is suspicious behaviour identified?
Analytics
Does the platform identify anomalies or simply apply static rules?
Audit
Are logs searchable, protected and exportable?
Compliance
Which reporting templates and evidence are available?
Integration
Can events feed into existing SIEM, SOC and PAM workflows?
Performance
What overhead does monitoring introduce?
Retention
How long can audit information be stored and how is it protected?
Questions to Ask Potential Suppliers
- Which database platforms do you support?
- Can you monitor both cloud and on-premises databases?
- How is activity collected?
- What performance overhead should we expect?
- Can privileged administrator activity be monitored separately?
- Which suspicious behaviours can generate real-time alerts?
- How are false positives managed?
- Can alerts be customised by database sensitivity?
- How are audit logs protected from tampering?
- What retention options are available?
- Can events integrate with our SIEM?
- Do you integrate with Privileged Access Management platforms?
- Which compliance reports are included?
- How is cloud database monitoring different from on-premises monitoring?
- What happens if the monitoring platform becomes unavailable?
Frequently Asked Questions
What is database activity monitoring?
Database activity monitoring records and analyses interactions with databases to help identify suspicious or unauthorised access.
What does database activity monitoring software do?
It may monitor queries, logins, changes, privileged activity and data access while generating alerts and audit trails.
What is DAM monitoring?
DAM is a common abbreviation for database activity monitoring.
Can DAM replace a SIEM?
Usually not. DAM provides detailed database visibility, while SIEM correlates security information from many systems. The two commonly work together.
Does database monitoring support compliance?
It can provide audit trails and reporting that support compliance activities, but technology alone does not guarantee compliance.
Should privileged database users be monitored?
Yes. Administrator accounts often have extensive access to sensitive data and system controls, making their activity particularly important to audit.
Related Reading
Continue exploring security monitoring with these articles from IT Briefing:
- Improve Your Security Know-How with City Security Magazine – https://cybersecureforum.co.uk/briefing/improve-your-security-know-how-with-city-security-magazine/
- AI Threat Detection Tools: What Cyber Teams Should Compare – https://cybersecureforum.co.uk/briefing/ai-threat-detection-tools-what-cyber-teams-should-compare/
Product Guide
Senior IT and cybersecurity professionals attending the Elevate Tech Summit can meet specialist providers supporting security monitoring, infrastructure, access management and managed security operations.
Featured Supplier
Spherica Group
UK managed IT and cybersecurity provider offering Security Operations Management, 24/7 security monitoring, threat detection, incident response and identity and access management services. Its wider managed infrastructure offering includes monitoring, alerting, reporting and automation across modern IT environments.
Website: www.spherica.co.uk
Explore Database Activity Monitoring Software
Databases can hold some of an organisation’s most valuable information, but protecting them requires visibility into what users and applications are actually doing.
Effective database activity monitoring gives security teams a stronger audit trail, greater insight into privileged access and earlier warning of behaviour that may indicate compromise or misuse.
The Elevate Tech Summit connects senior IT, data and cybersecurity professionals with carefully selected technology and service providers through a programme of pre-arranged one-to-one meetings.
Explore database activity monitoring software, compare specialist suppliers and discover technologies that can strengthen visibility across sensitive data environments.
Sources
- National Cyber Security Centre – Logging and Monitoring – https://www.ncsc.gov.uk/collection/10-steps/logging-and-monitoring
- National Cyber Security Centre – Introduction to Logging for Security Purposes – https://www.ncsc.gov.uk/guidance/introduction-logging-security-purposes
- National Cyber Security Centre – Log and Audit Administration Activities – https://www.ncsc.gov.uk/collection/secure-system-administration/log-and-audit-administration-activities
- National Cyber Security Centre – Cloud Security Principle 13: Audit Information and Alerting – https://www.ncsc.gov.uk/collection/cloud/the-cloud-security-principles/principle-13-audit-information-and-alerting-for-customers
- National Cyber Security Centre – Monitoring Access to Sensitive Personal Information – https://www.ncsc.gov.uk/collection/security-principles-protecting-most-sensitive-personal-information-in-datasets/principle-3-ensure-you-know-who-is-accessing-data-which-contains-spi
Image credit: https://unsplash.com/photos/black-flat-screen-computer-monitor-E6loQeZDIiM
