Tencent Cloud

Modifying Rule Template

Last updated: 2024-08-16 11:06:28

﻿This document describes how to modify a database audit rule template in the console.
Note：
Starting from September 202325, the relationship between rule templates and audit instances has transitioned from initialization to strong association. Alterations to the rule template content will synchronously impact the audit rules applied to the instances bound to the said rule template.
A rule template allows up to 5 characteristic strings for a single parameter field, with each string being separated by vertical bar "|".
Directions
1. Log in to the TencentDB for MySQL console.
2. On the left sidebar, click Database Audit.
3. Select Region and click Rule Template.
4. Find the target rule template in the rule template list, or search for it by resource attribute in the search box, and click Edit in the Operation column.
﻿
5. In the Edit Rule Template window, modify configuration items and click OK.
﻿
Parameter
Description
Rule Template Name
This field can contain up to 30 letters, digits, and symbols -_./()[]（）+=：:@ and cannot start with a digit.
Rule Content
Specify the rule content, including parameters, matching types, and feature strings. For detailed descriptions and examples, see Rule Content Details and Examples .
Note:
You can click 'Add' under Rule Content to include additional parameter fields.
You can click 'Delete' in the action column under Rule Content to remove unnecessary parameter fields and conditions, although at least one parameter field and condition must remain.
Risk Level
Choose a risk level for this rule template. Options include Low Risk, Medium Risk, and High Risk.
Alarm Policy
Choose an alarm policy for this rule template. Options include 'Do Not Send Alarms' and 'Send Alarms'.
Note:
Please go to TCOP->Alarm Management  to set alarm rules and notifications. For detailed information, refer to Post-Event Alarm Configuration.
Rule Template Remarks
This field can contain up to 200 letters, digits, and symbols-_./()[]（）+=：:@ and cannot start with a digit.
Rule content details and examples
Note:
You can configure one or multiple rules. Up to 5 rules can be configured.
Different rules are in AND relationship; that is, they need to be met at the same time.
Different characteristic strings in a rule are in OR relationship; that is, at least one of them needs to be met.
You can add only one operator for the same parameter field; for example, for the database name, the operator can be either Include or Exclude.
Parameter Field
Operator
Characteristic String
Client IP
Include, Exclude, Equal to, Not equal to, Regex
Up to five client IPs can be configured and should be separated by vertical bar "|". When the operator is Regex, only one characteristic string can be entered.
User Account
Include, Exclude, Equal to, Not equal to, Regex
Up to 5 user accounts can be configured, separated by English vertical bars. When the match type is regular expression, only one feature string is supported.
Database Name
Include, Exclude, Equal to, Not equal to, Regex
Up to five database names can be configured and should be separated by vertical bar "|". When the operator is Regex, only one characteristic string can be entered.
SQL Details
Include, Exclude
Up to five SQL commands can be configured and should be separated by vertical bar "|". 
SQL Type
Equal to, Not equal to
Up to five SQL types can be selected. Valid options: ALTER, CHANGEUSER, CREATE, DELETE, DROP, EXECUTE, INSERT, LOGIN, LOGOUT, OTHER, REPLACE, SELECT, SET, UPDATE.
Affected Rows
Greater than, Less than
Select affected rows.
Returned Rows
Greater than, Less than
Select returned rows.
Scanned Rows
Greater than, Less than
Select scanned rows.
Execution Time
Greater than, Less than
Select execution time, with the unit being millisecond.           
Example: If the following rule content is set, the database name should include a, b, or c, and the client IP should include IP1, 2 or 3, then the audit logs filtered by the rule are those where the database name includes a, b, or c and the client IP includes IP1, 2, or 3.

tencent cloud

Recent Pages

Modifying Rule Template

Directions

Rule content details and examples

Was this page helpful?

Was this page helpful?

Parameter	Description
Rule Template Name	This field can contain up to 30 letters, digits, and symbols -_./()[]（）+=：:@ and cannot start with a digit.
Rule Content	Specify the rule content, including parameters, matching types, and feature strings. For detailed descriptions and examples, see Rule Content Details and Examples . Note: You can click 'Add' under Rule Content to include additional parameter fields. You can click 'Delete' in the action column under Rule Content to remove unnecessary parameter fields and conditions, although at least one parameter field and condition must remain.
Risk Level	Choose a risk level for this rule template. Options include Low Risk, Medium Risk, and High Risk.
Alarm Policy	Choose an alarm policy for this rule template. Options include 'Do Not Send Alarms' and 'Send Alarms'. Note: Please go to TCOP->Alarm Management to set alarm rules and notifications. For detailed information, refer to Post-Event Alarm Configuration.
Rule Template Remarks	This field can contain up to 200 letters, digits, and symbols-_./()[]（）+=：:@ and cannot start with a digit.

Parameter Field	Operator	Characteristic String
Client IP	Include, Exclude, Equal to, Not equal to, Regex	Up to five client IPs can be configured and should be separated by vertical bar "\|". When the operator is Regex, only one characteristic string can be entered.
User Account	Include, Exclude, Equal to, Not equal to, Regex	Up to 5 user accounts can be configured, separated by English vertical bars. When the match type is regular expression, only one feature string is supported.
Database Name	Include, Exclude, Equal to, Not equal to, Regex	Up to five database names can be configured and should be separated by vertical bar "\|". When the operator is Regex, only one characteristic string can be entered.
SQL Details	Include, Exclude	Up to five SQL commands can be configured and should be separated by vertical bar "\|".
SQL Type	Equal to, Not equal to	Up to five SQL types can be selected. Valid options: ALTER, CHANGEUSER, CREATE, DELETE, DROP, EXECUTE, INSERT, LOGIN, LOGOUT, OTHER, REPLACE, SELECT, SET, UPDATE.
Affected Rows	Greater than, Less than	Select affected rows.
Returned Rows	Greater than, Less than	Select returned rows.
Scanned Rows	Greater than, Less than	Select scanned rows.
Execution Time	Greater than, Less than	Select execution time, with the unit being millisecond.

tencent cloud

Sign Up

Log in

Recent Pages

Modifying Rule Template

Directions

Rule content details and examples

Was this page helpful?

Was this page helpful?