I need some help regarding the design of SIEM requirments. In regard to large databases, what general requirements do I need to provide in order to provide coverage related to DB security?
Some of the use-cases I can think of are:
- use of privilege roles / accounts DBA, sysadmin
- Unauthorized Access to certain views/tables
- Report on deletion/addition of certain db table entries against certain time-based policy (date/time: xx-xx-2012/xx:yy:zzzz)
- Sending alert based upon security tampering baseline policy?
- Able to logs data/entries effected by certain malicious change?
- Able to identify attributes of service/application that draws SQL statements.
Are these enough or do I add more?