SWOT DAM · Database activity monitoring

SWOT DAM: Every audited action. Seen and scored.

Security posture, forensic audit, behavioural risk and compliance in one self-hosted console for Oracle, PostgreSQL, SQL Server, MySQL and the cloud.

Risk score per identity: 0–100
Rolling behaviour baseline: 30-day
Compliance frameworks mapped: 4
Business rows stored: None

Product documentationArchitecture, collectors and production runbooks.

Sensitive Data SentinelFinds PII and financial columns with LLM classification.
Behavioral Risk RadarFlags 3 AM admin queries and logins from unapproved IPs.
Forensic audit logSigned CSV and PDF exports with a SHA-256 receipt.

Reads the audit trail Oracle, PostgreSQL, SQL Server, MySQL already keeps.

Collectors sign in with read-only credentials and poll each native audit trail on a set interval (30 seconds in the documented setup). No kernel hooks, no inline proxy, no change to how transactions run.

Your databasesNative audit on
CollectorsWatermark polling
BackendDeduplicates events
Event storeNormalised metadata
ConsoleLive in the browser

Audit source: Unified Audit
Versions: 19c, 21c, 23c
Collector rights: CREATE SESSION, AUDIT_VIEWER and SELECT on three views
Reads: AUDSYS.UNIFIED_AUDIT_TRAILSYS.DBA_TAB_COLUMNSSYS.V_$SESSION

Audit trailHigh-water mark: SCN 48214

48210LOGONRead
48211LOGOFFRead
48212DROP TABLERead
48213ALTER TABLERead
48214CREATE USERRead

Sample rows, speeded up. Collectors poll on a set interval (30 seconds in the documented setup).

Audit source: pgAudit
Versions: 14, 15, 16
Collector rights: pg_read_all_stats, pg_monitor and USAGE on schema public
Reads: pgaudit log entries

Audit trailHigh-water mark: #48214

48210DDLRead
48211WRITERead
48212ROLERead
48213PRIVILEGERead

Sample rows, speeded up. Collectors poll on a set interval (30 seconds in the documented setup).

Audit source: SQL Server Audit
Versions: 2017, 2019, 2022
Collector rights: VIEW SERVER STATE
Reads: Server audit filessys.dm_exec_requests

Audit trailHigh-water mark: #48214

48210FAILED_LOGIN_GROUPRead
48211SERVER_ROLE_MEMBER_CHANGE_GROUPRead
48212DATABASE_OBJECT_CHANGE_GROUPRead

Sample rows, speeded up. Collectors poll on a set interval (30 seconds in the documented setup).

Audit source: server_audit plugin
Versions: MySQL 8.0, MariaDB
Collector rights: PROCESS, and SELECT on performance_schema and mysql.*
Reads: server_audit logperformance_schema

Audit trailHigh-water mark: #48214

48210CONNECTRead
48211QUERYRead
48212TABLERead

Sample rows, speeded up. Collectors poll on a set interval (30 seconds in the documented setup).

Audit source: CloudWatch log groups
Versions: Managed engines
Collector rights: An IAM role that reads the log group
Reads: CloudWatch audit log group

Audit trailHigh-water mark: #48214

48210Engine audit events, batches of 5,000Read

Sample rows, speeded up. Collectors poll on a set interval (30 seconds in the documented setup).

What it never touches

SWOT DAM never connects to your user data tables or copies business records. It reads catalog metadata, native audit views and system views, and nothing else.

Catalog metadata DBA_TAB_COLUMNS
Native audit views UNIFIED_AUDIT_TRAIL pgaudit
System views V$SESSION sys.dm_exec_requests
Your user data tables and business records

Finds sensitive columns before anyone queries them.

Every 24 hours the Sensitive Data Sentinel classifies new columns with an AI model. It reads the catalog, so it sees names and types, never your data.

The model runs on your own server, so nothing leaves the network.

**CUSTOMER_ACCOUNTS** · 10 columns · sample table
Column	Type	Classification
`CUSTOMER_ID`	NUMBER	Not sensitive0.97
`FIRST_NAME`	VARCHAR2(80)	Personal data0.98
`PHONE_NUMBER`	VARCHAR2(24)	Personal data0.96
`NATIONAL_ID`	VARCHAR2(20)	Personal data0.99
`CREDIT_CARD_NUM`	VARCHAR2(19)	Financial and cards0.99
`BANK_IBAN`	VARCHAR2(34)	Financial and cards0.95
`PATIENT_MRN`	VARCHAR2(16)	Health records0.94
`DIAGNOSIS_CODE`	VARCHAR2(10)	Health records0.93
`PASSWORD_HASH`	VARCHAR2(128)	Secrets0.99
`API_TOKEN`	VARCHAR2(64)	Secrets0.96

3Personal data
2Financial and cards
2Health records
2Secrets

Model output for the selected column

{
  "table_name": "CUSTOMER_ACCOUNTS",
  "column_name": "CREDIT_CARD_NUM",
  "classification": "Financial and cards",
  "confidence": 0.99,
  "regulatory_framework": "PCI-DSS-4.0"
}

Classes and column names follow the documentation. Confidence scores are samples. Scans run every 24 hours.

Knows each account’s normal, and scores the rest.

Every identity gets a risk score from 0 to 100, measured against its own 30-day baseline, not a fixed signature.

Baseline for reporting_app, last 30 days

00:0006:0012:0018:00MonTueWedThuFriSatSun

Baseline for etl_batch, last 30 days

00:0006:0012:0018:00MonTueWedThuFriSatSun

Baseline for dba_ops, last 30 days

00:0006:0012:0018:00MonTueWedThuFriSatSun

Risk score

42/ 100

An hour unused in its 30-day baseline.
A public IP instead of its usual VPN subnet.
Over 50 catalog reads a second: a script or ransomware.

Identities, hours and weights are samples. The thresholds are SWOT DAM’s.

User reporting_app executed SELECT * FROM HR_SALARY_DATA from unapproved workstation 192.168.10.45. This query accessed 14,200 salary records, which deviates by +480% from this user’s 30-day baseline.
AI Threat Insights, example from the documentation

Four rules for the incidents that matter.

Events pass through deduplication and correlation before anyone is told, to cut alert fatigue.

Unauthorised schema change
DROP, TRUNCATE or ALTER on a production schema outside a maintenance window.
Privilege escalation
GRANT DBA, SUPERUSER or sysadmin, or a change to a security policy.
Brute-force sign-in
More than 5 failed logins within 60 seconds from one IP or username.
Mass data read
One query reading more than 50,000 rows from a table flagged PII or financial.

Sent to

EmailSMTP
SplunkHEC
QRadar and ArcSightCEF over syslog
ServiceNow, Jira, PagerDutyWebhooks

From alert to a fix you can run.

AI Threat Insights explains the incident and drafts the SQL to contain it. LiveOps shows who blocks whom and ends a session after two confirmations.

Remediation playbooks

reporting_app read 14,200 salary records from an unapproved workstation.

REVOKE DBA FROM reporting_app;

ALTER USER reporting_app ACCOUNT LOCK;

ALTER ROLE reporting_app NOLOGIN;

-- every session from 192.168.10.45
ALTER SYSTEM KILL SESSION '412,9031' IMMEDIATE;
ALTER SYSTEM KILL SESSION '418,1177' IMMEDIATE;

Drafted for review: copy it to your console or dispatch it from SWOT DAM.

LiveOps lock tree

Sample sessions on ORC_FINANCE_PROD.

SID 412reporting_appUPDATE HR_SALARY_DATA Holding row lock for 4 min
- SID 377app_payment_svcUPDATE HR_SALARY_DATAWaiting 3 min 52 s
  - SID 405payroll_jobMERGE INTO PAYSLIPSWaiting 48 s
- SID 390hr_portalSELECT … FOR UPDATEWaiting 2 min 10 s
SID 2PMONBackground processSystem process

Ending a session runs the engine’s own command and is written to the audit trail.

Evidence an auditor can check for themselves.

Filter the forensic audit log, then export signed CSV or PDF. Every export comes with a SHA-256 receipt of exactly what it holds.

8 of 8 sample events
Time	Database	User	Client IP	Action	Code
02:58:14	ORC_FINANCE_PROD	SYSTEM	10.20.4.11	CREATE USER	0
03:02:41	ORC_FINANCE_PROD	reporting_app	192.168.10.45	SELECT	0
03:02:55	ORC_FINANCE_PROD	reporting_app	192.168.10.45	SELECT	ORA-00942
03:04:09	PG_CUSTOMER_PORTAL	app_payment_svc	10.20.7.32	SELECT	0
03:05:30	ORC_FINANCE_PROD	dba_ops	10.20.4.18	GRANT	0
03:06:12	MSSQL_ERP_PROD	dev_temp	172.16.2.90	DROP TABLE	0
03:07:44	ORC_FINANCE_PROD	SYSTEM	203.0.113.27	SELECT	ORA-01017
03:09:03	PG_CUSTOMER_PORTAL	reporting_ro	10.20.7.40	SELECT	0

Audit receipt

Format: CSV, signed
Rows: –
Filters: –
Generated: –

SHA-256 of the dataset

Export to compute the hash.

The hash is computed in your browser from the sample rows. SWOT DAM also watermarks exports with HMAC-SHA256.

Mapped to the frameworks you are audited against.

Activity logs and configuration checks map to the controls below, with evidence packs in one step. Meeting a control still depends on configuration, scope and an independent assessment.

Maps to Requirements 10.2 and 10.3

Complete, tamper-evident audit trails of every action administrators take on cardholder databases.

Typical evidence sources (illustrative)

Forensic audit log(used)
Alert rules(used)
Sensitive Data Sentinel(used)
Behavioral Risk Radar(not used)
CIS posture checks(not used)

Posture, checked against CIS benchmarks

84/ 100

Example score from the documentation.

CriticalDefault passwordsUnexpired defaults such as SCOTT/TIGER or postgres/postgres.CIS Oracle 1.1, CIS PG 1.2
HighEncryption at restTablespace and transaction-log encryption.CIS Oracle 3.1, MSSQL 2.1
HighExcess DBA rightsApplication accounts holding superuser.CIS PG 2.3, CIS MySQL 2.1
PassedListener securityTLS 1.3 on listeners, cleartext refused.CIS Oracle 2.1, CIS PG 1.4

Runs inside your network, on your terms.

SWOT DAM is self-hosted. Credentials, audit logs and who can see them stay under your control.

Four roles, four views

Full control: collectors, users and global tuning.

Audit event, as this role sees it

Time: 03:02:41
Database: ORC_FINANCE_PROD
Duration: 1,840 ms
User: reporting_app Hidden for this role
SQL text: SELECT * FROM HR_SALARY_DATA Hidden for this role

Size it

Databases you monitor: 12

Enterprise medium

Up to 25,000 events a minute

8 vCPU, 16 GB RAM, 500 GB NVMe

Sizing tiers from the deployment runbook.

Security boundaries

Database credentials: Encrypted with Fernet (AES-128-CBC with HMAC-SHA256).
User passwords: bcrypt with 12 rounds; sessions expire after 8 hours.
Exports: Watermarked with HMAC-SHA256 so tampering shows.
Tenancy: Organisation units and collector groups limit who sees which databases.

Two ways to deploy

Docker ComposeBackend on port 8000, console on port 80 and a PostgreSQL 15 metadata store.
Windows serviceA native service for air-gapped Windows Server 2019 and 2022, restarting itself on failure.

Single sign-on

Microsoft Entra ID
Okta
PingIdentity
Keycloak

SAML 2.0 (SP-initiated) or OIDC with PKCE; OIDC creates accounts and syncs groups.

Inside the console.

Real screens from SWOT DAM, as published in its documentation.

SWOT DAM Monitoring Deck screen: The whole fleet at a glance: instances online, host gauges and alert counts. — Monitoring Deck

SWOT DAM Forensic audit log screen: Every captured event with its SQL, user, client address, status and risk. — Monitoring Deck

SWOT DAM, answered.

What database and security teams ask before they choose a database activity monitoring platform.

10 answers

01What is SWOT DAM?

SWOT DAM is self-hosted database activity monitoring (DAM). It reads the audit trail each database already keeps, scores every identity from 0 to 100 against its own 30-day baseline, finds sensitive columns with AI, and exports signed audit evidence, all from one console.

02Does it sit inline or slow our databases down?

No. Collectors sign in with read-only credentials and poll each native audit trail on a set interval, every 30 seconds in the documented setup. There are no kernel hooks and no inline proxy, so how transactions run does not change.

03Which databases does it support?

Oracle 19c, 21c and 23c through Unified Audit, PostgreSQL 14 to 16 through pgAudit, SQL Server 2017 to 2022 through SQL Server Audit, MySQL 8.0 and MariaDB through the server_audit plugin, and Amazon RDS and Aurora through CloudWatch. Azure SQL and Google Cloud SQL are covered too.

04Does SWOT DAM read or copy our business data?

No. It never connects to your user data tables or copies business records. It reads catalog metadata, native audit views and system views only. Even the Sensitive Data Sentinel sees column names and types, never the values in them.

05How does it find sensitive data?

Every 24 hours the Sensitive Data Sentinel classifies new columns as personal, financial, health or secret data with an AI model. You choose the model: OpenAI, your own Azure OpenAI deployment, or Ollama on your own server, so nothing leaves your network.

06How does the risk score work?

Each identity is measured against its own 30-day baseline, not a fixed signature. Activity at an hour the account never uses, a connection from a new network or a sudden spike in reads raises its 0 to 100 score. Four alert rules catch schema changes, privilege escalation, brute-force sign-ins and mass reads of sensitive tables.

07Can it help us respond, not just alert?

Yes. AI Threat Insights explains an incident and drafts the SQL to contain it, such as revoking a role or locking an account. LiveOps shows which session blocks which, and ends a session only after two confirmations; it refuses to end the database’s own processes.

08Which SIEM and ticketing tools does it send to?

Splunk over HEC, QRadar and ArcSight as CEF over syslog, ServiceNow, Jira and PagerDuty over webhooks, and email over SMTP. Events are deduplicated and correlated first, to cut alert fatigue.

09Does it help with PCI DSS, HIPAA, SOX or GDPR?

Activity logs and configuration checks map to PCI DSS 4.0 Requirements 10.2 and 10.3, HIPAA 45 CFR 164.312(b), SOX Section 404 and GDPR Article 32, with evidence packs in one step and signed exports carrying a SHA-256 receipt. Meeting a control still depends on configuration, scope and an independent assessment.

10What does it take to run?

Docker Compose, or a native Windows service for air-gapped Windows Server 2019 and 2022. A proof of concept for up to 5 databases needs 4 vCPU, 8 GB RAM and 100 GB NVMe; the high-volume tier for 100 or more databases needs 16 vCPU, 32 GB RAM and 2 TB NVMe.

See SWOT DAM on your own databases

Watch the tour, read the technical manual, or book a walk-through on the engines you run.

Database security SWOT DAM vs IBM Guardium

Book a demo Read the technical manual