Database activity, read from native audit trails and scored per identity
SWOT DAM is self-hosted database activity monitoring. Read-only collectors poll each database’s own audit trail, so nothing is installed on the database server and no business data is copied. Every identity gets a 0 to 100 risk score against its own 30-day baseline, new columns are classified for sensitive data every 24 hours, and audit exports are signed with a SHA-256 receipt.
The problem
Database audit trails exist on most platforms but sit unread, in different formats per engine. Investigations then depend on SQL fluency and manual log correlation, so the queries that matter are found long after they ran.
0Agents on the database server
0–100Risk score per identity, on a 30-day baseline
4Frameworks mapped: PCI DSS, HIPAA, SOX, GDPR
Core capabilities
Native audit collection
Reads Oracle Unified Audit, pgAudit, SQL Server Audit, server_audit and cloud audit logs
Read-only credentials; catalogue metadata and audit views only
Behavioural risk
A 0 to 100 risk score per identity
Measured against that identity’s own 30-day baseline
Sensitive Data Sentinel
Classifies new columns every 24 hours from names and types
Uses OpenAI, Azure OpenAI or a local Ollama model
Alerts and response
Four alert rules with deduplication
AI Threat Insights drafts containment SQL; LiveOps ends sessions after two confirmations
SWOT DAM datasheetPage 1 of 2
Enterprise capabilities
Audit evidence
Signed CSV and PDF exports with a SHA-256 receipt
Mappings to PCI DSS, HIPAA, SOX and GDPR controls
SIEM and ticketing
Splunk (HEC), QRadar and ArcSight (CEF over syslog)
ServiceNow, Jira and PagerDuty webhooks, and e-mail
Deployment
Self-hosted on Docker Compose
Or a native Windows service for air-gapped Windows Server 2019 and 2022
Platform modules
Monitoring Deck
The whole fleet at a glance: instances online, host gauges and alert counts.
Forensic audit log
Every captured event with its SQL, user, client address, status and risk.
Alerts
Schema changes, suspicious grants and brute-force sign-ins, ranked by severity.
Behavioral Risk Radar
Per-identity risk scores against each identity’s own baseline.
AI Threat Insights
Root cause, why it matters and the script to contain it.
LiveOps
Which session blocks which, and ending a session after two confirmations.
Security posture
CIS checks, encryption status and privilege sprawl in one score.
Frameworks
Evidence for PCI DSS, HIPAA and SOX controls, ready to export.
Technical specifications
Databases
Oracle 19c to 23c, PostgreSQL 14 to 16, SQL Server 2017 to 2022, MySQL 8.0 and MariaDB
Managed cloud
Amazon RDS and Aurora, Azure SQL, Google Cloud SQL
Collection
Read-only collectors polling native audit trails; no inline proxy, no kernel hooks
Data copied
None: catalogue metadata, audit views and system views only
Evidence
Signed CSV and PDF exports with a SHA-256 receipt
Deployment
Docker Compose, or a Windows service for air-gapped sites
Framework mapping
PCI DSS 4.0
HIPAA
SOX 404
GDPR Art. 32
Evidence mapped to these frameworks. Whether a control is met depends on your configuration, scope and assessor.
Rudratic Technologies Ltd · London and Chennai · info@rudratic.com · rudratic.com/products/swot-dam