DataSunrise Audit for Elasticsearch

Elasticsearch Database Audit by DataSunrise is a software tool that continuously analyzes incoming traffic in real time according to a white list of SQL queries set by a database administrator (owner). Database Audit is a perfect tool to prevent any attacks on Elasticsearch databases, block unauthorized access and guarantee effective data protection. Nonstop monitoring is a part of any cybercrime investigation process.

DataSunrise Data Audit for Elasticsearch database enables real-time tracking of changes made to data and database structure, also it shows all user actions. Audit records include performed database operations, who and when performed the operations, and also all the attributes of the operations.

According to sensitive data protection regulations, companies are obliged to implement data audit solutions that provide comprehensive information on all actions performed with personally identifiable data. DataSunrise audit logs may be stored in an internal or external database for further examination or forensic purposes. DataSunrise Database Security Suite which includes Database Audit tool can generate specialized reports for specified types of transactions.

Some relational databases have in-built auditing possibilities, which, however, are not often used by database administrators due to inconvenience and data management issues. Unlike the native database audit DataSunrise Data Audit enables database auditing without any impact on the database or client applications and thus doesn’t cause any performance or scalability issues. By continuously monitoring database transactions, DataSunrise auditing solution for Elasticsearch helps database administrators prevent security threats by notifying about any suspicious transactions.

Elasticsearch Database Audit from DataSunrise retrieves and logs the following data:

• Codes of SQL queries and the results of their execution;
• Session details;
• Number of rows affected by a query, database errors;
• Client applications used to query the database, etc.

Elasticsearch Database Audit solution by DataSunrise can be configured to save audit results in the integrated SQLite database, external PostgreSQL, Amazon Aurora, Amazon Redshift or MySQL database; or it can export event logs to an external SIEM system.