Database Activity Monitoring (DAM).

A security control that continuously observes database queries, privileged-user actions, and schema changes to enforce policy and detect data abuse in real time. It belongs to the Defense & Operations category of cybersecurity.

A security control that continuously observes database queries, privileged-user actions, and schema changes to enforce policy and detect data abuse in real time.

Database Activity Monitoring (DAM) is a category of products that captures every SQL statement reaching a database engine — through network sniffing, kernel taps, or native audit hooks — and correlates it against policy to flag privilege escalation, mass exports, schema tampering, and anomalous DBA behavior. Leading vendors include IBM Guardium, Imperva SecureSphere, Trellix, and Oracle Audit Vault; cloud-native equivalents include AWS DAS and Microsoft Defender for SQL. DAM is widely deployed to satisfy PCI DSS, SOX, HIPAA, and GDPR requirements for separation of duties and auditable trails of access to sensitive data. Modern deployments stream events to SIEMs and trigger automated quarantine playbooks.

Defences for Database Activity Monitoring (DAM) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: DAM, database auditing.