4

Collection Setup

SL-10

How activity is captured from each instance. The choice is not cosmetic — it determines whether a privileged administrator can quietly disable the very monitoring that would record what they did next.

DischargesS.8(4)R.6
Instances
15
Agentless proxy
9
Average overhead
2.1%
Above 3% overhead
3

Collection modes

Agentless traffic inspection

9 instances

Captures queries and session context by inspecting traffic in-path, without installing anything on the database host. Preserves query fidelity at high volume and adds no load to the database itself.

Strengths
  • No agent to install, patch or fail on the database host
  • Full query text and session context preserved
  • No dependence on the database's own audit subsystem
Trade-offs
  • Requires network placement in the connection path
  • Local connections on the host itself bypass it unless separately covered

The default here. Some environments explicitly require avoiding dependence on native audit logs, which makes this the only viable primary mode.

familyid-prod-01portal-prod-pghealthcard-mysqlscholarship-pgration-mysqlemployment-mssql+3
Native audit ingestion

4 instances

Consumes the database platform's own audit source and normalises it into the same schema as proxy capture, so reporting is consistent across mixed estates.

Strengths
  • Captures local and console access that never crosses the network
  • Works for managed cloud platforms where in-path inspection is not possible
Trade-offs
  • Depends on a subsystem a privileged administrator can disable
  • Detail varies by platform; normalisation loses some fidelity
  • Adds load to the database when set to full verbosity

Used for Snowflake, Databricks and MongoDB here, where proxy capture is not available.

beneficiary-warehouseanalytics-lakehouseforms-mongofamilyid-dr-oracle
Hybrid

2 instances

Proxy capture as the primary source, with native audit filling the gaps for local and console sessions. Events are deduplicated on correlation.

Strengths
  • Closes the local-access gap
  • Retains proxy fidelity for the bulk of traffic
Trade-offs
  • Highest operational complexity
  • Requires careful deduplication tuning

Applied to the two tier-1 instances where local DBA access is routine.

pension-ledger-mssqlproperty-oracle

Per-instance overhead

Measurable overhead targets belong in the acceptance criteria, not in a vendor claim. Anything sustained above 3% warrants a mode review.

  • analytics-lakehouseDatabricks · productionnative audit
    3.8%
    Tamper-protected
  • property-oracleOracle · productionhybrid
    3.5%
    Tamper-protected
  • vitals-pgPostgreSQL · productionagentless proxy
    3.3%
    Tamper-protected
  • portal-prod-pgPostgreSQL · productionagentless proxy
    3%
    Tamper-protected
  • portal-staging-pgPostgreSQL · stagingagentless proxy
    2.8%
    Tamper-protected
  • healthcard-mysqlMySQL · productionagentless proxy
    2.7%
    Tamper-protected
  • ration-mysqlMySQL · productionagentless proxy
    2.3%
    Tamper-protected
  • forms-mongoMongoDB · productionnative audit
    2.2%
    Unprotected
  • employment-mssqlMicrosoft SQL Server · productionagentless proxy
    1.9%
    Tamper-protected
  • scholarship-pgPostgreSQL · productionagentless proxy
    1.6%
    Tamper-protected
  • pension-ledger-mssqlMicrosoft SQL Server · productionhybrid
    1.1%
    Tamper-protected
  • familyid-dr-oracleOracle · drnative audit
    1.1%
    Tamper-protected
  • beneficiary-warehouseSnowflake · productionnative audit
    0.8%
    Tamper-protected
  • familyid-prod-01Oracle · productionagentless proxy
    0.5%
    Tamper-protected
  • vendor-portal-pgPostgreSQL · productionagentless proxy
    0.5%
    Tamper-protected
Evidences:S.8(4)R.6New instances and schema objects are auto-discovered, so adding a database does not require reconfiguring the estate.