RE: IDS for DataBase Systems.

[Greg Shipley <gshipley () neohapsis com>]

You'll want to do some more digging on this, but I was talking to the
Entercept folks a few weeks ago and I believe they just announced a
host-based database "intrusion prevention" type product.  As in, something
that is SPECIFICALLY designed for DBs.

In fact, in briefly cruising their site, this looks to be it:
http://www.entercept.com/products/dbe/

In theory (I have not done this or checked it out...yet) one could tie the
alert output of such a solution to some type of correlation system, and
effectively have a "database IDS."

Might take some initial heavy lifting, but could be cool...assuming
Entercept's solution works, and you can get your sysadmins and DBAs to buy
into it.

Hope this helps,

-Greg