SWOT DAM Product Documentation

01 Executive Overview & Value Proposition

Database Activity Monitoring (DAM) involves tracking and analyzing database events in real time. Unlike legacy approaches, SWOT DAM integrates security posture management, forensic auditing, and behavioral analytics into a single platform.

Figure 1.0 — Secure Enterprise Authentication

Figure 1.1 — SWOT DAM Primary Home Dashboard

Figure 1.2 — SWOT DAM Unified Forensic Explorer

02 System Physical & Logical Architecture

SWOT DAM is engineered as a resilient, two-tier modular architecture designed for high event throughput and minimal resource footprint on monitored production instances.

Physical Components

• Central Audit Backend (`central_audit_backend`): Python 3.10+ service utilizing FastAPI and Uvicorn for high-concurrency REST endpoints. Background jobs are managed by APScheduler executing inside a dedicated ThreadPoolExecutor pool.
• Metadata & Normalized Event Lake: Managed through SQLAlchemy with SQLite or PostgreSQL backend. Stores collector definitions, normalized audit logs, alerts, user profiles, and configuration flags. Target business data is never stored.
• Dam_Frontend (Vite / React SPA): A lightweight single-page application utilizing TailwindCSS, Lucide icons, and React Query for sub-second reactive state hydration.

Addressing Concurrency & Synchronous Drivers

Standard enterprise database drivers (such as cx_Oracle, pymssql, and psycopg2) are synchronous and blocking. If executed directly inside an asynchronous async def route, they would freeze the entire Python asyncio event loop.

# FastAPI Non-Blocking ThreadPool Execution Pattern
from starlette.concurrency import run_in_threadpool
from fastapi import APIRouter, Depends

router = APIRouter()

@router.get("/api/admin/audit-logs")
async def fetch_audit_logs(source_id: int, limit: int = 50):
    # Offload blocking database I/O to background OS threads
    # Preserves 100% responsiveness of the asyncio event loop
    logs = await run_in_threadpool(
        blocking_fetch_logs_from_engine, 
        source_id=source_id, 
        limit=limit
    )
    return {"status": "success", "data": logs}

# Incremental Oracle SCN / Timestamp Watermark Polling
def poll_oracle_unified_audit(connection, last_watermark_scn: int):
    query = """
        SELECT SCN, EVENT_TIMESTAMP, DBUSERNAME, ACTION_NAME, OBJECT_SCHEMA, OBJECT_NAME, SQL_TEXT 
        FROM UNIFIED_AUDIT_TRAIL 
        WHERE SCN > :scn_watermark 
        ORDER BY SCN ASC 
        FETCH FIRST 5000 ROWS ONLY
    """
    cursor = connection.cursor()
    cursor.execute(query, {"scn_watermark": last_watermark_scn})
    rows = cursor.fetchall()
    # Advance high-water mark to prevent duplicates and missed events
    new_watermark = rows[-1][0] if rows else last_watermark_scn
    return rows, new_watermark

03 Security Boundaries & Data Isolation

SWOT DAM is engineered with strict cryptographic boundaries to guarantee that target database credentials and audit logs remain strictly under customer control.

04 Monitoring Deck & Fleet Topology

The Monitoring Deck (`dashboard.html`) serves as the mission-control cockpit for the enterprise database fleet. It consolidates real-time telemetry across all configured database engines.

Figure 4.1 — Monitoring Deck Real-Time Fleet Overview

05 LiveOps Real-Time Telemetry & Lock Analysis

The LiveOps module (`liveops.html`) delivers sub-second operational observability. It bridges database security with DBA operational health, identifying rogue transactions, lock starvation, and long-running exfiltration attempts.

Figure 5.1 — LiveOps Real-Time Query Stream & Lock Hierarchy

Core Operational Capabilities

• Live Query Stream: Displays actively executing SQL statements across all engines with runtime duration, execution plan hash, and client machine name.
• Blocking Lock Hierarchy: Automatically builds visual tree graphs identifying root-cause blocker sessions (`SID`, `SPID`, `PID`) holding exclusive row/table locks.
• Emergency Session Termination: Provides an authenticated "Kill Session" button executing engine-native abort commands (`ALTER SYSTEM KILL SESSION`, `pg_terminate_backend`, `KILL `) with automated audit trails.

06 Forensic Audit Log Explorer

The Audit Log Explorer (`audit-logs.html`) is the primary investigation interface for security analysts, incident responders, and compliance auditors.

Figure 6.1 — Forensic Audit Log Explorer & Search Engine

Tamper-Proof Export & Forensic Watermarking

Audit logs can be exported directly to cryptographically signed CSV or PDF formats. Each exported batch generates an audit receipt containing the SHA-256 hash of the dataset, ensuring non-repudiation during formal legal or regulatory inquiries.

07 Intelligent Alerting & Deduplication

To eliminate the debilitating "alert fatigue" common in large database deployments, SWOT DAM runs an in-memory Deduplication & Correlation Pipeline before publishing notifications.

Figure 7.1 — Security Incident & Threat Alert Stream

08 Sensitive Data & Metadata Sentinel

The Data Sentinel module (`metadata.html`) scans the metadata catalog of every monitored database to identify and catalog sensitive columns across four critical classifications:

• PII (Personally Identifiable Information): `SSN`, `NATIONAL_ID`, `PASSPORT`, `FIRST_NAME`, `LAST_NAME`, `PHONE_NUMBER`.
• Financial & Payment Cards: `CREDIT_CARD_NUM`, `CVV`, `EXPIRY_DATE`, `BANK_IBAN`, `ROUTING_NUMBER`.
• Protected Health Information (PHI): `DIAGNOSIS_CODE`, `PATIENT_MRN`, `PRESCRIPTION_RX`, `BLOOD_TYPE`.
• Authentication & Cryptographic Secrets: `PASSWORD_HASH`, `API_TOKEN`, `SECRET_KEY`, `AUTH_SALT`.

Figure 8.1 — Sensitive Data Discovery & Metadata Catalog

Intelligent LLM Classification Flow

Every 24 hours, the background scheduler gathers newly created table and column definitions and queries the configured AI provider (`gpt-4o-mini`, Azure OpenAI, or local Ollama) using strict JSON structured outputs:

// JSON Response Schema returned by LLM Discovery Engine
{
  "table_name": "CUSTOMER_BILLING_LEDGER",
  "sensitive_columns": [
    {
      "column_name": "CARD_PRIMARY_NUM",
      "classification": "FINANCIAL",
      "confidence": 0.99,
      "regulatory_framework": ["PCI-DSS-4.0", "GDPR-Art32"]
    },
    {
      "column_name": "CLIENT_EMAIL_ADDR",
      "classification": "PII",
      "confidence": 0.95,
      "regulatory_framework": ["GDPR-Art6", "DPDP-2023"]
    }
  ]
}

09 Behavioral Analytics & Anomaly Radar

The Behavioral Analytics module (`behavior.html`) evaluates how identities interact with the database over time. Instead of relying on static signature rules, it computes a dynamic risk score between 0 and 100 based on statistical deviations from a 30-day rolling baseline.

Figure 9.1 — Behavioral Risk Radar & Identity Baseline Scorecards

10 AI Threat Insights & Autonomous Remediation

The AI Threat Insights module (`ai-insights.html`) transforms cryptic database logs into human-readable incident explanations and provides DBA-grade remediation scripts.

Figure 10.1 — AI Threat Insights & Autonomous Remediation Playbooks

One-Click Remediation Playbooks

For each detected incident, SWOT DAM prepares instant mitigation SQL commands ready to copy or dispatch:

• Revoke Dangerous Role: REVOKE DBA FROM compromised_user;
• Lock Account: ALTER USER compromised_user ACCOUNT LOCK; (Oracle) / ALTER ROLE compromised_user NOLOGIN; (Postgres)
• Kill Active Sessions: Terminates all active connections associated with the suspicious IP address.

11 Database Security Posture Management (DSPM)

The Security Posture module (`posture.html`) continuously audits database configurations against the Center for Internet Security (CIS) benchmarks.

Figure 11.1 — Database Security Posture Management (DSPM) Scorecard

12 Regulatory Compliance Frameworks

The Compliance modules (`compliance.html` & `frameworks.html`) map all database activity logs and configuration benchmarks directly to international compliance mandates:

Figure 12.1 — Regulatory Frameworks Cockpit (PCI-DSS, HIPAA, SOX, GDPR)

13 Database Collector Configuration Guides

SWOT DAM connects to target databases using native read-only collector credentials. Use the tabs below to view setup SQL scripts for your database engine:

Figure 13.1 — Database Fleet Registry & Health Watermarks

-- ============================================================================
-- Oracle 19c/21c/23c Unified Audit Setup for SWOT DAM Collector
-- ============================================================================

-- 1. Create Dedicated Read-Only Collector User
CREATE USER c##swot_dam_collector IDENTIFIED BY "StrongSecretPassword#2026";
GRANT CREATE SESSION TO c##swot_dam_collector;

-- 2. Grant Read-Only Privileges on Unified Audit Trail & Catalog Views
GRANT AUDIT_VIEWER TO c##swot_dam_collector;
GRANT SELECT ON AUDSYS.UNIFIED_AUDIT_TRAIL TO c##swot_dam_collector;
GRANT SELECT ON SYS.DBA_TAB_COLUMNS TO c##swot_dam_collector;
GRANT SELECT ON SYS.V_$SESSION TO c##swot_dam_collector;

-- 3. Define and Enable Enterprise Audit Policy
CREATE AUDIT POLICY swot_security_policy
  ACTIONS
    LOGON, LOGOFF, DROP TABLE, ALTER TABLE, CREATE USER, DROP USER, GRANT, REVOKE;

AUDIT POLICY swot_security_policy;

-- ============================================================================
-- PostgreSQL 14/15/16 pgAudit Setup for SWOT DAM Collector
-- ============================================================================

-- 1. Configure postgresql.conf Parameters
-- shared_preload_libraries = 'pgaudit'
-- pgaudit.log = 'ddl, write, role, privilege'
-- pgaudit.log_catalog = off

-- 2. Create Database User for SWOT Collector
CREATE ROLE swot_collector WITH LOGIN PASSWORD 'StrongPgPass#2026';

-- 3. Grant Permissions to Read pg_stat_activity & pgAudit Logs
GRANT pg_read_all_stats TO swot_collector;
GRANT pg_monitor TO swot_collector;
GRANT USAGE ON SCHEMA public TO swot_collector;

-- ============================================================================
-- Microsoft SQL Server 2017/2019/2022 Server Audit Setup
-- ============================================================================

-- 1. Create Server Audit Writing to Secure Audit Files
CREATE SERVER AUDIT [SWOT_Server_Audit]
TO FILE (FILEPATH = 'C:\MSSQL\AuditLogs\', MAXSIZE = 100 MB, MAX_FILES = 50)
WITH (ON_FAILURE = CONTINUE);
ALTER SERVER AUDIT [SWOT_Server_Audit] WITH (STATE = ON);

-- 2. Create Audit Specification for Critical DDL and Security Events
CREATE SERVER AUDIT SPECIFICATION [SWOT_Audit_Spec]
FOR SERVER AUDIT [SWOT_Server_Audit]
ADD (FAILED_LOGIN_GROUP),
ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP),
ADD (DATABASE_OBJECT_CHANGE_GROUP);
ALTER SERVER AUDIT SPECIFICATION [SWOT_Audit_Spec] WITH (STATE = ON);

-- 3. Grant View Server State to Collector User
CREATE LOGIN [swot_collector] WITH PASSWORD = 'StrongMssqlPass#2026';
GRANT VIEW SERVER STATE TO [swot_collector];

-- ============================================================================
-- MySQL 8.0 & MariaDB Enterprise Audit Plugin Setup
-- ============================================================================

-- 1. Install Audit Plugin (in my.cnf or via SQL)
INSTALL PLUGIN server_audit SONAME 'server_audit.so';
SET GLOBAL server_audit_events = 'CONNECT,QUERY,TABLE';
SET GLOBAL server_audit_logging = ON;

-- 2. Create Collector User with Least Privilege
CREATE USER 'swot_collector'@'%' IDENTIFIED BY 'StrongMySqlPass#2026';
GRANT PROCESS, SELECT ON performance_schema.* TO 'swot_collector'@'%';
GRANT SELECT ON mysql.* TO 'swot_collector'@'%';

# AWS RDS / Aurora CloudWatch Collector Ingestion Configuration
cloud_collector:
  provider: "aws-rds"
  engine: "aurora-postgresql"
  log_group: "/aws/rds/instance/prod-db-aurora/postgresql"
  auth_mechanism: "IAM_ROLE"
  role_arn: "arn:aws:iam::123456789012:role/SWOT_DAM_CloudWatch_Reader"
  polling_interval_seconds: 30
  batch_size: 5000

Figure 13.2 — Cloud Databases & Agentless Ingestion Streams

14 Fleet Administration & Enterprise SSO

Administrative workflows in SWOT DAM (`admin.html` and `settings.html`) provide multi-tenant isolation, background job diagnostics, and enterprise directory integrations.

Figure 14.1 — Multi-Tenant RBAC & Collector Group Assignments

Multi-Tenancy & RBAC Roles

• Admin: Full platform control, collector lifecycle management, user management, and global security tuning.
• Security Officer: Full audit log inspection, behavioral radar analysis, and alert incident triage.
• Compliance Auditor: Read-only access to CIS benchmarks, compliance scorecards, and signed export binders.
• Read-Only Operator: Real-time telemetry monitoring deck view without access to SQL query text or user identities.

Figure 14.2 — APScheduler Worker Diagnostics & ThreadPool Utilization

Enterprise SSO (SAML 2.0 & OIDC)

SWOT DAM integrates with enterprise Identity Providers including Microsoft Entra ID (Azure AD), Okta, PingIdentity, and Keycloak:

• SAML 2.0 SP-Initiated Flow: Redirects to IdP with signed AuthnRequests; validates SAML assertions using IdP X.509 certificates.
• OpenID Connect (OIDC): Authorization Code flow with PKCE, auto-provisioning user accounts and syncing security groups.

Figure 14.3 — Enterprise Settings, SSO & SIEM Configuration

SIEM & Webhook Forwarders

Normalized audit records and alerts can be forwarded in real time to corporate SIEM systems:

• Splunk HEC: Token-authenticated JSON event forwarder with customizable source types.
• IBM QRadar / ArcSight: Standard Common Event Format (CEF) over Syslog (TCP/TLS).
• ITSM Ticketing: Instant incident creation via Webhook for ServiceNow, Jira Service Desk, and PagerDuty.

15 Deployment & Production Runbooks

SWOT DAM can be deployed either as containerized Docker microservices or as a native Windows service using the PyInstaller + WinSW wrapper.

Production Hardware Sizing Guidelines

Docker Compose Production Deployment

# Complete Production docker-compose.yml for SWOT DAM
version: '3.8'

services:
  swot-backend:
    image: rudratic/swot-dam-backend:latest
    container_name: swot-dam-backend
    restart: always
    environment:
      - DATABASE_URL=postgresql://swot_admin:SecretPass@postgres-meta:5432/swot_dam_meta
      - SESSION_SECRET=c28f9d0e8a7146b38c201a4e9b7f6d5c
      - FERNET_SECRET_KEY=bW9ja19mZXJuZXRfa2V5XzMyX2NoYXJzXzEyMzQ1Njc4OTA=
      - SCHEDULER_THREAD_POOL_SIZE=20
    ports:
      - "8000:8000"
    depends_on:
      - postgres-meta

  swot-frontend:
    image: rudratic/swot-dam-frontend:latest
    container_name: swot-dam-frontend
    restart: always
    ports:
      - "80:80"
    depends_on:
      - swot-backend

  postgres-meta:
    image: postgres:15-alpine
    container_name: swot-dam-postgres-meta
    restart: always
    environment:
      - POSTGRES_USER=swot_admin
      - POSTGRES_PASSWORD=SecretPass
      - POSTGRES_DB=swot_dam_meta
    volumes:
      - swot_meta_data:/var/lib/postgresql/data

volumes:
  swot_meta_data:

Windows WinSW Native Service Deployment

For air-gapped enterprise environments running Windows Server 2019/2022, SWOT DAM is packaged as a standalone native service managed by WinSW.exe:

:: Run as Administrator in C:\SWOT-DAM\service
cd C:\SWOT-DAM\service
SWOT_DAM_Service.exe install
SWOT_DAM_Service.exe start
SWOT_DAM_Service.exe status

:: Auto-restart configuration inside SWOT_DAM_Service.xml
:: <onfailure action="restart" delay="10 sec"/>