Database activity monitoring Custom rules syntax

[lior_ke]

Hello, 

I'm tring to write a custom rules that will catch statements such as:

grant <some_grant> to <some_user>;

so basically - I need to catch - 'grant * to *'

I think I should use matches functiion for that:

statement matches 'grant * to *' ? but I don't know how to use the regular expression and can't find any documentation about it.

Thanks,

Lior

[aguevara]

I just move this post to the Database security group for proper visibility 

[lior_ke]

Any updates

[eti]

you can write the rule with the following syntax:

1. statement LIKE 'grant%to%'

2. statement CONTAINS 'grant to'