This page lists every feature by the job you want done, says whether it is on or off when you install, and says where to run it or what to switch to turn it on. It is a map, not the manual: each row links to the page that has the detail.
Two kinds of setting turn features on:
.env. A few features are switched on by the person who runs the host, with a line in /opt/dbsheriff/state/.env and then sudo /opt/dbsheriff/current/deploy/onprem/stack.sh up. They are marked with the setting name below. Three of them also need a worker that stack.sh up does not start: Evidence Packs (the evidence-packs service, compose profile evidence), and Hunt and the Policy Lab replay (both run in the policy-lab service, compose profile lab). Add the profile to COMPOSE_PROFILES and start that service yourself; until it runs, a queued request or run just waits. Until you set a switch, the tab for the feature tells you how.The two consoles are the Reporting Console (watch, read-mostly) and the Admin Console (configure). ui tour (inside the package) walks every tab; console reference manual (inside the package) has every field.
| Feature | What it does | Default | Where / how |
|---|---|---|---|
| Overview | Five tiles (risky, safe, killed, locked, alerts), a risk-volume chart and your worst servers; each tile drills into a filtered list | On | Reporting Console, Overview |
| Live Feed | Every statement as it happens; a registered server appears here at once, before its first query | On | Reporting Console, Live Feed. Filter by engine and server on a busy fleet |
| History | The same data with date-range filtering and the full untruncated SQL | On | Reporting Console, History |
| Alerts | Fired alerts to review and bulk-dismiss | On | Reporting Console, Alerts; the rules and channels are in the Admin Console, Config Parameters |
| Coverage | Per server, what DBSheriff saw over the last 30 days, the open findings, capture gaps and the capture path. A server with no figure is shown as uncovered | On | Reporting Console, Coverage. engine completeness statements (inside the package) says what each engine's record does not cover |
| Availability | Whether each monitored server is up and replicating | On | Reporting Console, Availability. Check it first after registering a server |
| SQL Perf | Slow queries, missing indexes, regressions, with an acknowledge and resolve lifecycle | On | Reporting Console, SQL Perf; thresholds in the Admin Console, Slow Query Tuning |
| Space Mgmt | Disk and tablespace capacity findings | On | Reporting Console, Space Mgmt (Capacity sub-panel for engines that do not report size) |
| System Health | DBSheriff's own containers, Kafka, Redis | On | Either console, System Health; or stack.sh health on the host |
| Hunt | Search the history DBSheriff has already stored, over the days you choose, with a recorded reason for every run | Off: HUNTS=on, and the policy-lab worker started by hand (see the note above the first table); without the worker a queued hunt stays queued |
Admin Console, Hunt (approver) |
| Timeline | One login's recorded activity as an incident timeline; related alerts and the kill or lock they led to are grouped | Off: INCIDENT_TIMELINE=on |
Admin Console, Timeline |
| Leavers | Who was removed or locked out, what they touched in their last 30 days, whether anything ran after; read-only, every look is recorded | Off: INCIDENT_TIMELINE=on (the same switch as Timeline) |
Admin Console, Leavers |
| Ask DBSheriff | Questions in plain language in a chat panel | Off until an approver names an LLM endpoint | Admin Console, Config Parameters; then the header button in either console |
| Dashboards | An ad-hoc chart builder over DBSheriff's own non-sensitive tables, and five presets | On | Admin Console, Dashboards |
| Feature | What it does | Default | Where / how |
|---|---|---|---|
| Scoring and reason codes | Every statement gets a risk score and the reason codes (R-codes) that explain it | On | Reporting Console, Reason Codes is the glossary |
| Query Flagging | Correct a mis-scored statement yourself; a Risky flag applies at once, a Not-risky flag waits for a second approver | On | Either console, Query Flagging |
| Query Overrides | The approval queue for flags raised anywhere | On | Admin Console, Query Overrides |
| Privileged Users | Mark a real database login trusted, privileged or app-secure; this decides which accounts are never killed | On | Admin Console, Privileged Users |
| Trusted Networks | Your VPN and office egress ranges, so they do not trip the geography signals | On | Admin Console, Trusted Networks |
| Identity Aliases | Link one person's usernames across engines for cross-server signals | On | Admin Console, Identity Aliases |
| Exceptions | Every list that changes what DBSheriff does for an account, a statement or a network, in one place | On | Admin Console, Exceptions |
| Model Retraining | Review what the model would learn next; a retrained model goes live only after an unrestricted approver confirms it | On; weekly run on Sunday | Admin Console, Model Retraining, Run Retrain |
| Policy Lab | What each "shadow" setting would have changed if it had been on; changes nothing itself | Off: POLICY_LAB=on, and the policy-lab worker started by hand for replays |
Admin Console, Policy Lab (unrestricted approver) |
| Feature | What it does | Default | Where / how |
|---|---|---|---|
| Classifications | Table and column sensitivity tiers; a statement touching CRITICAL data scores differently | On | Admin Console, Classifications; view-only in the Reporting Console |
| Classification Scan | Proposes candidates by table and column names; only a server with a classification account also reads a small bounded sample of values to confirm a match (not stored) | Weekly and automatic for every monitoring-enabled server (CLASSIFICATION_SCAN_INTERVAL_H, 168; 0 turns it off); also on demand per server |
Admin Console, Classification Scan. Needs the classify account: database users by engine |
| Tag write-back | Writes the approved sensitivity tag into your database or catalog | Off (it writes into your database) | The server's setting in Monitored Servers |
| Honeytokens | Decoy tables and honey accounts nobody has a reason to touch; any other login reading a decoy, or a failed login on a honey account, alerts | Off: HONEYTOKENS=on (and NATIVE_CONTROLS=on for the console) |
native controls privileges (inside the package) |
| Feature | What it does | Default | Where / how |
|---|---|---|---|
| Kill and lock on burst | Ends a runaway session, or locks the account, with a graduated ladder | Off on every new server | Admin Console, Monitored Servers, Advanced: Kill & Lock credentials. Needs the kill and lock accounts. Watch alerts for a day or two first |
| Response mode | Alert only, manual (proposals an approver confirms), or automatic: kill, throttle, revoke or, on Snowflake and SQL Server, mask | Set per server | Monitored Servers, the server's response mode |
| Respond | End a session or lock an account on purpose ("Act now"); holds the queue of manual-mode proposals | The tab is there; Act now is off until an unrestricted approver switches it on | Admin Console, Respond, the settings at the bottom of the tab |
| Locked Users | Review accounts DBSheriff locked; Unlock restores access | On | Admin Console, Locked Users |
| Chat Confirmations | Asks the person behind a medium or high alert in Slack, "was this you?" | Off: CHAT_CONFIRM (and CHAT_INBOUND) |
chat confirmation (inside the package) |
Native controls are rules your database enforces on its own, so they stay in place if DBSheriff stops. They are off by default, and DBSheriff writes the SQL for your DBA to run unless you give it the separate, opt-in control account. Details and the per-engine privileges: native controls privileges (inside the package).
| Feature | What it does | Default |
|---|---|---|
| Native Masks | Writes your database's own mask (a Snowflake masking policy, a SQL Server dynamic data mask) from columns an approver approved as CRITICAL or SENSITIVE | Off until native masking is switched on |
| Guardrails | Sets a login's own limits (statement timeout, connection cap, a profile or workload group) from what it normally does; tried on one account first, then promoted by an approver | Off |
| Native Firewall | Turns on and manages the database's own firewall (Oracle SQL Firewall 23ai, MySQL Enterprise Firewall, MongoDB 8.0 query settings): capture, review, observe, then enforce; DBSheriff is not itself a firewall | Off |
| Access Requests | Time-limited grants of your database's own roles: you ask, a different approver decides, DBSheriff runs the GRANT or hands your DBA the script, and takes the role away at the end | Off: ACCESS_REQUESTS=on and NATIVE_CONTROLS=on |
| Access Reviews | Who can reach each classified table and who used it; an approver keeps, revokes or defers each finding. Nothing is revoked by itself | Off: ENTITLEMENTS=on |
| Feature | What it does | Default | Where / how |
|---|---|---|---|
| Security Posture | Security-configuration findings (grants, encryption, password policy), refreshed hourly by each engine's governance collector; run a scan yourself at any time and compare with a past run | On (hourly), plus on demand | Admin Console, Security Posture; read in the Reporting Console, Posture |
| Compliance Scan | An on-demand SOC 2, PCI, HIPAA or NIST evidence report; DBSheriff's own mapping, not externally reviewed | Manual | Admin Console, Compliance Scan |
| Evidence Packs | Signed packs for an auditor: the report, the status of each control of PCI DSS 4.0, SOC 2, GDPR, SOX ITGC and ISO 27001:2022, the coverage and retention statements, and a sample of privileged statements | Off: EVIDENCE_PACKS, the evidence compose profile and the evidence-packs service started by hand |
Admin Console, Evidence Packs |
| Auditor view | Time-boxed, read-only access for an external auditor, with an end date | Off: AUDITOR_ROLE=on |
auditor view (inside the package) |
| Changes | What changed on a server between hourly snapshots: grants, settings, accounts created, removed or locked, each with severity and a review step | On; alerts for them off: DRIFT_ALERTS=on |
Admin Console, Changes |
| Account Inventory | Every login DBSheriff has observed | On | Admin Console, Account Inventory |
| Data handling and erasure | What is stored, for how long, legal holds, the raw-text vault, and erasing a person | On for retention and erasure; the raw-text vault, and so the raw text a legal hold can keep, is off until the mode is set to on (Admin Console, Config Parameters, Data Handling and Retention) |
data handling and retention (inside the package), privacy and erasure (inside the package) |
| Feature | What it does | Default | Where / how |
|---|---|---|---|
| Discovered Databases | Lists managed databases in your AWS, Azure or GCP accounts that nobody registered; list-only | Off | cloud discovery (inside the package) |
| Cloud control plane | Alerts on cloud changes a SQL monitor cannot see: audit logging off, a key disabled, a firewall opened. Detects and alerts only | Off: add producer-control-plane to ENABLED_PRODUCERS, then CP_AWS=true and the other CP_* switches |
cloud control plane (inside the package) |
| Cloud Reverts | Takes back one dangerous cloud change (a database port opened to the world, a snapshot shared) with an approver's decision first | Off | cloud control write (inside the package) |
| Feature | What it does | Default | Where / how |
|---|---|---|---|
| SIEM Export | Delivers audit and platform events as a signed JSON webhook, CEF over syslog, Splunk HEC or a Microsoft Sentinel table, at least once, with statement text only in its evidence form (literals replaced) | Off until configured | Admin Console, SIEM Export |
| Notifications | Alert rules and notification channels | Configure | Admin Console, Config Parameters |
| Single sign-on | Entra ID, Google Workspace, Okta, Keycloak or any OIDC provider for both consoles; password accounts stay as a break-glass fallback | Off | Admin Console, Console Users |
| Feature | What it does | Default | Where / how |
|---|---|---|---|
| Monitored Servers | Register, edit and retire every server; credentials live here; your licence is checked on save | On | Admin Console, Monitored Servers. First time: first login quick start |
| Config Parameters | Alert rules, thresholds, poll intervals, the audit-backup archiver | On | Admin Console, Config Parameters |
| Maintenance Windows | Suppress schema-change alerts during a known change | On | Admin Console, Maintenance Windows |
| Console Users | Logins and roles for the two consoles | On | Admin Console, Console Users |
| Backups and audit archive | The training database, the audit chain and the archive of it offsite | Configure | Config Parameters; the installation guide and docs/backup-and-recovery.md |
| Upgrade and rollback | Run the new installer. Roll back with sudo ln -sfn /opt/dbsheriff/releases/<previous tag> /opt/dbsheriff/current, then sudo /opt/dbsheriff/current/deploy/onprem/install.sh --yes (the link alone starts nothing), then sudo /opt/dbsheriff/current/deploy/onprem/stack.sh health |
Manual | Upgrade: installation guide (inside the package); the rollback steps are in deploy/onprem/README.md of your release package and on the published install page |
| Licence | What a licence covers (engines and servers), buying one, installing it | A 30-day demo until installed | getting a permanent license (inside the package) |
What DBSheriff does on each engine, and what it cannot see there, has its own page:
| Engine | Features | Accounts and setup |
|---|---|---|
| PostgreSQL / AlloyDB | Feature guide (inside the package) | setup guide |
| MySQL / Aurora MySQL | Feature guide (inside the package) | setup guide |
| SQL Server | Feature guide (inside the package) | setup guide |
| Oracle | Feature guide (inside the package) | setup guide |
| SAP HANA | Feature guide (inside the package) | setup guide |
| Amazon Redshift | Feature guide (inside the package) | setup guide |
| Snowflake | Feature guide (inside the package) | setup guide |
| MongoDB / Atlas | Feature guide (inside the package) | setup guide |
| Azure Synapse | Feature guide (inside the package) | setup guide |
| Google BigQuery | Feature guide (inside the package) | setup guide |
| Databricks | Feature guide (inside the package) | setup guide |
| Google Cloud Spanner | Feature guide (inside the package) | setup guide |
Every account on every engine, required or optional, with its permissions and create statements: database users by engine.
Questions, or something in this guide doesn't match what you see: SECURITY.md
in your release package, or support@dbsheriff.ai.