Start with installation guide (inside the package) — sizing, a
quick install, and the full install with every option — and
verify the installer, which verifies the installer
script before you run it as root, and
verify your download, which verifies
everything else DBSheriff ships.
Once the stack is up:
install public or private subnet
— where to put the host: a public subnet, a private subnet, or a private
subnet with no internet; how people reach the two consoles in each case
(the bundled HTTPS front door, a VPN, a Session Manager, IAP or Bastion
port forward, your own load balancer), and which ports to open.
database users by engine — for each of
the twelve engines, which database accounts are required and which are
optional, every permission, and the statements that create them.
pre installation database users
— the database account DBSheriff needs on each engine, and how to
create it (by hand, or with the create_reset_dbuser tool: on an installed host
sudo /opt/dbsheriff/current/deploy/onprem/stack.sh tool create_reset_dbuser ...,
in a source checkout scripts/create_reset_dbuser.py).
first login quick start — your first
hour: sign in, secure the secrets the installer made, create the database
accounts, register your first server and see data flowing.
getting a permanent license (inside the package) — what a
licence covers, how to buy one at license.dbsheriff.ai and how to install it.
onboard target (inside the package) — monitoring a database on AWS,
GCP, or Azure? One command finds it, sets it up, and registers it —
skips the two steps above entirely. With --detect it lists the databases
of your account for PostgreSQL, MySQL, Oracle, SQL Server and Redshift at
once, so you do not need to know which of them you run; with --manual it
takes a host you type instead (the same five engines), so a database on
a virtual machine or on-premises works too. Any other engine is set up from
its own guide and registered in the Admin Console.
cloud discovery (inside the package) — which managed databases in your
AWS, Azure or GCP accounts nobody registered with DBSheriff: off by default,
list-only, and what it does not find.
cloud control plane (inside the package) — alerts on the cloud
changes a SQL monitor cannot see: audit logging switched off, a key
disabled, a firewall opened, a database credential read from the secrets
manager. What is switched on, the permissions per cloud, what it cannot see.
cloud control write (inside the package) — taking back one dangerous
cloud change, with an approver's decision first (a world-open database port,
an authorised network, a snapshot share, a firewall rule): off by default,
the write permission it needs per cloud, and what it never does.
chat confirmation (inside the package) — "Was this you?": ask the person
behind a medium or high alert, in Slack, after the fact. Off by default; what a
Yes and a No do, what the message carries, the Slack App setup.
native controls privileges (inside the package) — the optional
native controls (masks, limits and time-boxed grants the database itself
enforces): what each of the three access tiers can do to your database, what
the Control account needs on each engine, what no native control can do, and
how to remove everything DBSheriff made.
feature overview — everything DBSheriff can do, grouped by
the job you want done, with whether it is on or off at install and the
setting that turns it on.
ui tour (inside the package) — a fast pass through every tab in both
consoles.
console reference manual (inside the package) — every
field, every setting, exactly who can change what.
auditor view (inside the package) — how to give an external auditor time-boxed, read-only access to the evidence packs, what they can and
cannot see, how access ends and how you see what they looked at.
engine completeness statements (inside the package) —
per engine, how statements reach DBSheriff, what the coverage figure
counts, and what the record does not cover.
privacy and erasure (inside the package) — what DBSheriff keeps
about the people whose accounts it watches, for how long, and what a
request to erase a person reaches and does not reach.
data handling and retention (inside the package) — what is
stored of each statement and for how long, the raw-text vault, legal
holds, what cannot be erased in place, and whether a 30-day raw window
affects compliance reporting.
Then, two documents per engine: what DBSheriff does for you, and how to
create the service identities DBSheriff needs.
The installation guide (host requirements, the guided installer, day-2 operations) is at install.html. The feature guides are in customer_docs/ inside the package.