Database query audit

Availability Query recording: all editions (on by default). Turning it off, and SIEM export: Ultimate.

Because Tessera’s database proxy is protocol-aware, it can record every statement that passes through a brokered PostgreSQL or MySQL session — giving you a per-session SQL trail without touching the database server.

What gets recorded

With query audit enabled, each successful statement is written to the session’s audit trail, visible per session under Audit → Sessions.

• Statement text is truncated for the log (long or multi-line queries are collapsed).
• Bind-parameter values are never logged — only the statement shape, never the data.
• Client introspection noise (catalog lookups, autocomplete queries) is filtered out, so the trail reflects real user activity.

Write and DDL statements blocked in a read-only session are always audited, regardless of the query-audit toggle — see Read-only policies. (Turning database activity capture off entirely silences these too.)

Configure it

Query audit is on by default on every edition — you don’t need to enable it. Under Settings → Integrations → Audit & capture, the per-kind activity switches and session recording are available on every edition; the Database query audit switch (to turn query recording off) requires Ultimate. (The per-kind switch applies to SSH, database and Kubernetes activity capture; RDP sessions only ever record start/close lifecycle events, so its switch has no effect.)

Privacy

Query audit is safe to leave on: it captures what kind of statement ran and against which session and target, not the row data. For the full event stream in your SIEM, combine it with audit export.