How to create a catch all rule?

[Saish]

I am trying to create a catch all rule on Trellix DAM 4.8.7. The goal is to detect all the queries executed on a DBMS. It is basically used for testing.

The rule in use is as follows: user contains ''

The idea of the above mentioned rule is to detect any statement executed from all users on a DBMS. However, I am not sure if all the statements are being captured on the DAM console. Could anyone please confirm if the rule to capture all activities is correct? Any suggestion is welcome.

[MarkW]

Try something like the below ( you will need to change the rule_object names)

user NOT IN $safe_user_list
AND
user NOT IN $safe_exec_user_list
AND
user not in $mgs_safe_osuser_list
AND
user not like 'xxx%' -- anything you want to block ignore
AND
( application in $sensitive_app_list OR application = '.Net SqlClient Data Provider')
AND
session_state not in ( NEW_SESSION, END_SESSION, NEW_LOGIN, END_LOGIN)