# FOCTTA Activity - database activity monitoring (DAM) for sensitive data

> See who touches sensitive data, learn what normal looks like, and start the right breach clock when it is not.

Web page: https://foctta.com/activity  
This Markdown copy has the same content as the web page. Built 2026-10-14.

---

FOCTTA Activity (DAM) See who touched data On-premise

# Know who touched sensitive data, and whether that was normal.

FOCTTA Activity records who read or moved sensitive data, learns what is normal for each person, and warns before an export completes. (DAM \- database activity monitoring) Each record shows from where, how much and for what purpose, per person and per application.

[Book a demo](https://foctta.com/company) See what Activity catches

**svc-reporting · rows read per hour** baseline learned

Export 11x this account's normal step-up required

Touched cold tables for the first time early warning

How it works

1.   Connect audit logs, cloud trails or the gateway
2.   Learn what is normal for each person
3.   Get warned before an export completes

## Three ways to capture activity. No agent on the database needed.

Person identifiers inside queries are stored as hashes, never raw. Retention up to seven years.

**Mode A Native audit logs PostgreSQL SQL Server Oracle**
Survives log rotation and partial lines.

**Mode B Cloud event streams Snowflake BigQuery AWS CloudTrail**
Includes S3 downloads measured in bytes, with guidance that keeps logging costs in check.

**Mode C Through the gateway With FOCTTA Detection (DDR) Field proof pending**
Every query that passes the FOCTTA Detection (DDR) gateway is also recorded as activity.

Named detectors, not a black box

## Warnings before the damage, each with a reason you can read.

**Baselines per person**: Spots a sudden change for any person.
Normal volume is learned for each person and account, so a sudden change stands out.

**Application fingerprints**: Flags when an app's account is misused.
Each application has a normal query pattern. A shift exposes a misused service account.

**Early warnings Pilot**: Spots probing before any data leaves.
Reconnaissance, off-pattern access, new credentials, audit disabling, schema mapping, cold tables.

**Mass export, tiered**: Big exports alerted, challenged or blocked.
5x normal alerts, 10x asks for step-up sign-in, 50x blocks.

**Low and slow**: Catches many small queries that add up.
Thousands of small, normal-looking queries that add up to a large move.

**Purpose drift**: Flags use that strays from usual purposes.
Someone whose data use drifts away from their usual purpose mix.

**Attack stories**: Joins separate warnings into one finding.
Separate signals joined into one finding: recon, pivot, escalate, exfiltrate.

**Privileged users**: Watches admin accounts for mass exports.
Volume tracking and a dedicated rule for mass export by a privileged account.

Breach readiness

## When something is found, the clocks are already on screen.

A live query stream A forensic timeline you can export A drill-through from each finding to the decisions it relates to

**72** hours

DPDP Act India, report to the Board

**72** hours

GDPR Art. 33 EU, report to the regulator

**60** days

HIPAA US health data

Consent-aware findings

**Did the people whose data was touched agree to this purpose?** How it is answeredEach finding can carry the answer, from FOCTTA Consent or a local consent ledger. If the answer cannot be checked, the finding says so.

On its own, or together

**Activity is sold on its own. Pair it when you are ready.**

FOCTTA Detection (DDR) Baselines feed the decision on each query. (https://foctta.com/detection)

FOCTTA Discovery (DSPM) Tells Activity which stores hold sensitive data. (https://foctta.com/discovery)

## See your own audit logs turned into findings.

[Book a demo](https://foctta.com/company)