Database Activity Monitoring (DAM) is security tooling that observes database sessions, queries, and user behavior, often in real time. It can record activity for audits and flag anomalies such as unusual query patterns, unexpected access to sensitive records, or actions outside normal user behavior.
DAM helps defenders detect suspicious activity and investigate how data was accessed, including misuse of legitimate accounts. It provides visibility rather than automatically preventing every action, so it is most effective alongside access controls, encryption, and secure configuration reviews. In an attack, monitoring alerts or audit records may help identify unauthorized data access; defenders can use them to investigate and respond.