DAM stands for Database Activity Monitoring. It is the continuous collection and analysis of database actions, such as logins, queries, schema changes, privilege use, and data exports. The goal is to create visibility into who touched a database, what they did, and whether the activity matched policy. DAM matters because databases often hold high-value data, and normal application traffic can hide dangerous behavior unless it is monitored and normalized in one place.
In defense, DAM platforms are used to consolidate audit evidence, support compliance, and detect threats such as insider abuse, stolen credentials, suspicious bulk reads, and unusual administrative commands. In attacks, defenders look for patterns like repeated failed logins, access from unexpected hosts, or large exports outside business hours. Some DAM tools only observe, while others can integrate with inline enforcement to alert or block risky activity. That makes DAM a key control for both investigation and real-time detection.