LOOK CLOSER
One query.
A larger body of data.
An unusual query is a starting point. Explore who accessed the data and the context around it.
DATABASE ACTIVITY MONITORING. IDENTITY. RISK.
A query isonly thebeginning.
See the activity. Recognize the risk.
Understand what deserves a closer look.
Nanori brings database monitoring, identity context, and investigation together in one place.
01 / DATABASE RISK DETECTION
What changes when you look closer?
Database activity monitoring shows what ran. Nanori adds behavioral risk analysis to help your team recognize unusual access, extraction patterns, and changes in identity behavior.
Small extractions. A larger pattern.
Repeated reads can add up. Nanori evaluates extraction over longer windows against measured history to surface changes worth investigating.
Requires sufficient measured history and available row or byte measurements.
- Observe the activity
- Compare across time
- Investigate the finding
A familiar account. Unfamiliar behavior.
A service account used interactively. A dormant identity active again. Changes in sources, tools, or hours give your team reasons to examine the activity.
Unusual behavior is a reason to investigate, not proof of compromise.
- Review usual behavior
- Examine the change
- Follow the associated activity
New privileges. Sensitive data.
A privilege grant followed by a sensitive read connects two actions into a more consequential sequence. Nanori surfaces that sequence for investigation.
Requires observable privilege activity and the relevant sensitivity context.
- A privilege is granted
- Sensitive data is read
- Review the connected sequence
Different application users.One shared database account.
Different application users.One shared database account.
Alex MorganUnusual activity
Emma BennettApplication session
Daniel ReedApplication session
01 / APPLICATION
Different people.
Individual sessions carry the context of who is using the application.
02 / SHARED DATABASE ACCOUNT
One account.
The application connects through a shared database identity.
03 / DATABASE
Activity with context.
Nanori Trace helps connect database activity to the person behind it. Available with Nanori or independently for another compatible monitoring product.
Application-user attribution depends on the context provided by the application. A reason to investigate, not a verdict about the person.
THE INVESTIGATION / NANORI OVERSIGHT
Follow the activity.Find the context.
Investigate captured SQL, database accounts, and available application-user context together in Nanori Oversight.
03 / SAMMY, YOUR AI COMPANION
Your trusted companion.At every step ofthe investigation.
Sammy helps your analysts build searches, understand SQL, and explore risk findings. Less manual work. More time to investigate.
01 / 06
Start with a question. Sammy helps your analyst turn it into a focused search.
04 / FOLLOW THE EVIDENCE
A finding opens the investigation.
Review the reasons behind an alert, inspect associated activity, and bring related alerts together into an incident your team can work through.
Understand the finding.
Severity, reasons, and observed behavior.
Examine the activity.
Relevant statements and identity context.
Work the incident.
Group related alerts, assign, review, and close.
DATABASE AUDITING & SENSITIVE DATA
Know what matters. Decide what to keep.
Understand sensitive-data exposure.
Review sensitive-column findings, classification certainty and observed readers. Classification is built from the database traffic Nanori observes.
Shape your audit policy.
Choose which matching events retain full details, which retain summaries, and which are counted without being stored. Set retention to fit your audit requirements.
Take the evidence with you.
Export Events search results as CSV or Parquet for further analysis and audit workflows.
05 / HOW NANORI FITS
See how it all connects.
Application identity. Database activity.One place to investigate.
Alex MorganApplication user
Emma BennettApplication user
Daniel ReedApplication user
Separate application users can share one database account. Flow connects application users, applications, database accounts and tables.
IDENTITY AT THE APPLICATION
Nanori Trace
Nanori Trace is the optional application component that adds user context to database queries. Use it with Nanori or independently for another compatible monitoring product.
CAPTURE AT THE SOURCE
Nanori Lens
Nanori Lens captures traffic on the database host and sends it to Oversight. Your application connects to the database; capture runs alongside it. Nanori Lens and Nanori Oversight are deployed together.
INVESTIGATE IN CONTEXT
Nanori Oversight
Explore database activity, behavioral and identity risk, and the context behind an event. Sammy helps your team explore activity and understand captured SQL.
06 / START A CONVERSATION
What would you like to understand about your database activity?
Tell us about your environment and what your team needs to investigate.
We will use your details to respond to your inquiry.