When an application or client sends an SQL request statement to the Data Vault, the Dynamic Data Masking Rule Engine applies the connection and security rules that you configure to the SQL request.

If the SQL request queries any columns that you configured to trigger the audit, the Dynamic Data Masking Rule Engine rewrites the SQL request to append an audit tag.

After the Rule Engine appends an audit tag to the SQL statement, the Dynamic Data Masking service sends the rewritten statement to the Data Vault. Data Vault recognizes the appended audit tags, and the Data Vault server writes the audit information to the audit log.

To extract the audit information from the audit log, use the Data Vault SQL Worksheet or a third-party SQL tool to run the

EXTRACT FROM AUDIT

command. The

EXTRACT FROM AUDIT

command extracts the audit information that you specify in the command and writes the information to a formatted CSV file.

The following figure shows the audit log components: