I am building basecheck, a database auditing tool. It currently supports PostgreSQL, SQL Server, Oracle, Supabase (preview), SQLite and the goal is to support more databases over time.
There is a standalone agent CLI that can be used in free or paid mode. The free mode includes six control packs with 61 controls and SIEM delivery to generic HTTP or syslog destinations. The paid mode allows you to run more control packs and use basecheck platform features.
The free packs cover concrete states: PostgreSQL SSL, password encryption, superuser and PUBLIC schema exposure; SQL Server `sa`, `xp_cmdshell`, sysadmin membership, and password policy; Oracle default accounts and audit settings; Supabase RLS and grants; and SQLite integrity and journal safety. Supabase is in preview. If you believe the free mode should definitely include some more controls, let me know.
Findings can be written to JSON or sent to an existing HTTP or syslog collector. If you just want to test, `--test-siem` sends a test event without running a scan.
The source is available under BSL 1.1 and free for internal use.
Repo and release: https://github.com/baselabs-io/basecheck-agent
Native SIEM connectors are not built yet (I could not install one on my laptop:)). If you run a SIEM, I’d be glad to build and test one with you.