QubeSight shows who touched which data, from where and how. It centrally collects all activity across your databases (user, source IP, SQL statement and object accessed), parses every query, detects risky access to sensitive data in real time and produces verifiable evidence for audits. It works alongside IBM Guardium or on its own, and your data stays on your infrastructure.
Lab measurements. The capacity of your own environment can be measured in the product under Settings → Benchmark.
QubeSight stores records in a compressed, columnar format, so each query reads only the columns it needs. Searches and reports that can take minutes in traditional database activity monitoring tools built on row-based storage complete in under a second with QubeSight.
Test environment measurement (November 2026): 8 vCPU server, 6 ClickHouse threads and about 5.6 GB of memory, with live ingestion running. Each query was run 7 times; the server-side median is shown.
Example scenario: a service account accesses card data outside business hours, from a client it has never used before. Follow, step by step, how QubeSight collects the event, analyses it, raises an alert and turns it into audit evidence.
app_batch is a service account that normally connects during business hours from the same application server. In this scenario it connects from a previously unseen IP address, using a desktop SQL client.
QubeSight maintains a behavioural baseline for every account by time, source and client, and records any deviation from it.
The activity record arrives from IBM Guardium via syslog, SNMP or archive, or from the database's native audit log. Vector parses it, Redpanda queues it, the worker analyses it and ClickHouse stores it.
The pipeline is designed to be lossless: new records are never deleted, even when disk capacity runs out.
The worker parses each statement into a syntax tree rather than matching text, identifying every object accessed, including tables in joins and subqueries.
The sensitive data catalogue recognises the national_id and pan columns and maps them to the applicable regulation, such as PCI DSS.
Each record is evaluated against the rule set as it is written. Built-in detections cover brute-force attempts, SQL injection, bulk deletion, privilege escalation and insider data exfiltration, and organisation-specific rules can be added.
In this example all four conditions are met, so the event is classified as critical.
The alert is delivered through the configured channels: email, syslog over TLS to your SIEM, or webhook. Notifications can be sent in English or Turkish.
A false positive can be turned into a suppression rule in a single step, using the link in the alert email.
Mindmap shows the user's sessions with their open and close times, the statements in each session, the tables accessed and any violations, all in a single view.
Security operations teams can assess the scope of an incident in minutes, without sifting through raw logs.
Records are retained in an immutable archive, and Guardium archives are verified with SHA-256. A signed evidence pack can be provided directly in response to an audit request.
Evidence for PCI DSS and data-protection audits is available from the moment the event occurs.
The analysis runs entirely in your browser; nothing you enter is sent anywhere.
A simplified in-browser demo. QubeSight itself uses a full SQL syntax tree and built-in classification rules.
When the record volume from a source rises above its normal level, QubeSight detects it and asks the responsible person by email. Handling false positives and expected peaks does not require logging in to the console; the button in the email is enough.
Volume over the last hours is compared with a 7-day baseline, identifying the combination of user, source IP and application that exceeds its normal level.
The email states the size of the increase, the source affected and the recommended action. The decision is made with the button in the email, without signing in.
The ignore period is chosen on the confirmation screen. The rule is added to the Guardium policy automatically and removed when the period ends. Every decision is kept in the audit log.
The built-in assistant turns a request written in plain language into a report query. The model runs on your premises and no data leaves your network. You can also connect your organisation's own language model.
Just write what you need. The assistant determines the user, operation, object and time-range filters, summarises the result and opens the report in the Reports screen with one click, where it can be exported or added to a scheduled delivery.
QubeSight works with your existing AI infrastructure: it provides data, supports analysis and triggers action workflows. A local model is used by default, and no data is sent outside your organisation.
The screens below are taken directly from the product.
Brute-force attempts, five types of SQL injection, bulk deletion, schema changes, privilege escalation and insider data exfiltration are monitored out of the box. Every indicator can be drilled down to the underlying statements.
The Assurance Center answers audit questions such as who accessed sensitive data, whether segregation of duties is in place and whether backups have been verified, using live data, and summarises them in a single assurance score.
QubeSight ingests Guardium data in real time via syslog and SNMP, restores Guardium archives and verifies every archive file with SHA-256. It continuously monitors the health of your Guardium infrastructure and reports issues as they occur.
Runs on three nodes, or two nodes plus a witness: virtual IP, replicated ClickHouse and PostgreSQL, and automatic failover. The live cluster map shows connections between services down to the port level.
No additional agent rollout is required. QubeSight ingests from the log sources you already have and delivers to the channels you already use.
No QubeSight cloud account, no outbound telemetry and no third-party service dependency. Designed with the requirements of financial services and the public sector in mind.
An offline installation package that needs no internet access; a browser-based setup wizard or a single command.
The web interface, intra-cluster traffic, Kafka (SASL/SCRAM) and syslog transport are all encrypted.
LDAP / Active Directory, enterprise SSO, built-in two-factor authentication and segregation of duties.
Ed25519-signed patches; the new version starts alongside the current one and rolls back automatically on failure.
Licensing is based on the number of monitored databases, not on log volume. Both editions are also available on AWS Marketplace.
Freeno database limit
Per databaseannual subscription · request a quote
The Community and Enterprise editions are available on AWS Marketplace. QubeSight runs on a single EC2 instance in your account, and your data never leaves it.
Let us show you how QubeSight works with your own Guardium or audit logs in a 30-minute session.
or write to us directly at info@fklabs.co.
