MySQL Enterprise Firewall •If related applications share protection requirements, associate each application with its own acccount, then add these application accounts as members of the same group profile. Alternatively, configure all the applications to use the same account and associate them with an account profile for that account. Statement matching performed by the firewall does not use SQL statements as received from clients. Instead, the server converts incoming statements to normalized digest form and firewall operation uses these digests. The benefit of statement normalization is that it enables similar statements to be grouped and recognized using a single pattern. For example, these statements are distinct from each other: But all of them have the same normalized digest form: By using normalization, firewall allowlists can store digests that each match many different statements received from clients. For more information about normalization and digests, see Section 27.10, “Performance Schema Statement Digests and Sampling” . Setting the  max_digest_length  system variable to zero disables digest production, which also disables server functionality that requires digests, such as MySQL Enterprise Firewall. Each profile registered with the firewall has its own operational mode, chosen from these values: • OFF : This mode disables the profile. The firewall considers it inactive and ignores it. • RECORDING : This is the firewall training mode. Incoming statements received from a client that matches the profile are considered acceptable for the profile and become part of its “fingerprint.”  The firewall records the normalized digest form of each statement to learn the acceptable statement patterns for the profile. Each pattern is a rule, and the union of the rules is the profile allowlist. • PROTECTING : In this mode, the profile allows or prevents statement execution. The firewall matches incoming statements against the profile allowlist, accepting only statements that match and rejecting those that do not. After training a profile in  RECORDING  mode, switch it to  PROTECTING  mode to harden MySQL against access by statements that deviate from the allowlist. If the  mysql_firewall_trace system variable is enabled, the firewall also writes rejected statements to the error log. • DETECTING : This mode detects but not does not block intrusions (statements that are suspicious because they match nothing in the profile allowlist). In  DETECTING  mode, the firewall writes suspicious statements to the error log but accepts them without denying access. When a profile is assigned any of the preceding mode values, the firewall stores the mode in the profile. Firewall mode-setting operations also permit a mode value of  RESET , but this value is not stored: setting a profile to  RESET  mode causes the firewall to delete all rules for the profile and set its mode to  OFF . A difference between group and account profiles is that statement recording for a group profile can be limited to statements received from a single group member (the training member). Firewall Statement Matching Warning Profile Operational Modes 1553 SELECT first_name, last_name FROM customer WHERE customer_id = 1; select first_name, last_name from customer where customer_id = 99; SELECT first_name, last_name FROM customer WHERE customer_id = 143; SELECT ‘first_name‘ , ‘last_name‘ FROM ‘customer‘ WHERE ‘customer_id‘ = ?