MySQL Enterprise Firewall CREATE USER ’member1’@’localhost’ IDENTIFIED BY ’ password ’; GRANT ALL ON sakila.* TO ’member1’@’localhost’; 2. Use the  sp_set_firewall_group_mode()  stored procedure to register the group profile with the firewall and place the profile in  RECORDING  (training) mode: 3. Use the  sp_firewall_group_enlist()  stored procedure to add an initial member account for use in training the group profile allowlist: 4. To train the group profile using the initial member account, connect to the server as  member1  from the server host so that the firewall sees a session account of  member1@localhost . Then execute some statements to be considered legitimate for the profile. For example: CALL mysql.sp_set_firewall_group_mode(’fwgrp’, ’RECORDING’); CALL mysql.sp_firewall_group_enlist(’fwgrp’, ’member1@localhost’); SELECT title, release_year FROM film WHERE film_id = 1; UPDATE actor SET last_update = NOW() WHERE actor_id = 1; SELECT store_id, COUNT(*) FROM inventory GROUP BY store_id; The firewall receives the statements from the  member1@localhost  account. Because that account is a member of the  fwgrp  profile, which is in  RECORDING  mode, the firewall interprets the statements as applicable to  fwgrp  and records the normalized digest form of the statements as rules in the  fwgrp allowlist. Those rules then apply to all accounts that are members of  fwgrp . Until the  fwgrp  group profile receives statements in  RECORDING  mode, its allowlist is empty, which is equivalent to “deny all.”  No statement can match an empty allowlist, which has these implications: •The group profile cannot be switched to  PROTECTING  mode. It would reject every statement, effectively prohibiting the accounts that are group members from executing any statement. •The group profile can be switched to  DETECTING  mode. In this case, the profile accepts every statement but logs it as suspicious. 5. At this point, the group profile information is cached, including its name, membership, and allowlist. To see this information, query the Performance Schema firewall tables: Note mysql>  SELECT MODE FROM performance_schema.firewall_groups WHERE NAME = ’fwgrp’; mysql>  SELECT * FROM performance_schema.firewall_membership WHERE GROUP_ID = ’fwgrp’ ORDER BY MEMBER_ID; mysql>  SELECT RULE FROM performance_schema.firewall_group_allowlist WHERE NAME = ’fwgrp’; +-----------+ | MODE | +-----------+ | RECORDING | +-----------+ +----------+-------------------+ | GROUP_ID | MEMBER_ID | +----------+-------------------+ | fwgrp | member1@localhost | +----------+-------------------+ +----------------------------------------------------------------------+ | RULE | +----------------------------------------------------------------------+ 1556