MySQL Enterprise Firewall To avoid unexpected behavior when a particular account is specified as the training account for a group profile, always ensure that account is a member of the group. After the additional training, set the group profile back to  PROTECTING  mode: CALL mysql.sp_set_firewall_group_mode(’fwgrp’, ’PROTECTING’); The training account established by  sp_set_firewall_group_mode_and_user()  is saved in the group profile, so the firewall remembers it in case more training is needed later. Thus, if you call sp_set_firewall_group_mode()  (which takes no training account argument), the current profile training account,  member4@localhost , remains unchanged. To clear the training account if it actually is desired to enable all group members to perform training in RECORDING  mode, call  sp_set_firewall_group_mode_and_user()  and pass a  NULL  value for the account argument: CALL mysql.sp_set_firewall_group_mode_and_user(’fwgrp’, ’RECORDING’, NULL); It is possible to detect intrusions by logging nonmatching statements as suspicious without denying access. First, put the group profile in  DETECTING  mode: CALL mysql.sp_set_firewall_group_mode(’fwgrp’, ’DETECTING’); Then, using a member account, execute a statement that does not match the group profile allowlist. In DETECTING  mode, the firewall permits the nonmatching statement to execute: In addition, the firewall writes a message to the error log: To disable a group profile, change its mode to  OFF : CALL mysql.sp_set_firewall_group_mode( group , ’OFF’); To forget all training for a profile and disable it, reset it: CALL mysql.sp_set_firewall_group_mode( group , ’RESET’); The reset operation causes the firewall to delete all rules for the profile and set its mode to  OFF . MySQL Enterprise Firewall enables profiles to be registered that correspond to individual accounts. To use a firewall account profile to protect MySQL against incoming statements from a given account, follow these steps: 1559 1. Register the account profile and put it in  RECORDING  mode. 2. Connect to the MySQL server using the account and execute statements to be learned. This trains the account profile and establishes the rules that form the profile allowlist. Registering Firewall Account Profiles Note mysql>  SHOW TABLES LIKE ’customer%’; +------------------------------+ | Tables_in_sakila (customer%) | +------------------------------+ | customer | | customer_list | +------------------------------+ [Note] Plugin MYSQL_FIREWALL reported: ’SUSPICIOUS STATEMENT from ’member1@localhost’. Reason: No match in allowlist. Statement: SHOW TABLES LIKE ?’