I just wanted to mention that this product has the capability of capturing queries and match them to a particular login session. Given this there may be other r

I just wanted to mention that this product has the capability of capturing queries and match them to a particular login session. Given this there may be other reasons why this particular query stood out after reviewing administrative queries for irregularities or using some of the analytics available in the IBM product. There's a couple of ways this could have come up and it depends on a particular security team's policy and review strategy. They may have been able to look at the rest of the queries in the session to have an immediate feel that something totally irregular was happening. Generally you get used to the application traffic/change requests/administrative surgery style of queries after monitoring a particular database for a while so when something new comes up it immediately looks weird, like a log message for a familiar daemon you've never seen before.