1. A method of determining a web application user as a source of database activity comprising: receiving, via a first thread, a communication associated with a web application user, the web application user having authenticated to a web application using a first set of credentials; associating a second thread spawned by the web application in response to the communication, with the web application user, wherein the association is based at least in part on mapping a session identifier of the second thread to an identifier associated with the web application user; associating the web application user with a database query generated by the second thread, wherein the second thread uses a second set of credentials, that are independent of the web application user and associated with the web application, to access a database for the database query, the database being separate from the web application, wherein associating the web application user with a database query comprises generating a dummy query containing an indicator associated with web application user; providing the dummy query to a downstream database security monitor to indicate that the database query is associated with the web application user, wherein the dummy query is ignored by the database, and wherein the dummy query indicates that any subsequent queries received from the web application over the second thread are associated with the web application user; and providing an interface for auditing and intrusion detection functionality, wherein the interface allows identification of a user associated with a database anomaly using at least in part the dummy query provided to the downstream database security monitor.