24 Reporting and Auditing

Oracle Adaptive Access Manager provides access to a rich set of forensic data to power investigations and auditing:

24.1 Configuring OAAM Reports

Oracle Adaptive Access Manager reports enable you to use Oracle BI Publisher as the reporting solution. Oracle Adaptive Access Manager reports use Oracle BI Publisher to query and report on information in the OAAM schema.

24.1.1 What is Oracle BI Publisher?

Oracle BI Publisher is an Oracle's enterprise reporting solution and provides a single reporting environment to author, manage, and deliver all of your reports and business documents. Utilizing a set of familiar desktop tools, such as Microsoft Word, Microsoft Excel, or Adobe Acrobat, you can create and maintain report layouts based on data from diverse sources

The Oracle Business Intelligence Publisher Administrator's Guide explains how to use Oracle BI Publisher to create reports. You can access the Oracle Business Intelligence Publisher Administrator's Guide by searching for it on the Oracle Technology Network web site.

The Oracle Business Intelligence Publisher Documentation Library is available on the Oracle Technology Network web site. You can access the Oracle Technology Network Website at:

http://www.oracle.com/technology/index.html

24.1.2 Setting Up Oracle BI Publisher for OAAM Reports and Fusion Middleware Audit

When your data resides in a database, you can run pre-defined Oracle Business Intelligence Publisher (Oracle BI Publisher) reports and create your own reports on the data. This section contains these topics about configuring Oracle BI Publisher for OAAM reports:

For performance reasons, it is recommended to replicate production data into a reporting database and to provide a dedicated reporting environment for Oracle BI Publisher.

For information on how to configure audit reporting and view audit reports, refer to "Using Audit Analysis and Reporting" in Oracle Fusion Middleware Application Security Guide.

24.1.2.1 Acquiring and Installing Oracle BI Publisher

OAAM uses Oracle BI Publisher to generate your OAAM reports.

Perform the following steps to acquire and install Oracle BI Publisher:

  1. Go to Oracle Technology Network web site at http://www.oracle.com/technetwork/index.html

  2. Locate the Oracle BI Publisher Download page by searching on the key words Oracle BI Publisher or Oracle BI Publisher Download.

  3. Review the Oracle Technology Network License Agreement that appears on the Oracle BI Publisher Download page. You must accept the Oracle Technology Network License Agreement to download Oracle BI Publisher.

  4. Download the version of Oracle BI Publisher that is appropriate for your operating system by clicking on the appropriate link.

  5. Install Oracle BI Publisher by referring to the Oracle Business Intelligence Publisher Installation Guide. Refer to Oracle Business Intelligence Publisher Documentation for information about accessing the Oracle Business Intelligence Publisher Installation Guide.

  6. Verify your Oracle BI Publisher is operational before installing and configuring the OAAM reports.

24.1.2.2 Copying OAAM Reports to the Reporting Database

This section explains how to install Oracle BI Publisher OAAM reports. You must install Oracle BI Publisher and verify it is operational before installing the OAAM reports. Refer to the Oracle Fusion Middleware Business Intelligence Publisher Reports Administrator's Guide for Oracle Identity Management for more information.

Perform the following steps to install the reports:

  1. Stop the Oracle BI Publisher server. Refer to Oracle Business Intelligence Publisher Documentation if you need more information.

  2. On your OAAM host, locate the OAAM products reports package from the /IAM_HOME/oaam/reports directory and extract the contents to a location on your Oracle BI Publisher server. For example:

    /ORACLE_BI_PUBLISHER_HOME/xmlp/XMLP/reports

  3. Copy the properties.xml file to any directory in Oracle BI Publisher server's file system.

  4. Start the Oracle BI Publisher server. Refer to Oracle Business Intelligence Publisher Documentation if you need more information.

24.1.2.3 Set Up the Data Source for OAAM Reports

Perform the following steps to configure the data source for the reports:

  1. Configure the JDBC Data Source for the reports by performing the following steps:

    1. Log in to Oracle BI Publisher from a Web browser as an Administrator. Refer to Oracle Business Intelligence Publisher Documentation if you need more information.

    2. Click the Admin tab, then click JDBC under Data Sources, and then click the Add Data Source button. The Add Data Source screen appears.

    3. Enter the following information in the fields on the Add Data Source screen. Replace the variable values in the following examples with the actual values for your Oracle Adaptive Access Manager database.

      Field Data to Enter

      Data Source Name

      ARM

      For the Oracle Adaptive Access Manager reports to work out-of-the-box, the JDBC data source must be named as "ARM". If you choose a different name, you must modify the data source property in all reports.

      Connection String

      jdbc:oracle:thin:@host:port:sid

      User Name

      User name for a database schema user that has access to Oracle Adaptive Access Manager.

      Password

      Password for user identified in the User Name field.

      Database Driver Class

      oracle.jdbc.driver.OracleDriver


    4. Click the Test Connection button to test the connection to the JDBC Data Source. You will receive the Connection established successfully message if your connection is successful.

      If you do not receive the Connection established successfully message, verify the data you entered is accurate and check if the OAAM database is running.

    5. Click the Apply button on the Add Data Source screen after you have received the Connection established successfully message.

  2. Configure the AdminProperties Data Source. The AdminProperties contains configuration information that Oracle BI Publisher will need to read when generating the reports.

    1. Click the Admin tab, then click File under Data Sources, and then click the Add Data Source button. The Add Data Source screen appears.

    2. Enter the following information in the fields on the Add Data Source screen:

      Field Data to Enter

      Data Source Name

      AdminProperties

      You must name this Data Source AdminProperties.

      Full Path of Top-level Directory

      Path must be the directory where you copied properties.xml.


    The configuration for the data source is complete. Refer to the Oracle Fusion Middleware Business Intelligence Publisher Reports Administrator's Guide for Oracle Identity Management to generate reports for Oracle Adaptive Access Manager.

  3. Click Reports, Shared Folders, and then oaam.

    Reports are grouped under Common, KBA, OTP, Security, Users, Devices, Location, Performance, and Summary.

  4. Choose any report from these groupings.

  5. Choose any output type and click View.

24.1.3 Viewing/Running Reports

This section explains how to view/run reports.

Take these steps to view/run a report:

  1. Log in to Oracle BI Publisher using a URL of the form:

    http://host.domain.com:port/xmlpserver/

  2. Click Shared Folders, OAAM, and then oradb.

  3. Click View for the report you want to generate.

  4. Select an output format for the report and click View.

    The report is generated. See Oracle Business Intelligence Publisher Documentation to learn more about Oracle BI Publisher.

24.1.4 Setting Preferences

You can set the Report Locale, User Interface Language, Time Zone, and Accessibility Mode for Oracle BI Publisher.

  • Report Locale- A locale is a language and territory combination (for example, English (United States) or French (Canada)). Oracle BI Publisher uses the report locale selection to determine the template translation to apply, the number formatting and date formatting to apply to the report data.

  • User Interface Language- The User Interface language is the language that your user interface displays in. The language that you selected at login will be selected as the default. However, you can choose from the languages that are available for your installation through this option.

  • Time Zone - Select the time zone to apply to your reports. Reports run by you (this user) will display the time according to the time zone preference selected here.

  • Accessibility Mode- Setting this to "On" will display the report catalog in a tree structure that is accessible via keyboard strokes

For more information on setting preferences, refer to the "Setting My Account Preferences and Viewing My Groups" chapter of the Oracle Fusion Middleware Report Designer's Guide for Oracle Business Intelligence Publisher.

24.1.5 Adding Translations for the Oracle BI Publisher Catalog and Reports

In release 11g, Oracle BI Publisher supports two types of translation:

  • Catalog Translation

  • Template (or layout) Translation

Catalog translation enables the extraction of translatable strings from all objects contained in a selected catalog folder into a single translation file; this file can then be translated and uploaded back to Oracle BI Publisher and assigned the appropriate language code.

Catalog translation extracts not only translatable strings from the report layouts, but also the user interface strings that are displayed to users, such as catalog object descriptions, report parameter names, and data display names.

Users viewing the catalog will see the item translations appropriate for the user interface language they selected in their My Account preferences. Users will see report translations appropriate for the Report Locale they selected in their My Account preferences.

Template translation enables the extraction of the translatable strings from a single RTF-based template (including sub templates and style templates) or a single Oracle BI Publisher layout template (.xpt file). Use this option when you only need the final report documents translated. For example, your enterprise requires translated invoices to send to German and Japanese customers.

For information describing the process of downloading and uploading translation files, refer to the "Adding Translations for the BI Publisher Catalog and Reports" of the Oracle Fusion Middleware Administrator's and Developer's Guide for Oracle Business Intelligence Publisher.

24.1.6 Localizing Reports

If you want to localize reports perform the following steps:

  1. Unzip oaam_reports_translations.zip. The oaam_reports_translations.zip is in the same directory as the reports you installed earlier. Refer to Section 24.1.2.2, "Copying OAAM Reports to the Reporting Database."

  2. In the Oracle BI Publisher catalog, select the OAAM folder.

  3. Click the option to Import XLIFF.

  4. Upload the Catalog_*.xlf file for the languages you want to use.

24.1.7 Scheduling a Report

Oracle BI Publisher Enterprise enables you to schedule reports, and deliver the executed output to various destinations. Oracle BI Publisher Scheduler is configured as a part of Oracle BI Enterprise Edition installation process. Ensure that the scheduler is configured properly, before you start scheduling the reports.

For information on scheduling reports, refer to "Creating Report Jobs" in the Oracle Fusion Middleware Report Designer's Guide for Oracle Business Intelligence Publisher.

24.1.8 OAAM Reports

OAAM provides a range of out-of-the-box reports that are accessible through Oracle Business Intelligence Publisher.

24.1.8.1 Common Reports

These reports provide data based on device location or login information.

Report Name Description

RecentLogins

Lists all logins in the specified time range.


24.1.8.2 Devices Reports

These reports provide data based on the device information.

Report Name Description

DeviceIdScoring

Displays Device ID scoring summary for the designated date range.

MultipleFailures

Lists all devices with multiple login failures in the specified time range.

MultipleUsers

Lists all devices that have multiple users.


24.1.8.3 KBA Reports

These reports provide data based on the KBA information.

Report Name Description

ChallengeStatistics

Lists challenge response statistics.

For example,

Users with Failure counter > 0 - failures more than none (have at least failed once)

Users with multiple failures - failures more than one (have failed multiple times)

QuestionStatistics

Lists challenge question statistics.

Registration

Lists question registration statistics.


Note:

Updated statistics are not available immediately after a user is challenged or answers a question. The Oracle BI Publisher reports are generated from the database and database updates do not occur in real-time for the statistics.

24.1.8.4 Location Reports

These reports provide data based on the location information.

Report Name Description

CountryAggregates

Displays country aggregate summary for the designated date range.

MultipleUsers

Lists all locations that have multiple users.

StateAggregates

Displays state aggregate summary for the designated date range.


24.1.8.5 Performance Reports

These reports provide data based on the performance information.

Report Name Description

RulesAPIPerformance

Displays the Average Processing time and counts for Rule API calls for the designated date range.

RulesPerformance

Displays the Average Processing time, runtime, and counts for the rules in the designated date range.

TrackerAPIPerformance

Displays the Average Processing time and counts for Tracker API calls for the designated date range.


24.1.8.6 Security Reports

These reports provide data based on the security information.

Report Name Description

AlertsBreakdown

Displays alert breakdown summary for the designated date range.

PostAuthScoring

Displays post-authorization scoring summary for the designated date range.

PreAuthScoring

Displays pre-authorization scoring summary for the designated date range.

RulesBreakdown

Displays rules breakdown summary for the designated date range.

ScoringCombinations

Displays score combination summary for the designated date range.


24.1.8.7 Summary Reports

These reports provide summaries for date ranges.

Report Name Description

AveragesSummary

Displays average summary for the designated date range.

LoginSummary

Displays login aggregate summary for the designated date range.


24.1.8.8 Users Reports

These reports provide data based on the user information.

Report Name Description

MultipleDevices

Lists all users that use multiple devices.


24.1.9 Creating Custom OAAM Reports

If you have additional reporting requirements beyond the out of the box reports described in Section 24.1.8, "OAAM Reports", you can create custom reports. You may want to refer to the Oracle Adaptive Access Manager Database Schema chapter in the Oracle Fusion Middleware Reference for Oracle Identity Management. It describes the OAAM schema, which is useful when building custom reports. This section discusses advanced report creation.

To create a custom OAAM report, you must perform the following tasks:

An example is provided for your reference.

In code listings OAAM table and field names are bold and italic.

24.1.9.1 Creating a Data Model

Refer to the instructions in Creating a New Report in the Oracle Business Intelligence Publisher Report Designer's Guide:

http://download.oracle.com/docs/cd/E12844_01/doc/bip.1013/e12187/T518230T518233.htm

24.1.9.2 Mapping User Defined Enum Numeric Type Codes to Readable Names

Several fields in many tables are numeric type codes, which correspond to OAAM User Defined Enums. Refer to the Oracle Fusion Middleware Developer's Guide for Oracle Adaptive Access Manager for more information on OAAM User Defined Enums. Information on how to map those type codes to readable names is presented in this section.

There are two methods for resolving these names, and the one to choose depends on whether you need to display in English only or in internationalized strings.

24.1.9.2.1 Results Display

To display a readable string rather than a type code value in the report output, the report writer will need to add a join to the tables that hold the User Defined Enums, and then add the field to the select clause.

24.1.9.2.2 English Only User Defined Enum Result Display

The following SQL code shows how to add the join criteria to the query:

SELECT …
FROM …
LEFT OUTER JOIN (
      SELECT enumElement.num_value, enumElement.label
      FROM v_b_enum enum
             INNER JOIN v_b_enum_elmnt enumElement ON on enum.enum_id = enum_element.enum_id
      WHERE enum.prop_name = 'enum name') alias
      ON table.type_field = alias.num_value
…

In this code, table.type_field is the field containing a type code value that you want to replace with a string. Alias is the name you are giving the inner select clause. Finally, enum_name is the property name of the User Defined Enum.

To display in the report, you need to add alias.label to the select clause.

24.1.9.2.3 Internationalized User Defined Enum Result Display

The following SQL code shows how to add the join criteria to the query:

SELECT …
FROM …
LEFT OUTER JOIN (
      SELECT t0.config_value, element.num_value
      FROM v_b_config_rb t0
      INNER JOIN (
             SELECT enum_element.num_value, enum_element.str_value, enum.prop_name
             FROM v_b_enum enum
                   INNER JOIN v_b_enum_elmnt enum_element ON enum.enum_id = enum_element.enum_id
             WHERE enum.prop_name = 'enum name') element
             ON t0.config_name=element.prop_name || '.' || element.str_value || '.name'
      WHERE t0.locale_id = (
             SELECT locale_id FROM v_b_locale
             WHERE language = substr(:xdo_user_ui_locale, 1, 2)
                   AND country = substr(:xdo_user_ui_locale, 4, 2)
                   AND (substr(:xdo_user_ui_locale, 1, 2) in ('de', 'en', 'es', 'fr', 'it', 'ja', 'ko')
                         OR (substr(:xdo_user_ui_locale, 1, 2) = 'pt' AND substr(:xdo_user_ui_locale, 4, 2) = 'BR')
                         OR (substr(:xdo_user_ui_locale, 1, 2) = 'zh' AND substr(:xdo_user_ui_locale, 4, 2) IN ('CN', 'TW')))
             UNION SELECT locale_id FROM v_b_locale
             WHERE language = substr(:xdo_user_ui_locale, 1, 2)
                   AND NOT EXISTS(SELECT locale_id FROM v_b_locale
                   WHERE language = substr(:xdo_user_ui_locale, 1, 2)
                         AND country = substr(:xdo_user_ui_locale, 4, 2))
                         AND country IS NULL
                         AND (substr(:xdo_user_ui_locale, 1, 2) in ('de', 'en', 'es', 'fr', 'it', 'ja', 'ko')
                               OR (substr(:xdo_user_ui_locale, 1, 2) = 'pt' AND substr(:xdo_user_ui_locale, 4, 2) = 'BR')
                               OR (substr(:xdo_user_ui_locale, 1, 2) = 'zh' AND substr(:xdo_user_ui_locale, 4, 2) IN ('CN', 'TW'))) 
             UNION SELECT locale_id FROM v_b_locale
             WHERE language = 'en'
                   AND NOT (substr(:xdo_user_ui_locale, 1, 2) in ('de', 'en', 'es', 'fr', 'it', 'ja', 'ko')
                         OR (substr(:xdo_user_ui_locale, 1, 2) = 'pt' AND substr(:xdo_user_ui_locale, 4, 2) = 'BR')
                         OR (substr(:xdo_user_ui_locale, 1, 2) = 'zh' AND substr(:xdo_user_ui_locale, 4, 2) IN ('CN', 'TW'))))
      ORDER BY t0.config_name) alias
      ON table.type_field = alias.num_value
…

In this code, table.type_field is the field containing a type code value that you want to replace with a string. Alias is the name you want to give the inner select clause. Finally, enum_name is the property name of the User Defined Enum.

To display in the report, you need to add alias.config_value to the select clause.

24.1.9.3 Adding Lists of Values

Add parameters to your report definition to enable your users to interact with the report and specify the data of interest from the data set.

To allow a user to select from a list of readable strings representing type codes, the report writer will need to create a List of Values (LOV) from a query on the User Defined Enums tables, filtered by the enum name.

24.1.9.3.1 User Defined Enums as List of Values for Filtering, English Only

The following listing shows how to write the query to populate the list of values.

SELECT enumElement.label, enumElement.num_value
FROM v_b_enum enum
      INNER JOIN v_b_enum_elmnt enumElement ON on enum.enum_id = enumElement.enum_id
WHERE enum.prop_name = 'enum name'
ORDER BY enumElement.label

The following listing shows how to filter the report based on this LOV.

WHERE …
AND (:parameter IS NULL OR :parameter = table.type_field)

In these listings, enum_name is the property name of the User Defined Enum, table.type_field is the field containing a type code value that you want to replace with a string, and parameter is the named parameter. Review the Oracle BI Publisher User's Guide for information about creating and setting up report parameters.

24.1.9.3.2 User Defined Enums as List of Values for Filtering, Internalized

The following listing shows how to write the query to populate the list of values.

SELECT t0.config_value, element.num_value
FROM v_b_config_rb t0
INNER JOIN (
      SELECT enum_element.num_value, enum_element.str_value, enum.prop_name
      FROM v_b_enum enum
             INNER JOIN v_b_enum_elmnt enum_element ON enum.enum_id = enum_element.enum_id
      WHERE enum.prop_name = 'enum name') element
      ON t0.config_name=element.prop_name || '.' || element.str_value || '.name'
WHERE t0.locale_id = (
      SELECT locale_id FROM v_b_locale
      WHERE language = substr(:xdo_user_ui_locale, 1, 2)
             AND country = substr(:xdo_user_ui_locale, 4, 2)
             AND (substr(:xdo_user_ui_locale, 1, 2) in ('de', 'en', 'es', 'fr', 'it', 'ja', 'ko')
                   OR (substr(:xdo_user_ui_locale, 1, 2) = 'pt' AND substr(:xdo_user_ui_locale, 4, 2) = 'BR')
                   OR (substr(:xdo_user_ui_locale, 1, 2) = 'zh' AND substr(:xdo_user_ui_locale, 4, 2) IN ('CN', 'TW')))
      UNION SELECT locale_id FROM v_b_locale
      WHERE language = substr(:xdo_user_ui_locale, 1, 2)
             AND NOT EXISTS(SELECT locale_id FROM v_b_locale
             WHERE language = substr(:xdo_user_ui_locale, 1, 2)
                   AND country = substr(:xdo_user_ui_locale, 4, 2))
                   AND country IS NULL
                   AND (substr(:xdo_user_ui_locale, 1, 2) in ('de', 'en', 'es', 'fr', 'it', 'ja', 'ko')
                         OR (substr(:xdo_user_ui_locale, 1, 2) = 'pt' AND substr(:xdo_user_ui_locale, 4, 2) = 'BR')
                         OR (substr(:xdo_user_ui_locale, 1, 2) = 'zh' AND substr(:xdo_user_ui_locale, 4, 2) IN ('CN', 'TW'))) 
      UNION SELECT locale_id FROM v_b_locale
      WHERE language = 'en'
             AND NOT (substr(:xdo_user_ui_locale, 1, 2) in ('de', 'en', 'es', 'fr', 'it', 'ja', 'ko')
                   OR (substr(:xdo_user_ui_locale, 1, 2) = 'pt' AND substr(:xdo_user_ui_locale, 4, 2) = 'BR')
                   OR (substr(:xdo_user_ui_locale, 1, 2) = 'zh' AND substr(:xdo_user_ui_locale, 4, 2) IN ('CN', 'TW'))))
ORDER BY t0.config_name

The filtering is done in the same manner as the English Only version.

24.1.9.4 Adding Geolocation Data

The OAAM schema includes tables that map IP address ranges to location data including city, state, and country. The relevant tables are VCRYPT_IP_LOCATION_MAP, VCRYPT_CITY, VCRYPT_STATE, and VCRYPT_COUNTRY. Many tables contain IP addresses, and VCRYPT_IP_LOCATION_MAP contains foreign keys to each of VCRYPT_CITY, VCRYPT_STATE, and VCRYPT_COUNTRY.

In OAAM, IP addresses are stored as long numerals. The following listing shows how join a table containing an IP address to the VCRYPT_IP_LOCATION_MAP.

SELECT ...
FROM vcrypt_tracker_usernode_logs logs
      INNER JOIN vcrypt_ip_location_map loc ON (
             logs.remote_ip_addr >= loc.from_ip_addr AND logs.remote_ip_addr <= loc.from_ip_addr
      )

For user input and display purposes, you will normally want to use the standard four-part IP address. The following listing shows how to display a numeric IP address as a standard IP, where ipField is the field or parameter containing the numeric IP address you want to display.

…
to_char(to_number(substr(to_char(ipField, 'XXXXXXXX'), 1, 3), 'XX')) || '.' ||
      to_char(to_number(substr(to_char(ipField, 'XXXXXXXX'), 4, 2), 'XX')) || '.' ||
      to_char(to_number(substr(to_char(ipField, 'XXXXXXXX'), 6, 2), 'XX')) || '.' ||
      to_char(to_number(substr(to_char(ipField, 'XXXXXXXX'), 8, 2), 'XX'))
...

The following listing shows how to convert a standard IP address to the long numeric format.

…
to_number(substr(ipField, 1, instr(ipField, '.')-1))*16777216 +
      to_number(substr(ipField, instr(ipField, '.', 1, 1)+1, instr(ipField, '.', 1, 2)-instr(ipField, '.', 1, 1)-1))*65536 +
      to_number(substr(ipField, instr(ipField, '.', 1, 2)+1, instr(ipField, '.', 1, 3)-instr(ipField, '.', 1, 2)-1))*256 +
      to_number(substr(ipField, instr(ipField, '.', 1, 3)+1))

24.1.9.5 Adding Sessions and Alerts

Sessions and alerts exist in the VCRYPT_TRACKER_USERNODE_LOGS and VCRYPT_ALERT tables, respectively. They join to each other via the REQUEST_ID field, and they each join to the geolocation data via the VCRYPT_IP_LOCATION_MAP table via the BASE_IP_ADDR field.

24.1.9.5.1 Type Code Lookups

The session table and the alert table have several type code fields that may be translated into readable text by following the instructions to look up the user defined enums by name. The following tables will list the type code fields and the name of the user defined enum.

Table 24-1 VCRYPT_TRACKER_USERNODE_LOGS

Field Name User Defined Enum Name

AUTH_STATUS

auth.status.enum

AUTH_CLIENT_TYPE_CODE

auth.client.type.enum


Table 24-2 VCRYPT_ALERT

Field Name User Defined Enum Name

ALERT_LEVEL

alert.level.enum

ALERT_TYPE

alert.type.enum

ALERT_STATUS

alert.status.enum

RUNTIME_TYPE

profile.type.enum


24.1.9.6 Example

This report will show a list of sessions, with user id, login id, auth status, and location. To start with, you will need to create two date parameters, fromDate and toDate. The query will look like this:

SELECT s.request_id, s.user_id, s.user_login_id, auth.label, country.country_name, state.state_name,
city.city_name
FROM vcrypt_tracker_usernode_logs s
      INNER JOIN vcrypt_ip_location_map loc ON s.base_ip_addr = loc.base_ip_addr
      INNER JOIN vcrypt_country country ON loc.country_id = country.country_id
      INNER JOIN vcrypt_state loc ON loc.state_id = country.state_id
      INNER JOIN vcrypt_city city ON loc.city_id = city.city_id
      LEFT OUTER JOIN (
             SELECT enumElement.num_value, enumElement.label
             FROM v_b_enum enum
                   INNER JOIN v_b_enum_elmnt enumElement ON on enum.enum_id = enum_element.enum_id
             WHERE enum.prop_name = 'auth.status.enum') auth
             ON s.auth_status = auth.num_value
WHERE (:fromDate IS NULL OR s.create_time >= :fromDate)
      AND (:toDate IS NULL OR s.create_time <= :toDate)
ORDER BY s.create_time DESC

24.1.9.7 Adding Layouts to the Report Definition

Oracle BI Publisher offers several options for designing templates for your reports. Refer to the Oracle Business Intelligence Publisher Report Designer's Guide for instructions.

24.1.10 Building OAAM Transactions Reports

This section explains how you can build transaction reports. It contains the following topics:

24.1.10.1 Getting Entities and Transactions Information

To obtain the Transaction Definition key and Entity Definition keys, follow these steps:

  1. Log in to the OAAM Administration Console and go to Transactions menu and search for the transaction definitions you are interested in.

  2. Go to the General tab and note down the Definition Key of the transaction. This is the "Transaction Definition Key" of the transaction.

  3. Go to the Entities tab of the transaction and note down distinct list Entity Name.

  4. Choose the Entities menu option to search for Entities and note the Key of each of those entities. That is the "Entity Definition Key" of the entities.

24.1.10.2 Discovering Entity Data Mapping Information

To discover entity data mapping information that you will need to create your report, follow the procedures in this section.

24.1.10.2.1 Information about Data Types

For your reference, number data types are listed in the following table.

Table 24-3 Information about Data Types

Data Type Description

1

Represents String data

2

Represents Numeric data. Data stored is equal to (Original value * 1000).

3

Date type data. Store the data in "'YYYY-MM-DD HH24:MI:SS TZH:TZM" format and also retrieve it using same format.

4

Boolean data. Stored as strings. "True" represents TRUE and "False" represents FALSE


24.1.10.2.2 Discover Entity Data Details Like Data Type, Row and Column Mappings

To get the entity data details that you will need to construct your report, follow these steps:

  1. Get the Entity Definition Key by looking at the entity definition using the OAAM Administration Console.

  2. Get details of how entity data is mapped using the SQL Query:

    SELECT label,
      data_row,
      data_col,
      data_type
    FROM vt_data_def_elem
    WHERE status =1
    AND data_def_id =
      (SELECT data_def_id
      FROM vt_data_def_map
      WHERE relation_type   ='data'
      AND parent_obj_type   =3
      AND parent_object_id IN
        (SELECT entity_def_id
        FROM vt_entity_def
        WHERE entity_def_key=<Entity Definition Key>
        AND status =1
        )
      )
    ORDER BY data_row ASC,
      data_col ASC;
    
24.1.10.2.3 Build Entity Data SQL Queries and Views

The above SQL query gives a list of data fields of the entity with data type and row, column position. Using that information, build a SQL query based on the following information that represents data of the given entity. It is also recommended to create/build a view based on this SQL query that represents data of the given entity.

Note:

EntityRowN represents an entity data row. If your entity has 3 distinct data_row values from the above query then you would have 3 EntityRows, name the aliases as EntityRow1, EntityRow2, and so on, and similarly take care of the corresponding joins as shown below.

SELECT ent.ENTITY_ID,
    ent.EXT_ENTITY_ID,
    ent.ENTITYNAME,
    ent.ENTITY_KEY,
    ent.ENTITY_TYPE,
    EntityRowN<row>.DATA<col> <column_name>,
    (EntityRowN<row>.NUM_DATA<col>/ 1000.0) <numeric_column_name>,
    to_timestamp_tz(EntityRowN<row>.DATA<col>, 'YYYY-MM-DD HH24:MI:SS TZH:TZM') <date_column_name>,
    ent.CREATE_TIME,
    ent.UPDATE_TIME,
    ent.EXPIRY_TIME,
    ent.RENEW_TIME
  FROM 
    VT_ENTITY_DEF entDef,
    VT_ENTITY_ONE ent
    LEFT OUTER JOIN VT_ENTITY_ONE_PROFILE EntityRowN
          ON (EntityRowN.ENTITY_ID    = ent.ENTITY_ID
          AND EntityRowN.ROW_ORDER    = <row>
          AND EntityRowN.EXPIRE_TIME IS NULL)
    LEFT OUTER JOIN VT_ENTITY_ONE_PROFILE EntityRowN+1
        ON (EntityRowN+1.ENTITY_ID    = ent.ENTITY_ID
          AND EntityRowN+1.ROW_ORDER    = <row+1>
        AND row1.EXPIRE_TIME IS NULL)
  WHERE 
        ent.ENTITY_DEF_ID      = entDef.ENTITY_DEF_ID and 
        entDef.ENTITY_DEF_KEY=<Entity Definition Key>

24.1.10.3 Discovering Transaction Data Mapping Information

To discover transaction data mapping information that you will need to create your report, follow the procedures in this section.

24.1.10.3.1 Discover Transaction data details like Data Type, Row and Column mappings

To get entity data details you will need to construct your report, follow these steps:

  1. Get list of transaction to entity definition mapping Ids using the following SQL:

    SELECT map_id
    FROM 
    vt_trx_ent_defs_map,
            vt_trx_def
    WHERE 
    vt_trx_ent_defs_map.trx_def_id = vt_trx_def.trx_def_id
    AND vt_trx_def.trx_def_key  =<Transaction Definition Key>
    
  2. Use the following SQL query to get details of all transaction data fields, their data type and their row, column mapping:

    SELECT label,
      data_row,
      data_col,
      data_type
    FROM vt_data_def_elem
    WHERE status    =1
    AND data_def_id =
      (SELECT data_def_id
      FROM vt_data_def_map
      WHERE relation_type   ='data'
      AND parent_obj_type   =1
      AND parent_object_id IN
        (SELECT trx_def_id
        FROM vt_trx_def
        WHERE trx_def_key='mayo_pat_rec_acc'
        AND status       =1
        )
      )
    ORDER BY data_row ASC,
      data_col ASC;
    
24.1.10.3.2 Build Transaction Data SQL Queries and Views

Use the information from the previous section and build a SQL query that represents transaction data based on the following:

Note: It is recommended to build a view based on this query so that it is easier to build reports

SELECT trx.LOG_ID,
    trx.USER_ID,
    trx.REQUEST_ID,
    trx.EXT_TRX_ID,
    trx.TRX_TYPE,
    trx.STATUS,
    trx.SCORE,
    trx.RULE_ACTION,
    trx.TRX_FLAG,
    trx.POST_PROCESS_STATUS,
    trx.POST_PROCESS_RESULT,
    TxnDataRowN<row>.DATA<col> <data_column_name>,
   (TxnDataRowN<row>.NUM_DATA<col>/ 1000.0) <numeric_column_name>,
    to_timestamp_tz(TxnDataRowN<row>.DATA<col>, 'YYYY-MM-DD HH24:MI:SS TZH:TZM') <date_column_name>,
    (SELECT entTrxMap.MAP_OBJ_ID
    FROM VT_ENT_TRX_MAP entTrxMap
    WHERE entTrxMap.DEF_MAP_ID = <Transaction to Entity Mapping Id of Entity1_Name>
    AND entTrxMap.TRX_ID       = trx.LOG_ID
    ) <EntityN_Name>,
    (SELECT entTrxMap.MAP_OBJ_ID
    FROM VT_ENT_TRX_MAP entTrxMap
    WHERE entTrxMap.DEF_MAP_ID = <Transaction to Entity Mapping Id of Entity2_Name>
    AND entTrxMap.TRX_ID       = trx.LOG_ID
    ) <EntityN+1_Name>,
    trx.CREATE_TIME,
    trx.UPDATE_TIME,
    TRUNC(trx.create_time, 'HH24') created_hour,
    TRUNC(trx.create_time, 'DDD') created_day,
    TRUNC(trx.create_time, 'DAY') created_week,
    TRUNC(trx.create_time, 'MM') created_month,
    TRUNC(trx.create_time, 'YYYY') created_year
  FROM VT_TRX_DEF trxDef,
    VT_TRX_LOGS trx
  LEFT OUTER JOIN VT_TRX_DATA TransactionDataRowN
  ON (TransactionDataRowN.TRX_ID         = trx.LOG_ID
  AND TransactionDataRowN.ROW_ORDER      = <rowN>)
LEFT OUTER JOIN VT_TRX_DATA TransactionDataRowN+1
  ON (TransactionDataRowN+1.TRX_ID         = trx.LOG_ID
  AND TransactionDataRowN+1.ROW_ORDER      = <rowN+1>)
  WHERE trx.TRX_DEF_ID      = trxDef.TRX_DEF_ID  and
trxDef.TRX_DEF_KEY=<Transaction Definition Key>

24.1.10.4 Building Transaction Reports

Follow the instructions in this section to build reports for entities and transactions.

24.1.10.4.1 Building Entity Data Reports

Use the SQL Queries or Views built using the information mentioned in Section 24.1.10.2.3, "Build Entity Data SQL Queries and Views."

24.1.10.4.2 Building Transaction Data Reports

Use the SQL Queries or Views built using the information mentioned in Section 24.1.10.3.2, "Build Transaction Data SQL Queries and Views."

24.1.10.4.3 Joining Entity Data Tables and Transaction data tables

You can join the transaction data views you built with entity data view using VT_ENT_TRX_ MAP.MAP_OBJ_ID which is indicated using the pseudo column <EntityN_Name>.

24.2 Auditing OAAM Events

The Fusion Middleware Audit Framework leverages Oracle BI Publisher to audit data recorded to an audit database. By using Oracle BI Publisher, you can take advantage of powerful reporting features such as flexible report display, filtering, scheduling, and custom reporting.

24.2.1 Introduction to Auditing

Oracle Adaptive Access Manager uses the Oracle Fusion Middleware Common Audit Framework to support auditing for a number of events. The Oracle Fusion Middleware Common Audit Framework provides uniform logging.

While auditing can be enabled or disabled, it is normally enabled in production environments. Auditing has minimal performance impact, and the information captured by auditing can be useful (even mission-critical).

Audit data can be written to either a single, centralized Oracle Database instance or to flat files known as bug-stops. Regardless of where the audit record is stored, it contains a sequence of items that can be configured to meet particular requirements. The audit log file helps the audit administrator track errors and diagnose problems if the audit framework is not working properly.

24.2.2 About Audit Record Storage

Database Logging: Implements the Common Auditing Framework across a range of Oracle Fusion Middleware products. The benefit is audit-function commonality at the platform level.

Database Audit Store: In production environments, Oracle recommends using a database audit store to provide scalability and high-availability for the Common Audit Framework. Audit data is cumulative and grows over time. Ideally this is a database for only audit data; not used by other applications.

The Oracle Fusion Middleware Audit Framework schema for audit log tables is provided by the Oracle Fusion Middleware Repository Creation Utility (RCU), which must be run before you can log information to the database.

24.2.3 Oracle Adaptive Access Manager Events You Can Audit

OAAM events are those generated when the Oracle Adaptive Access Manager Console is used.

The OAAM events that can be audited and the details captured in them are listed in this section. These event definitions and configurations are implemented as part of the audit service in Oracle Platform Security Services.

24.2.3.1 Customer Care Events

Customer Care events are shown in Table 24-4.

Table 24-4 Customer Care Events

Event Event Data

Create CSR Case

CaseId, UserGroupName, UserId, CaseSeverity, Description

Update Cases

CaseId, CaseSeverity, CaseStatus, CaseDisposition, CaseExpirationDurationInHrs, ActionNotes, CaseActionResult

Change Status

CaseId, CaseStatus, CaseDisposition, ActionNotes, CaseActionResult

Perform Case Action

CaseId, CaseActionEnum, CaseSubActionEnum, ActionNotes, CaseActionResult

Get Challenge Question

CaseId, ActionNotes, CaseChallengeQuestion

Check Challenge Question Response

CaseId, ActionNotes, CaseChallengeQuestion, CaseChallengeQuestionResult


24.2.3.2 KBA Questions Events

KBA Questions events are listed in Table 24-5.

Table 24-5 KBA Questions Events

Event Event Data

Create KBA Category

KBACategoryId, KBACategoryName, KBACategoryDetails

Update KBA Category

KBACategoryId, KBACategoryName, KBACategoryDetails

Delete KBA Categories

KBACategoryIds

Create KBA Question

KBAQuestionId, KBAQuestion, KBAQuestionDetails

Update KBA Question

KBAQuestionId, KBAQuestion, KBAQuestionDetails

Delete KBA Questions

KBAQuestionIds

Create KBA Validation

KBAValidationId, KBAValidationName, KBAValidationDetails

Update KBA Validation

KBAValidationId, KBAValidationName, KBAValidationDetails

Delete KBA Validation

KBAValidationIds

Add KBA Validation to Global

KBAValidationId

Delete KBA Validation from Global

KBAValidationId

Update KBA Answer Logic

KBAAnswerLogicDetails

Update KBA Registration Logic

KBARegistrationLogicDetails


24.2.3.3 Policy Management Events

Policy Management events are listed in Table 24-6.

Table 24-6 Policy Management Events

Event Event Data

Create Policy

PolicyId, PolicyName, PolicyDetails

Copy Policy

SourcePolicyId, PolicyName, PolicyDetails

Update Policy

PolicyId, PolicyName, PolicyDetails

Delete Policy

PolicyIds

Add Override

PolicyId, PolicyOverrideRowId, PolicyOverrideDetails

Update Overrides

PolicyId, PolicyOverrideIds, PolicyOverrideDetails

Delete Overrides

PolicyId, PolicyOverrideIds

Link Policy To Group

PolicyId, GroupId, ActionNotes

Unlink Policy from Groups

PolicyId, GroupIds

Create Rule

PolicyId, RuleId, RuleName, RuleDetails

Add Conditions to Rule

PolicyRuleMapId, RuleConditionIds

Update Rule in Policy

PolicyId, RuleId, RuleName, RuleDetails

Copy Rule to Policy

PolicyId, PolicyRuleMapDetails

Delete Rules from Policy

PolicyRuleMapIds

Update Rules Order in Policy

PolicyRuleMapId, RuleConditionMapIds

Update Rule Parameter values

PolicyRuleMapId, RuleConditionMapId, RuleParamValueDetails


24.2.3.4 Policy Set Management Events

Policy set management events are listed in Table 24-7.

Table 24-7 Policy Set Management Events

Event Event Data

Policy Set Update

UpdatePolicySet

Policy Set Save Score

SaveScoreActions

Policy Set Save Action

SaveActionOverrides

Policy Set Delete Score

DeleteScoreActions

Policy Set Delete Action

Delete Action Overrides


24.2.3.5 Group/List Management Events

Group/List Management events are listed in Table 24-8.

Table 24-8 Group Management Events

Event Event Data

Add Group

GroupId, GroupName, GroupDetails

Update Group

GroupId, GroupName, GroupDetails

Delete Groups

GroupIds

Add Group Elements

GroupId, GroupElementsDetails

Update Group Element

GroupId, GroupElementId, GroupElementValue

Delete Group Elements

GroupId, GroupElementIds

Delete all Group Elements

GroupId


24.2.3.6 Pattern Management Events

Pattern management events are listed in Table 24-9.

Table 24-9 Pattern Management Events

Event Event Data

Pattern Update Status

UpdatePattern

Pattern Create

CreatePattern

Pattern Update

UpdatePatternStatus

Pattern Delete

DeletePattern

Pattern Add Parameter

AddParam

Pattern Update Parameter

UpdateParam

Pattern Delete Parameter

DeleteParams

Pattern Update Parameter Order

UpdateParamsOrder


24.2.3.7 Dynamic Action Management Events

Dynamic action management events are listed in Table 24-10.

Table 24-10 Dynamic Action Management Events

Event Event Data

Dynamic Action Create

CreateDynamicAction

Dynamic Action Update

UpdateDynamicAction

Dynamic Action Delete

DeleteDynamicActions

Dynamic Action Create Instance

CreateDynamicActionInstance

Dynamic Action Update Instance

UpdateDynamicActionInstance

Dynamic Action Update Status

UpdateDynamicActionInstanceStatus

Dynamic Action Delete Instance

DeleteDynamicActionInstances


24.2.3.8 Entity Management Events

Entity Management events are listed in Table 24-11.

Table 24-11 Entity Management Events

Event Event Data

Entity Create

CreateEntityDef

Entity Update

 

Entity Update Status

UpdateEntityDefStatus

Entity Delete

DeleteEntityDefs

Entity Save Data

SaveDataElements

Entity Delete Data

DeleteDataElements

Entity Add ID

AddIDSchemeElements

Entity Update ID

UpdateIDSchemeElements

Entity Delete ID

DeleteIDSchemeElements

Entity Add Display

AddDisplayElements

Entity Update Display

UpdateDisplayElements

Entity Delete Display

DeleteDisplayElements

Entity Create Reference

CreateEntityDefsRelation

Entity Update Reference

UpdateEntityDef

Entity Delete Reference

DeleteEntityDefsRelations


When an update to attributes/properties of an entity definition is performed, the following audit events are triggered:

  • Update Entity Def

  • Update ID Scheme Elements

  • Save Data Elements

24.2.3.9 Transaction Management Events

Transaction management events are listed in Table 24-12.

Table 24-12 Transaction Management Events

Event Event Data

Transaction Create

CreateTransactionDef

Transaction Update

UpdateTransactionDef

Transaction Update Status

UpdateTransactionDefStatus

Transaction Delete

DeleteTransactionDef

Transaction Add Entity

AddTransactionEntityDefMap

Transaction Update Entity

UpdateTransactionEntityDefMap

Transaction Delete Entity

DeleteTransactionEntityDefMaps

Transaction Save Data

SaveTransactionDataElemDefs

Transaction Delete Data

DeleteTransactionDataElemDefs

Transaction Save Source

SaveTransactionSourceDataElemDefs

Transaction Delete Transaction Source Data Element Definitions

DeleteTransactionSourceDataElemDefs

Transaction Set Data Map

SetTransactionDataMapping

Transaction Delete Data Map

DeleteTransactionDataMappings

Transaction Set Entity Map

SetTransactionEntityDataMapping

Transaction Delete Entity Map

DeleteTransactionEntityDataMappings


When an update to attributes/properties of a transaction definition occurs, an audit event is triggered as well as audit events of related APIs. For example, when the transaction "save source" is performed the following audit events are also triggered:

  • Save transaction data-element defs

  • Update a transaction definition

24.2.3.10 Snapshot Management Events

Snapshot management events are listed in Table 24-13.

Table 24-13 Snapshot Management Events

Event Event Data

Snapshot Create

CreateSnapshotInDB

Snapshot Store

StoreSnapshot

Snapshot Commit Diff

CommitDiff

Snapshot Delete

DeleteSnapshots


24.2.3.11 OAAM Server Administration Events

OAAM Server Administration events are listed in Table 24-14

Table 24-14 OAAM Server Administration Utility Events

Event Event Data

Property Create

Create Property

Property Delete

UpdateProperty

Property Update

DeleteProperties


24.2.3.12 User Detail Events

User events are listed in Table 24-15.

Table 24-15 User Events

Event Event Data

Get Login

GetUserRecentLogins

Get Session Data

GetSessionData

Get User Transaction

GetUserTransaction

Get Transaction Details

GetUserTransactionDetails

Get Checkpoint

GetUserCheckpointDetails


24.2.3.13 Import Events

Import events are listed in Table 24-16.

Table 24-16 Import Events

Event Event Data

Import Policy

ImportPolicies

Import KBA

ImportKBAQuestions

Import Dynamic Action

ImportDynamicActions

Import Transaction

ImportTransactions

Import Pattern

ImportPatterns

Import Entity

ImportEntities

Import Condition

ImportConditions

Import Group

ImportGroups

Import Property

ImportProperties

Import Validation

ImportValidations


24.2.4 Setting Up Auditing for Oracle Adaptive Access Manager

Oracle Adaptive Access Manager can be configured to write audit records to a central database. In production environments, Oracle recommends using a database audit store to provide scalability and high-availability for the Common Audit Framework. Audit data is cumulative and grows over time. Ideally this is a database for only audit data; not used by other applications.

Configuring auditing for Oracle Adaptive Access Manager as follows:

  1. Run the Oracle Fusion Middleware Repository Creation Utility (RCU) against the database, as described in "Create the Audit Schema using RCU" in the Oracle Fusion Middleware Repository Creation Utility User's Guide.

  2. Set up audit data sources for the audit loader and configure it for the OAAM Server as described in "Set Up Audit Data Sources" in the Oracle Fusion Middleware Application Security Guide.

  3. Enable the audit Policy and Audit Store by using Fusion Middleware Control.

  4. Set up Oracle Business Intelligence Publisher audit reports.

  5. Restart the WebLogic Server.

For information on deploying auditing, refer to "Configuring and Managing Auditing" in the Oracle Fusion Middleware Application Security Guide.

24.2.4.1 Create the Audit Schema using Repository Creation Utility

To switch to a database as the permanent store for your audit records, you first use the Oracle Fusion Middleware Repository Creation Utility (RCU) to create a database store for audit data.

Before you begin, make sure to collect the details on which database to use, along with the DBA credentials to use. Create the audit schema using RCU by selecting Audit Services when running RCU. When running RCU, and selecting the OAAM component, it does not select Audit by default. Hence, by default, the audit data is on a file system (IAMDomain/servers/AdminServer/logs/auditlogs/JPS/audit.log) rather than a database. If you want to use audit in production, it is advised to configure the audit schema when running RCU.

24.2.4.2 Configure a Data Source for the Audit Database

After you create a database schema to store audit records in a database, you must set up an Oracle WebLogic Server audit data source that points to that schema.

Define a JDBC data source for the audit database by using the WebLogic Administration Console so that the WebLogic server can access the database. You must configure the data source on the administration server and on all WebLogic managed server instances running Oracle Adaptive Access Manager server. Refer to the Oracle Fusion Middleware Application Security Guide for specific steps to follow to configure the data source.

24.2.4.3 Enable Auditing

Enable Audit Policy and Audit Store by using Fusion Middleware Control.

An audit policy is a declaration of the type of events to be captured by the audit framework for a particular component.

  1. Change auditing store from file to database: navigate to the WebLogic Domain, then IAM_Domain, then Security, then Audit Store. Specify the JNDI name of the data source for the audit database.

  2. Enable audit policies: navigate to the WebLogic Domain, then IAM_Domain, then Security, then Audit Policy.

24.2.4.4 Set Up Oracle Business Intelligence Publisher Audit Reports

You must install Oracle BI Publisher and verify it is operational before installing the Fusion Middleware Audit reports. Refer to Oracle Business Intelligence Publisher Documentation if you need more information.

Perform the following steps to set up standard Oracle BI Publisher audit reports in their default formats out-of-the-box.

  1. Stop the Oracle BI Publisher server. Refer to Oracle Business Intelligence Publisher Documentation if you need more information.

  2. Unjar the AuditReportTemplates.jar to a location on your Oracle BI Publisher server. For example:

    /ORACLE_BI_PUBLISHER_HOME/xmlp/XMLP/reports

    You can find AuditReportTemplates.jar at $MW_ORA_HOME/oracle_common/modules/oracle.iau_<version>/reports/AuditReportTemplates.jar.

  3. Start the Oracle BI Publisher server. Refer to Oracle Business Intelligence Publisher Documentation if you need more information.

  4. Configure the JDBC Data Source for the reports by performing the following steps:

    1. Log in to Oracle BI Publisher from a Web browser as an Administrator. Refer to Oracle Business Intelligence Publisher Documentation if you need more information.

    2. Click the Admin tab, then click JDBC under Data Sources, and then click the Add Data Source button. The Add Data Source screen appears.

    3. Enter the following information in the fields on the Add Data Source screen. Replace the variable values in the following examples with the actual values for your audit schema.

      Field Data to Enter

      Data Source Name

      Audit

      Provide a name for the data source.

      Connection String

      jdbc:oracle:thin:@host:port:sid

      User Name

      User name for a audit schema user.

      Password

      Password for user identified in the User Name field.

      Database Driver Class

      oracle.jdbc.driver.OracleDriver


  5. Test for a successful connection. If the connection is not successful, check the values you entered.

  6. Click Apply.

24.2.4.5 Restart the WebLogic Server

Restart WebLogic Server instances: You must restart all the WebLogic Server instances (the admin server and all the managed server instances in the domain). During the restart, the audit loader rereads the audit store configuration and starts using the database for auditing.

24.2.5 Generate Fusion Middleware Audit Framework Reports

To generate Fusion Middleware Audit Framework reports in Oracle BI Publisher, perform the following steps:

  1. Log in to Oracle BI Publisher.

  2. Select the Reports tab.

  3. Click More to expose the list of standard reports, including audit reports.

  4. Click Oracle_Fusion_Middleware_Audit, then navigate to the report you want to run.

  5. Use filter options in the top part of the report page to filter reported data in various ways. Report data appears on the bottom part of the report page.

For information, refer to "Using Audit Analysis and Reporting" in Oracle Fusion Middleware Application Security Guide.

24.2.6 Run the Fusion Middleware Common User Activities Reports

Perform the following steps to run the Fusion Middleware common user activities reports in Oracle BI Publisher:

  1. Log in to Oracle BI Publisher.

  2. Select the Reports tab.

  3. Click More to expose the list of standard reports, including audit reports.

  4. Click Oracle_Fusion_Middleware_Audit, then navigate to the report you want to run.

  5. Select All Events.

24.2.7 Set Up Audit Report Filters

You can use the standard audit reports in their default formats out-of-the-box. However, if you want to customize the scope of data and other related aspects of the reports, you do so by setting up audit report filters.

For information, refer to "Using Audit Analysis and Reporting" in Oracle Fusion Middleware Application Security Guide.

24.2.8 Configure Scheduler in Oracle Business Intelligence Publisher

Clicking on the report's Schedule button brings up a page which you can use to schedule and administer the report.

For information on customizing audit reports, refer to "Using Audit Analysis and Reporting" in Oracle Fusion Middleware Application Security Guide.

24.2.9 Design and Create Custom Reports

The data in the database audit store is exposed through OAAM reports. OAAM audit reports are not available with Oracle Adaptive Access Manager out of the box. Oracle Fusion Middleware Audit Framework ships with a set of pre-defined reports that are designed to work, out-of-the-box, with Oracle Fusion Middleware components, but you can design and create custom reports with Oracle Business Intelligence Publisher's complete set of capabilities for designing and creating custom reports.

For information, refer to "Using Audit Analysis and Reporting" in Oracle Fusion Middleware Application Security Guide.

24.3 Use Cases

The following section provides a scenario of how Oracle Adaptive Access Manager's reports are used.

24.3.1 Use Case: BIP Reports

You are Marty, a business analyst for Acme Corp. You have been asked to gather some aggregate data on the impact to customers by the Oracle Adaptive Access Manager security system.

Directions: Run the KBA challenge statistics report and rules aggregate breakdown report. Also run the recent logins report, filtering for sessions that resulted in a block. Run all the reports with XLS output so you can share the results with your business unit.

24.3.1.1 Description

This use case demonstrates how to use Oracle BI Publisher.

24.3.1.2 Steps

This use case demonstrates how to use Oracle BI Publisher reports.

  1. Log in to Oracle BI Publisher as an Analyst.

  2. Select OAAM under Shared Folders.

  3. Under oaam folder, select oradb.

  4. Locate the report to run.

    1. Under the Common folder, click RecentLogins to view the RecentLogins report.

    2. Under the KBA folder, click ChallengeStatistics to view the Challenge Statistics report.

    3. Under the KBA folder, click QuestionStatistics to view the QuestionStatistics report

    4. Under the Security folder, click RulesBreakdown to view the RulesBreakdown report.

  5. For the RecentLogins report, select Blocked in Auth Status as a search criteria.

  6. Repeat the following steps for each report.

    1. Click View.

    2. In Template menu, select Excel2000 and click Export.

24.3.2 Use Case: LoginSummary Report

The LoginSummary displays login aggregate summary for the designated date range.

  1. Log in to Oracle BI Publisher using a URL of the form:

    http://host.domain.com:port/xmlpserver/

  2. In the main page, click OAAM under Shared Folders and then oradb.

  3. Under the Security folder, click LoginSummary to view the LoginSummary report.

    The Login Summary Report opens with the default time range of one month.

    The summary graph shows the following:

    • The count of sessions

    • The count of users

    • The count of registrations

    • The count of blocks

  4. Save or export the report as desired.