Oracle® Audit Vault Auditor's Guide Release 10.2.3 Part Number E11058-01 |
|
|
View PDF |
This appendix contains:
This appendix lists the audit event names and IDs, and the attribute names and data types for Oracle Database. The audit events are organized by their respective categories; for example, Account Management. You can use these audit events as follows:
For alerts. When you create an alert, you can specify an audit event, based on its category, that can trigger the alert. See Section 2.11.2 for more information.
For custom reports using third-party tools. If you want to create custom reports using third-party tools, refer to the tables in this appendix when you design the reports. See Appendix A, "Oracle Audit Vault Data Warehouse Schema" for more information about custom reports created with third-party tools.
Account management events track SQL statements that affect user accounts, such as creating users or altering their profiles. The Account Management Report, described in Section 3.4.1, uses these events.
Table B-1 lists the Oracle Database account management events and event IDs.
Table B-1 Oracle Database Account Management Events and Event IDs
Event Name | Event ID |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
Table B-2 lists the Oracle Database account management event attributes.
Table B-2 Oracle Database Account Management Event Attributes
Attribute Name | Data Type |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Footnote 1 SQL_BIND
variable could be truncated to 4000 characters.
Footnote 2 SQL_TEXT
variable could be truncated to 4000 characters.
Application management events track actions that were performed on the underlying PL/SQL procedures or functions of system services and applications, such as ALTER FUNCTION
statements. The Procedure Management Report, described in Section 3.4.4, uses these events.
Table B-3 lists the Oracle Database application management events and event IDs.
Table B-3 Oracle Database Application Management Events and Event IDs
Event Name | Event ID |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Table B-4 lists the Oracle Database application management event attributes.
Table B-4 Oracle Database Application Management Event Attributes
Attribute Name | Data Type |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Footnote 1 SQL_BIND
variable could be truncated to 4000 characters.
Footnote 2 SQL_TEXT
variable could be truncated to 4000 characters.
Audit command events track the use of AUDIT
SQL statements on other SQL statements and on database objects. The Audit Command Report, described in Section 3.4.2, uses these events.
Table B-5 lists the Oracle Database audit events and event IDs.
Table B-5 Oracle Database Audit Events and Event IDs
Event Name | Event ID |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
Table B-6 lists the Oracle Database audit command event attributes.
Table B-6 Oracle Database Audit Command Event Attributes
Attribute Name | Data Type |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Footnote 1 SQL_BIND
variable could be truncated to 4000 characters.
Footnote 2 SQL_TEXT
variable could be truncated to 4000 characters.
Data access events track audited data manipulation language (DML) activities, for example, all SELECT
, INSERT
, UPDATE
, or DROP
SQL statements. The Data Access Report, described in Section 3.3.2, uses these events.
Table B-7 lists the Oracle Database data access events and event IDs.
Table B-7 Oracle Database Data Access Events and Event IDs
Event Name | Event ID |
---|---|
|
|
|
|
|
|
|
|
|
|
Table B-8 lists the Oracle Database data access event attributes.
Table B-8 Oracle Database Data Access Event Attributes
Attribute Name | Data Type |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Footnote 1 SQL_BIND
variable could be truncated to 4000 characters.
Footnote 2 SQL_TEXT
variable could be truncated to 4000 characters.
Oracle Database Vault events track audited Oracle Database Vault activity. The Oracle Database Vault Report, described in Section 3.3.3, uses these events.
Table B-9 lists the Oracle Database Vault events and event IDs.
Table B-9 Oracle Database Vault Events and Event IDs
Event Name | Event ID |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Table B-10 lists the Oracle Database Vault event attributes.
Table B-10 Oracle Database Vault Event Attributes
Attribute Name | Data Type |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Exception events track audited error and exception activity, such as network errors. The Exception Report, described in Section 3.5.1, uses these events.
Table B-11 lists the Oracle Database exception events and event IDs.
Table B-12 lists the Oracle Database exception event attributes.
Table B-12 Oracle Database Exceptional Event Attributes
Attribute Name | Data Type |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Footnote 1 SQL_BIND
variable could be truncated to 4000 characters.
Footnote 2 SQL_TEXT
variable could be truncated to 4000 characters.
Invalid record events track audited activity that Audit Vault could not understand, possibly due to a corrupted audit record. The Invalid Audit Record Report, described in Section 3.5.2, uses these events.
Table B-13 lists the Oracle Database invalid record events and event IDs.
Table B-13 Oracle Database Invalid Record Events and Event IDs
Event Name | Event ID |
---|---|
|
|
Table B-14 lists the Oracle Database invalid record event attributes.
Table B-14 Oracle Database Invalid Record Event Attributes
Attribute Name | Data Type |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Footnote 1 SQL_BIND
variable could be truncated to 4000 characters.
Footnote 2 SQL_TEXT
variable could be truncated to 4000 characters.
Object management events track audited actions performed on database objects, such as CREATE TABLE
statements. The Object Management Report, described in Section 3.4.3, uses these events.
Table B-15 lists the Oracle Database object management events and event IDs.
Table B-15 Oracle Database Object Management Events and Event IDs
Event Name | Event ID |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Table B-16 lists the Oracle Database object management event attributes.
Table B-16 Oracle Database Object Management Event Attributes
Attribute Name | Data Type |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Footnote 1 SQL_BIND
variable could be truncated to 4000 characters.
Footnote 2 SQL_TEXT
variable could be truncated to 4000 characters.
Peer association events track database link statements. The Distributed Database Report, described in Section 3.3.4, uses these events.
Table B-17 lists the Oracle Database peer association events and event IDs.
Table B-17 Oracle Database Peer Association Events and Event IDs
Event Name | Event ID |
---|---|
|
|
|
|
Table B-18 lists the Oracle Database peer association event attributes.
Table B-18 Oracle Database Peer Association Event Attributes
Attribute Name | Data Type |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Footnote 1 SQL_BIND variable could be truncated to 4000 characters.
Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.
Role and privilege management events track audited role and privilege management activity, such creating of roles and privileges. The Role and Privilege Management Report, described in Section 3.4.5, uses these events.
Table B-19 lists the Oracle Database role and privilege management events and event IDs.
Table B-19 Oracle Database Role and Privilege Management Events and Event IDs
Event Name | Event ID |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Table B-20 lists the Oracle Database role and privilege management event attributes.
Table B-20 Oracle Database Role and Privilege Management Event Attributes
Attribute Name | Data Type |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Footnote 1 SQL_BIND
variable could be truncated to 4000 characters.
Footnote 2 SQL_TEXT
variable could be truncated to 4000 characters.
Service and application utilization events track audited application access activity, such as the execution of PL/SQL procedures or functions. The Procedure Executions Report, described in Section 3.3.5, uses these events.
Table B-21 lists the Oracle Database service and application utilization events and event IDs.
Table B-21 Oracle Database Service and Application Utilization Events and Event IDs
Event Name | Event ID |
---|---|
|
|
|
|
|
|
Table B-22 lists the Oracle Database service and application utilization event attributes.
Table B-22 Oracle Database Service and Application Utilization Event Attributes
Attribute Name | Data Type |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Footnote 1 SQL_BIND
variable could be truncated to 4000 characters.
Footnote 2 SQL_TEXT
variable could be truncated to 4000 characters.
System management events track audited system management activity, such as STARTUP
and SHUTDOWN
operations. The System Management Report, described in Section 3.4.6, uses these events.
Table B-23 lists the Oracle Database system management events and event IDs.
Table B-23 Oracle Database System Management Events and Event IDs
Event Name | Event ID |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Table B-24 lists the Oracle Database system management event attributes.
Table B-24 Oracle Database System Management Event Attributes
Attribute Name | Data Type |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Footnote 1 SQL_BIND
variable could be truncated to 4000 characters.
Footnote 2 SQL_TEXT
variable could be truncated to 4000 characters.
Unknown or uncategorized events track audited activity that cannot be categorized, such as ALTER SUMMARY
statements. The Uncategorized Activity Report, described in Section 3.5.3, uses these events.
Table B-25 lists the Oracle Database unknown or uncategorized events and event IDs.
Table B-25 Oracle Database Unknown or Uncategorized Events and Event IDs
Event Name | Event ID |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Table B-26 lists the Oracle Database unknown or uncategorized event attributes.
Table B-26 Unknown or Uncategorized Event Attributes
Attribute Name | Data Type |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Footnote 1 SQL_BIND
variable could be truncated to 4000 characters.
Footnote 2 SQL_TEXT
variable could be truncated to 4000 characters.
User session events track audited authentication events for users who log in to the database. The User Sessions Report, described in Section 3.3.6, uses these events.
Table B-27 lists the Oracle Database user session events and event IDs.
Table B-27 Oracle Database User Session Events and Event IDs
Event Name | Event ID |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Table B-28 lists the Oracle Database user session event attributes.
Table B-28 Oracle Database User Session Event Attributes
Attribute Name | Data Type |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Footnote 1 SQL_BIND
variable could be truncated to 4000 characters.
Footnote 2 SQL_TEXT
variable could be truncated to 4000 characters.