Contents

List of Figures

List of Tables

Title and Copyright Information

Preface

• Audience
• Documentation Accessibility
• Related Documents
• Conventions

Quick Reference for Common Tasks

• About this Quick Reference
• Secured Targets
• User Accounts and Access Rights
• Email Notifications
• Status and Job Monitoring
• Firewall Policies
• Audit Policies (for Oracle Databases)
• Reports
• Entitlements
• Alerts

1 Introducing Oracle Audit Vault and Database Firewall

• Downloading the Latest Version of This Manual
• System Features
  • About Oracle Audit Vault and Database Firewall
  • Supported Secured Targets
  • Auditing Features
  • Administrative Features
  • Integrations With Third-Party Products
• Component Architecture
  • How Oracle AVDF Components Work Together
  • The Audit Vault Server
  • The Database Firewall
  • The Audit Vault Agent
• The Auditor's Role
• Understanding Secured Targets
• Understanding Firewall Policies
  • Planning the Protection Level for Your Databases
• Understanding Audit Policies and Audit Data Collection
  • About Audit Policies and Audit Data Collection
  • Requirements for Collecting Audit Data from Secured Targets
    • Requirements for Oracle Database
    • Requirements for SQL Server, Sybase ASE, and IBM DB2 Databases
• Configuring Alerts and Notifications
• Generating Reports
• Creating Users and Managing Access
• Logging in to Audit Vault Server Console
  • Logging in to the Audit Vault Server Console
  • Understanding the Tabs in the Audit Vault Server Console UI
  • Working with Lists of Objects in the UI

2 Managing Secured Targets

• About Managing Secured Targets
• Viewing and Changing Settings for a Secured Target
  • Viewing a List of Audit Trails
    • Viewing a List of Audit Trails for One Secured Target
    • Viewing a List of Audit Trails for All Your Secured Targets
  • Viewing a List of Enforcement Points
    • Viewing a List of Enforcement Points for One Database Secured Target
    • Viewing a List of Enforcement Points for All Your Secured Target Databases
  • Selecting a Firewall Policy
  • Viewing Audit Policy Settings for Oracle Databases
  • Retrieving User Entitlement Data for Oracle Database Secured Targets
  • Activating Stored Procedure Auditing
  • Setting a Data Retention (Archiving) Policy
• Creating and Modifying Secured Target Groups
  • About Secured Target Groups
  • Creating and Modifying Secured Target Groups
• Managing Compliance for Secured Target Databases
• Setting Access Rights for Secured Targets and Groups

3 Managing Access and Other Settings

• Managing User Accounts and Access
  • About Oracle AVDF Auditor Accounts and Passwords
  • Creating Auditor Accounts in Oracle AVDF
  • Managing User Access to Secured Targets or Groups
    • About Managing User Access
    • Controlling Access by User
    • Controlling Access by Secured Target or Group
  • Changing a User Account Type in Oracle AVDF
  • Deleting an Auditor Account in Oracle AVDF
  • Changing Your Password
• Creating Templates and Distribution Lists for Email Notifications
  • About Email Notifications and Templates
  • Creating or Modifying an Email Distribution List
  • Creating or Modifying an Email Template
• Viewing Enforcement Point and Audit Trail Status
  • Viewing Enforcement Point Status
  • Viewing Audit Trail Status
• Monitoring Jobs

4 Creating Database Firewall Policies

• Overview of Database Firewall Policies
  • About Firewall Policies
  • The Steps of Developing a Firewall Policy
• Creating a Firewall Policy
  • Creating a New Firewall Policy
  • Copying a Firewall Policy
  • Editing a Firewall Policy
  • Understanding a Firewall Policy's Overview Page
• Defining a Firewall Policy
  • About Defining the Policy
  • Defining Session Filters to Use in Profiles and Exceptions
  • Creating Exceptions
    • About Exceptions
    • Creating Exceptions
    • The Order of Applying Exceptions
  • Defining Policy Rules for Analyzed SQL
    • About Analyzed SQL
    • Defining Policy Rules for Analyzed SQL
    • Analyzing SQL Encrypted with Oracle Network Encryption
  • Creating Novelty Policies
    • About Novelty Policies
    • Creating Novelty Policies
    • The Order of Applying Novelty Policies
    • Novelty Policy Examples
  • Defining the Default Rule
    • About the Default Rule
    • Default Rule Settings in Relation to Other Policies
    • Defining the Default Rule
  • Blocking SQL and Creating Substitute Statements
  • Configuring Other Policy Settings
    • Creating Login and Logout Policies for Database Users
    • Masking Sensitive Data
    • Setting a Policy for Invalid SQL
    • Configuring Global Firewall Policy Settings
• Using Profiles to Customize a Firewall Policy
  • About Profiles
  • Creating a Profile
• Publishing and Deploying Firewall Policies
  • About Publishing and Using Firewall Policies
  • Publishing a Firewall Policy
  • Deploying Firewall Policies to Secured Targets

5 Creating Audit Policies for Oracle Databases

• About Audit Policies
  • General Steps for Creating Audit Policies for Oracle Databases
• Retrieving and Modifying Audit Settings from an Oracle Database
  • Understanding the Columns on the Audit Settings Page
  • Retrieving Audit Settings from an Oracle Database
  • Specifying Which Audit Settings Are Needed
• Creating Additional Audit Policy Settings for an Oracle Database
  • About Creating Audit Policy Settings
  • Creating Audit Policies for SQL Statements
    • About SQL Statement Auditing
    • Defining SQL Statement Audit Settings
    • Understanding the Statement Audit Settings Page
  • Creating Audit Policies for Schema Objects
    • About Schema Object Auditing
    • Defining Schema Object Audit Settings
    • Understanding the Object Audit Settings Page
  • Creating Audit Policies for Privileges
    • About Privilege Auditing
    • Defining Privilege Audit Settings
    • Understanding the Privilege Audit Settings Page
  • Creating Audit Policies for Fine-Grained Auditing (FGA)
    • About Fine-Grained Auditing
    • Defining Fine-Grained Audit Settings
    • Understanding the Fine-Grained Audit Settings Page
  • Creating Capture Rules for Redo Log File Auditing
    • About Capture Rules Redo Log File Auditing
    • Defining a Capture Rule for Redo Log File Auditing
    • Understanding the Capture Rule Settings Page
• Provisioning Audit Policies to an Oracle Database
  • Exporting Audit Settings to a SQL Script
  • Provisioning the Audit Settings from the Audit Vault Server

6 Generating Reports

• About the Reports in Audit Vault and Database Firewall
  • Related Event Data Appendices
• Browsing the Built-In Reports
• Downloading a Report in HTML or CSV Format
• Customizing the Built-in Reports
  • About Customizing Built-in Reports
  • Filtering and Controlling the Display of Data in a Report
    • About Filtering and Display Settings in Reports
    • Filtering Data in a Report
    • Hiding or Showing Columns in a Report
    • Formatting Data in a Report
    • Resetting the Report Display Values to Their Default Settings
  • Saving your Customized Reports
  • Accessing Your Saved Custom Reports
• Scheduling and Generating PDF or XLS Reports
  • About Scheduling and Creating PDF or XLS Reports
  • Creating a Report Schedule
  • Viewing or Modifying Report Schedules
  • Downloading Generated Reports in PDF or XLS Format
  • Notifying Users About Generated PDF or XML Reports
• Annotating and Attesting Reports
• Creating and Uploading Your Own Custom Reports
• Audit Report Descriptions
  • About the Audit Reports
  • Activity Reports
    • About the Activity Reports
    • Activity Overview Report
    • Data Access Report
    • Data Modification Report
    • Data Modification Before-After Values
    • Database Schema Changes Report
    • All Activity Report
    • Failed Logins Report
    • User Login and Logout Report
    • Entitlements Changes Report
    • Audit Settings Changes Report
    • Secured Targets Startup/Shutdown Report
  • Alert Reports
  • Stored Procedure Auditing Reports
• Compliance Report Descriptions
  • About the Compliance Reports
  • Associating Secured Targets with Compliance Report Categories
  • Reports Included in Each Compliance Report Category
• Specialized Database Firewall Report Descriptions
  • About the Specialized Database Firewall Reports
  • Database Firewall Policy Reports
  • Database Firewall F5 Reports

7 Managing Entitlements

• Managing and Viewing Entitlement Data
• Working With Entitlement Snapshots and Labels
  • About Entitlement Snapshots and Labels
  • Creating, Modifying, or Deleting Labels for Entitlement Snapshots
  • Assigning Labels to Entitlement Snapshots
• Generating Entitlement Reports
  • About Viewing Entitlement Reports with Snapshots and Labels
  • Viewing Entitlement Reports by Snapshot or Label
  • Comparing Entitlement Data Using Snapshots or Labels
• Entitlement Report Descriptions
  • About the Entitlement Reports
  • User Accounts Reports
  • User Privileges Reports
  • User Profiles Reports
  • Database Roles Reports
  • System Privileges Reports
  • Object Privileges Reports
  • Privileged Users Reports

8 Creating Alerts

• About Alerts
• Creating and Configuring Alerts
  • Creating Alert Status Values
  • Creating or Modifying an Alert
  • Defining Alert Conditions
    • About Alert Conditions
    • Creating an Alert Condition
  • Forwarding Alerts to Syslog (AVDF 12.1.2)
  • Monitoring Alerts
  • Disabling, Enabling, or Deleting Alerts
• Responding to an Alert

A Oracle Audit Vault and Database Firewall Database Schemas

• About Oracle Audit Vault and Database Firewall Schemas
• Metadata for Activity Reports
• Data for Event Reports
• Data for Alert Reports
• Data for Entitlement Reports
• Data for SPA Reports
• Data for Database Firewall Reports

B Audit Record Fields

C Oracle Database Audit Events

• About the Oracle Database Audit Events
• Account Management Events
• Application Management Events
• Audit Command Events
• Data Access Events
• Database Vault Events
  • Database Vault Events in Oracle Database 11g
  • Database Vault Events in Oracle Database 12c
• Exception Events
• Invalid Record Events
• Object Management Events
• Peer Association Events
• Role and Privilege Management Events
• Service and Application Utilization Events
• System Management Events
• Unknown or Uncategorized Events
• User Session Events

D Sybase ASE Audit Events

• About the Sybase ASE Audit Events
• Account Management Events
• Application Management Events
• Audit Command Events
• Data Access Events
• Exception Events
• Invalid Record Events
• Object Management Events
• Peer Association Events
• Role and Privilege Management Events
• Service and Application Utilization Events
• System Management Events
• Unknown or Uncategorized Events
• User Session Events

E Microsoft SQL Server SQL Trace Audit Events

• About the Microsoft SQL Server Audit Events
• Account Management Events
• Application Management Events
• Audit Command Events
• Data Access Events
• Exception Events
• Invalid Record Events
• Object Management Events
• Peer Association Events
• Role and Privilege Management Events
• Service and Application Utilization Events
• System Management Events
• Unknown or Uncategorized Events
• User Session Events
• Target Type Values
  • List 1

F Microsoft SQL Server SQL Audit and Event Log Events

• SQL Audit Events
• Event Log Events
• Target Type Values
  • List 1

G IBM DB2 Audit Events

• About the IBM DB2 for LUW Audit Events
• Account Management Events
• Application Management Events
• Audit Command Events
• Data Access Events
• Exception Events
• Invalid Record Events
• Object Management Events
• Peer Association Events
• Role and Privilege Management Events
• Service and Application Utilization Events
• System Management Events
• Unknown or Uncategorized Events
• User Session Events
• Target Type Values
  • List 1
  • List 2
  • List 3

H MySQL Audit Events

I Solaris Operating System Audit Events

J Microsoft Windows Operating System Audit Events

K Linux Operating System Audit Events

L Oracle ACFS Audit Events

M Active Directory Audit Events

• About Active Directory Audit Events
• Directory Service Audit Trail Events
• Security Audit Trail Events

Index