Contents

List of Figures

List of Tables

Title and Copyright Information

Preface

• Audience
• Documentation Accessibility
• Diversity and Inclusion
• Related Documents
• Conventions

What’s New

• Oracle AVDF Release 12.2.0 Changes
• Changes In This Document
  • Revision History

Quick Reference for Common Tasks

• About this Quick Reference
• Audit Vault Server
• Database Firewall
• Hosts
• Agent
• Host Monitor
• Secured Targets
  • Registering and Managing
  • Auditing
  • Monitoring with Database Firewall
• BIG-IP ASM Integration
• Arcsight Integration
• Other Administrator Tasks
• Reference Information

Part I Getting Started

1 Introducing Oracle Audit Vault and Database Firewall

• 1.1 Downloading the Latest Version of This Manual
• 1.2 Learning About Oracle AVDF
• 1.3 Supported Platforms for Oracle Audit Vault and Database Firewall
• 1.4 System Features
  • 1.4.1 About Audit Vault and Database Firewall
  • 1.4.2 Security Technical Implementation Guides and Implementation for Oracle Audit Vault and Database Firewall
  • 1.4.3 System Requirements for Oracle Audit Vault and Database Firewall
  • 1.4.4 Supported Secured Targets
  • 1.4.5 Administrative Features
  • 1.4.6 Oracle Audit Vault and Database Firewall Auditing Features
  • 1.4.7 Integrating Oracle Audit Vault and Database Firewall with Third-Party Products
  • 1.4.8 Integrating Oracle Audit Vault and Database Firewall with Oracle Key Vault
• 1.5 Understanding the Administrator's Role
• 1.6 Summary of Configuration Steps
  • 1.6.1 Configuring Oracle AVDF and Deploying the Audit Vault Agent
  • 1.6.2 Configuring Oracle AVDF and Deploying the Database Firewall
• 1.7 Planning the System Configuration
  • 1.7.1 Guidance for Planning Your Oracle Audit Vault and Database Firewall Configuration
  • 1.7.2 Step 1: Plan Your Oracle Audit Vault Server Configuration
  • 1.7.3 Step 2: Plan the Database Firewall Configuration
  • 1.7.4 Step 3: Plan the Audit Vault Agent Deployments
  • 1.7.5 Step 4: Plan the Audit Trail Configurations
  • 1.7.6 Step 5: Plan Your Integration Options
  • 1.7.7 Step 6: Plan for High Availability
  • 1.7.8 Step 7: Plan User Accounts and Access Rights
• 1.8 Logging in to the Audit Vault Server Console UI
  • 1.8.1 Log in to Oracle Audit Vault Server Console
  • 1.8.2 Understanding the Tabs and Menus in the Audit Vault Server Console
  • 1.8.3 Working with Lists of Objects in the UI
• 1.9 Logging in to the Database Firewall Console UI
  • 1.9.1 Log in to the Database Firewall Console UI
  • 1.9.2 Using the Oracle Database Firewall UI
• 1.10 Using the Audit Vault Command-Line Interface
• 1.11 Using the Audit Vault and Database Firewall Enterprise Manager Plug-in

2 General Security Guidelines

• 2.1 Installing Securely and Protecting Your Data
  • 2.1.1 Installing Oracle Audit Vault and Database Firewall Securely
  • 2.1.2 Protecting Your Data
• 2.2 General Security Recommendations
• 2.3 External Network Dependencies
• 2.4 Considerations for Deploying Network-Based Solutions
  • 2.4.1 Managing Database Firewall Network Encryption
  • 2.4.2 Handling Server-Side SQL and Context Configurations
• 2.5 How Oracle AVDF Works with Various Database Access Paths
• 2.6 Security Considerations for Special Configurations
  • 2.6.1 Database Firewall Configuration for Oracle Database Target Configured in Shared Server Mode
  • 2.6.2 How TCP Invited Nodes Are Affected by Client IP Addresses
  • 2.6.3 Additional Behavior to be Aware Of
  • 2.6.4 Custom Collector Development
• 2.7 About Setting Transport Layer Security Levels
• 2.8 Certificates
  • 2.8.1 Renew Audit Vault Server Certificate
  • 2.8.2 Renew Database Firewall Certificate

3 Configuring the Audit Vault Server

• 3.1 About Configuring Oracle Audit Vault Server
• 3.2 Changing the UI (Console) Certificate for Oracle Audit Vault Server
• 3.3 Specifying Initial System Settings and Options (Required)
  • 3.3.1 Specifying the Server Date, Time, and Keyboard Settings
  • 3.3.2 Specifying the Audit Vault Server System Settings
    • 3.3.2.1 Setting or Changing the Audit Vault Server Network Configuration
    • 3.3.2.2 Configuring or Changing the Oracle Audit Vault Server Services
    • 3.3.2.3 Changing IP Address Of An Active And Registered Host
  • 3.3.3 Configuring Oracle Audit Vault Server Syslog Destinations
• 3.4 Configuring the Email Notification Service
  • 3.4.1 About Email Notifications in Oracle Audit Vault and Database Firewall
  • 3.4.2 Configuring Email Notification for Oracle Audit Vault and Database Firewall
• 3.5 Configuring Archive Locations and Retention Policies
  • 3.5.1 About Archiving And Retrieving Data In Oracle Audit Vault And Database Firewall
  • 3.5.2 Defining Archive Locations
  • 3.5.3 Creating or Deleting Archiving Policies
    • 3.5.3.1 Creating Archiving (Retention) Policies
    • 3.5.3.2 Deleting Archiving Policies
  • 3.5.4 Running Archive or Retrieve Jobs
• 3.6 Managing Archival and Retrieval in High Availability Environments
• 3.7 Defining Resilient Pairs for High Availability
• 3.8 Registering Database Firewall in Audit Vault Server
• 3.9 Testing Audit Vault Server System Operations
• 3.10 Configuring Fiber Channel-Based Storage for Audit Vault Server
• 3.11 Adding Network Address Translation IP Addresses to Audit Vault Agent

4 Configuring the Database Firewall

• 4.1 About Configuring the Database Firewall
• 4.2 Changing the UI (Console) Certificate for the Database Firewall
• 4.3 Managing the Database Firewall's Network and Services Configuration
  • 4.3.1 Configuring Network Settings For A Database Firewall
  • 4.3.2 Configuring Network Services For A Database Firewall
• 4.4 Setting the Date and Time in the Database Firewall
• 4.5 Specifying the Audit Vault Server Certificate and IP Address
• 4.6 Changing IP Address For A Single Instance Of Database Firewall Server
• 4.7 Configuring Database Firewall and its Traffic Sources on Your Network
  • 4.7.1 About Configuring The Database Firewall And Traffic Sources On Your Network
  • 4.7.2 Configuring Traffic Sources
  • 4.7.3 Configuring a Bridge in the Database Firewall
  • 4.7.4 Configuring Oracle Database Firewall As A Traffic Proxy
• 4.8 Configuring an Interface Masters Niagara Server Adapter Card
• 4.9 Viewing the Status and Diagnostics Report for a Database Firewall
• 4.10 Configure and Download the Diagnostics Report File

5 Registering Hosts and Deploying the Agent

• 5.1 Registering Hosts in the Audit Vault Server
  • 5.1.1 About Registering Hosts
  • 5.1.2 Registering Hosts in the Audit Vault Server
  • 5.1.3 Changing Host Names
• 5.2 Deploying and Activating the Audit Vault Agent on Host Computers
  • 5.2.1 About Deploying the Audit Vault Agent
  • 5.2.2 Steps Required to Deploy and Activate the Audit Vault Agent
  • 5.2.3 Registering the Host
  • 5.2.4 Deploying the Audit Vault Agent on the Host Computer
  • 5.2.5 Activating and Starting the Audit Vault Agent
  • 5.2.6 Registering and Unregistering the Audit Vault Agent as a Windows Service
    • 5.2.6.1 About the Audit Vault Agent Windows Service
    • 5.2.6.2 Registering the Audit Vault Agent as a Windows Service
    • 5.2.6.3 Unregistering the Audit Vault Agent as a Windows Service
• 5.3 Stopping, Starting, and Other Agent Operations
  • 5.3.1 Stopping and Starting Oracle Audit Vault Agent
    • 5.3.1.1 Stopping and Starting the Agent on Unix Hosts
    • 5.3.1.2 Stopping and Starting the Agent on Windows Hosts
    • 5.3.1.3 Autostarting the Agent on Windows Hosts
  • 5.3.2 Changing the Logging Level for the Audit Vault Agent
  • 5.3.3 Viewing the Status and Details of an Audit Vault Agent
  • 5.3.4 Deactivating and Removing the Audit Vault Agent
• 5.4 Updating Oracle Audit Vault Agent
• 5.5 Deploying Plug-ins and Registering Plug-in Hosts
  • 5.5.1 About Plug-ins
  • 5.5.2 Ensuring that Auditing is Enabled in the Secured Target
  • 5.5.3 Registering the Plug-in Host in Audit Vault Server
  • 5.5.4 Deploying and Activating the Plug-in
  • 5.5.5 Un-Deploying Plug-ins
• 5.6 Deleting Hosts from the Audit Vault Server

6 Configuring Secured Targets, Audit Trails, and Enforcement Points

• 6.1 About Configuring Secured Targets
• 6.2 Registering Secured Targets and Creating Groups
  • 6.2.1 Registering or Removing Secured Targets in the Audit Vault Server
    • 6.2.1.1 About Secured Targets in the Audit Vault Server
    • 6.2.1.2 Registering Secured Targets
    • 6.2.1.3 Modifying Secured Targets
    • 6.2.1.4 Removing Secured Targets
  • 6.2.2 Creating or Modifying Secured Target Groups
  • 6.2.3 Controlling Access to Secured Targets and Target Groups
• 6.3 Preparing Secured Targets for Audit Data Collection
  • 6.3.1 Using an NTP Service to set Time on Secured Targets
  • 6.3.2 Ensuring that Auditing is Enabled on the Secured Target
  • 6.3.3 Setting User Account Privileges on Secured Targets
  • 6.3.4 Scheduling Audit Trail Cleanup
• 6.4 Configuring and Managing Audit Trail Collection
  • 6.4.1 Adding an Audit Trail in the Audit Vault Server
  • 6.4.2 Stopping, Starting, and Autostart of Audit Trails in the Audit Vault Server
  • 6.4.3 Checking the Status of Audit Trails in the Audit Vault Server
  • 6.4.4 Handling new Audit Trails with Expired Audit Records
  • 6.4.5 Deleting an Audit Trail
  • 6.4.6 Converting Audit Record Format For Collection
  • 6.4.7 Configuring Audit Trail Collection for Oracle Real Application Clusters
  • 6.4.8 Configuring Audit Trail Collection For CDB And PDB
• 6.5 Configuring Enforcement Points
  • 6.5.1 About Configuring Enforcement Points for Secured Targets
  • 6.5.2 Creating and Configuring an Enforcement Point
  • 6.5.3 Modifying an Enforcement Point
  • 6.5.4 Starting, Stopping, or Deleting Enforcement Points
  • 6.5.5 Viewing the Status of Enforcement Points
  • 6.5.6 Finding the Port Number Used by an Enforcement Point
• 6.6 Configuring Stored Procedure Auditing (SPA)
• 6.7 Configuring and Using Database Interrogation
  • 6.7.1 About Database Interrogation
    • 6.7.1.1 Using Database Interrogation for SQL Server and SQL Anywhere Databases
    • 6.7.1.2 Using Database Interrogation for Oracle Databases with Network Encryption
  • 6.7.2 Configuring Database Interrogation for SQL Server and SQL Anywhere
    • 6.7.2.1 Setting Database Interrogation Permissions in a Microsoft SQL Server Database
    • 6.7.2.2 Setting Database Interrogation Permissions in a Sybase SQL Anywhere Database
  • 6.7.3 Enabling Database Interrogation
  • 6.7.4 Disabling Database Interrogation
• 6.8 Configuring Oracle Database Firewall for Databases That Use Network Encryption
  • 6.8.1 Step 1: Apply the Specified Patch to Oracle Database
  • 6.8.2 Step 2: Run the Oracle Advance Security Integration Script
  • 6.8.3 Step 3: Provide the Database Firewall Public Key to the Oracle Database
  • 6.8.4 Step 4: Enable Database Interrogation for the Oracle Database
• 6.9 Configuring and Using Database Response Monitoring
  • 6.9.1 About Database Response Monitoring
  • 6.9.2 Configuring Database Response Monitoring
    • 6.9.2.1 Enabling Database Response Monitoring
    • 6.9.2.2 Setting Up Log-in and Log-out Policies in Oracle Database Firewall
• 6.10 Securing the Agent and Oracle Database Secure Target Connection

7 Enabling and Using Host Monitoring

• 7.1 About Host Monitoring
• 7.2 Installing and Enabling Host Monitoring
  • 7.2.1 Host Monitor Requirements
  • 7.2.2 Register the Computer that will Run the Host Monitor
  • 7.2.3 Deploying the Agent and Host Monitor on Microsoft Windows Hosts
  • 7.2.4 Deploying the Agent and Host Monitor on Unix Hosts
  • 7.2.5 Create a Secured Target for the Host-Monitored Database
  • 7.2.6 Create an Enforcement Point for the Host Monitor
  • 7.2.7 Create a Network Audit Trail
• 7.3 Starting, Stopping, and Other Host Monitor Operations
  • 7.3.1 Starting the Host Monitor
  • 7.3.2 Stopping the Host Monitor
  • 7.3.3 Changing the Logging Level for a Host Monitor
  • 7.3.4 Viewing Host Monitor Status and Details
  • 7.3.5 Checking the Status of a Host Monitor Audit Trail
  • 7.3.6 Uninstalling the Host Monitor (Unix Hosts Only)
• 7.4 Updating the Host Monitor (Unix Hosts Only)
• 7.5 Using Certificate-based Authentication for the Host Monitor
  • 7.5.1 Requiring a Signed Certificate for Host Monitor Connections to the Firewall
  • 7.5.2 Getting a Signed Certificate from the Audit Vault Server

8 Configuring High Availability

• 8.1 About High Availability Configurations in Oracle Audit Vault and Database Firewall
• 8.2 Managing A Resilient Audit Vault Server Pair
  • 8.2.1 About Pairing Audit Vault Servers
  • 8.2.2 Prerequisites for Configuring a Resilient Pair of Audit Vault Servers
  • 8.2.3 Configure the Secondary Audit Vault Server
  • 8.2.4 Configure the Primary Audit Vault Server
  • 8.2.5 Checking the High Availability Status of an Audit Vault Server
  • 8.2.6 Updating Audit Vault Agents and Host Monitor Agents After Pairing Audit Vault Servers
  • 8.2.7 Swapping Roles Between a Primary and Standby Audit Vault Server
  • 8.2.8 Handling a Failover of the Audit Vault Server Pair
  • 8.2.9 Disabling or Enabling Failover of the Audit Vault Server
  • 8.2.10 Performing a Manual Failover of the Audit Vault Server
• 8.3 Managing A Resilient Database Firewall Pair
  • 8.3.1 About Managing A Resilient Database Firewall Pair
  • 8.3.2 Configuring A Resilient Database Firewall Pair
  • 8.3.3 Switching Roles in a Resilient Pair of Database Firewalls
  • 8.3.4 Breaking (Un-pairing) a Resilient Pair of Database Firewalls
• 8.4 High Availability For Database Firewall In Proxy Mode
  • 8.4.1 Configuring High Availability For Database Firewall In Proxy Mode Through Client Configuration
  • 8.4.2 Configuring High Availability For Database Firewall In Proxy Mode Through DNS Setup

9 Configuring Integration with BIG-IP ASM

• 9.1 System Requirements
• 9.2 About the Integration of Oracle Audit Vault and Database Firewall with F5 BIG-IP Application Security Manager (BIG-IP ASM)
• 9.3 How the Integration Works
• 9.4 Deploying the Oracle AVDF and F5 BIG-IP Application Security Manager Integration
  • 9.4.1 About the Deployment
  • 9.4.2 Configuring Oracle Audit Vault and Database Firewall to Work with F5 BIG-IP Application Security Manager
  • 9.4.3 Configuring F5 BIG-IP Application Security Manager
    • 9.4.3.1 Logging Profile
    • 9.4.3.2 Policy Settings
  • 9.4.4 Developing a F5 BIG-IP Application Security Manager iRule
    • 9.4.4.1 Required Syslog Message Format
    • 9.4.4.2 Configuring syslog-ng.conf
• 9.5 Viewing F5 Data in Oracle Audit Vault and Database Firewall Reports

10 Integration with Third Party SIEM and Log-data Analysis Tools

• 10.1 How Oracle Audit Vault and Database Firewall Integrates with HP ArcSight SIEM
• 10.2 Enabling the HP ArcSight SIEM Integration

11 Using an Oracle Database Firewall with Oracle RAC

• 11.1 Configuring a Database Firewall with Oracle RAC for DPE Mode
  • 11.1.1 About Configuring a Database Firewall with Oracle RAC for DPE Proxy Mode
  • 11.1.2 Step 1: Configure the Listeners for Each Oracle RAC Node
  • 11.1.3 Step 2: Configure the Proxies in the Oracle Database Firewall Console
  • 11.1.4 Step 3: Test the Audit Reports to Ensure That They Can Collect Oracle RAC Node Data
• 11.2 Configuring a Database Firewall with Oracle RAC for DAM Mode

12 Oracle Audit Vault And Database Firewall Hybrid Cloud Deployment

• 12.1 Oracle Audit Vault And Database Firewall Hybrid Cloud Deployment And Pre-requisites
• 12.2 Opening Ports on DBCS
• 12.3 Configuring Hybrid Cloud Secured Target Using TCP
  • 12.3.1 Step 1: Registering On-premises Host on the Audit Vault Server
  • 12.3.2 Step 2: Installing Audit Vault Agent on Registered On-premises Hosts
  • 12.3.3 Step 3: Creating A User Account On The DBCS Target Instance
  • 12.3.4 Step 4: Setting Up or Reviewing Audit Policies on Target Oracle Database Cloud Service Instances
  • 12.3.5 Step 5: Creating a Secured Target on Audit Vault Server for the DBCS Instance
  • 12.3.6 Step 6: Starting Audit Trail On Audit Vault Server For The DBCS Instance
• 12.4 Configuring TCPS Connections for DBCS Instances
  • 12.4.1 Step 1: Creating Server Wallet and Certificate
  • 12.4.2 Step 2: Creating Client (Agent) Wallet and Certificate
  • 12.4.3 Step 3: Exchanging Client (Agent) and Server Certificates
  • 12.4.4 Step 4: Configuring Server Network
  • 12.4.5 Step 5: Connecting to DBCS instances in TCPS mode
• 12.5 Configuring Hybrid Cloud Secured Target Using TCPS
  • 12.5.1 Step 1: Registering On-premises Host on Oracle Audit Vault Server
  • 12.5.2 Step 2: Installing Oracle Audit Vault Agent on Registered On-premises Hosts and Configuring TCPS
  • 12.5.3 Step 3: Creating User Accounts on Oracle Database Cloud Service Target Instances
  • 12.5.4 Step 4: Setting Up or Reviewing Audit Policies on Target Oracle Database Cloud Service Instances
  • 12.5.5 Step 5: Creating A Secured Target On Audit Vault Server For The DBCS Instance
  • 12.5.6 Step 6: Starting Audit Trail On Audit Vault Server For The DBCS Instance
• 12.6 Configuring Oracle Database Exadata Express Cloud Service Secured Target Using TCPS
  • 12.6.1 Step 1: Installing Audit Vault Agent on registered on-premises Host and configuring TCPS
  • 12.6.2 Step 2: Creating User Accounts on Oracle Exadata Express Cloud Service Instances
  • 12.6.3 Step 3: Creating A Secured Target On Audit Vault Server For Exadata Express Cloud Service Instance
• 12.7 Configuring Oracle Database Exadata Express Cloud Service Secured Target Using TCP
  • 12.7.1 Step 1: Registering On Premises Host On The Audit Vault Server
  • 12.7.2 Step 2: Installing Audit Vault Agent On Registered On Premises Host
  • 12.7.3 Step 3: Creating User Accounts on Oracle Exadata Express Cloud Target Instances
  • 12.7.4 Step 4: Setting Up or Reviewing Audit Policies on Target Oracle Exadata Express Cloud Instances
  • 12.7.5 Step 5: Creating A Secured Target On Audit Vault Server For The Exadata Express Cloud Instance
  • 12.7.6 Step 6: Starting Audit Trail On Audit Vault Server For The Exadata Express Cloud Instance
• 12.8 Configuring Autonomous Data Warehouse and Autonomous Transaction Processing
  • 12.8.1 Step 1: Install Audit Vault Agent On Registered On-premises Host And Configuring TCPS
  • 12.8.2 Step 2: Create User Accounts on Oracle Cloud Instances
  • 12.8.3 Step 3: Create A Secured Target On Audit Vault Server For The Cloud Instance

Part II General Administration Tasks

13 Managing User Accounts and Access

• 13.1 About Oracle Audit Vault and Database Firewall Administrative Accounts
• 13.2 Security Technical Implementation Guides and Implementation for User Accounts
• 13.3 Configuring Administrative Accounts for the Audit Vault Server
  • 13.3.1 Guidelines for Securing the Oracle Audit Vault and Database Firewall User Accounts
  • 13.3.2 Creating Administrative Accounts for the Audit Vault Server
  • 13.3.3 Viewing the Status of Administrator User Accounts
  • 13.3.4 Changing a User Account Type for the Audit Vault Server
  • 13.3.5 Unlocking a User Account
  • 13.3.6 Deleting an Audit Vault Server Administrator Account
• 13.4 Configuring sudo Access for Users
  • 13.4.1 About Configuring sudo Access
  • 13.4.2 Configuring sudo Access for a User
• 13.5 Managing User Access Rights to Secured Targets or Groups
  • 13.5.1 About Managing User Access Rights
  • 13.5.2 Controlling Access Rights by User
  • 13.5.3 Controlling Access Rights by Secured Target or Group
• 13.6 Changing User Passwords in Oracle Audit Vault and Database Firewall
  • 13.6.1 Password Requirements
  • 13.6.2 Changing the Audit Vault Server Administrator User Password
  • 13.6.3 Changing the Database Firewall Administrator Password

14 Managing the Audit Vault Server and Database Firewalls

• 14.1 Managing Audit Vault Server Settings, Status, and Maintenance Operations
  • 14.1.1 Checking Server Status and System Operation
  • 14.1.2 Running Diagnostics Checks for the Audit Vault Server
  • 14.1.3 Downloading Detailed Diagnostics Reports for the Audit Vault Server
  • 14.1.4 Accessing the Audit Vault Server Certificate and Public Key
    • 14.1.4.1 Accessing the Server Certificate
    • 14.1.4.2 Accessing the Server Public Key
  • 14.1.5 Changing Logging Levels and Clearing Diagnostic Logs
  • 14.1.6 Changing the Keyboard Layout
  • 14.1.7 Rebooting or Powering Off the Audit Vault Server
• 14.2 Changing the Audit Vault Server's Network or Services Configuration
• 14.3 Managing Server Connectors for Email, Syslog, and Arcsight SIEM
• 14.4 Archiving and Retrieving Audit Data
  • 14.4.1 Starting an Archive Job
  • 14.4.2 Retrieving Oracle Audit Vault and Database Firewall Audit Data
• 14.5 Managing Repository Encryption
  • 14.5.1 About Oracle Audit Vault Server Repository Encryption
  • 14.5.2 Rotating the Master Key for Repository Encryption
  • 14.5.3 Changing the Keystore Password
  • 14.5.4 Backing Up the TDE Wallet
  • 14.5.5 Data Encryption on Upgraded Instances
• 14.6 Backing Up and Restoring the Audit Vault Server
  • 14.6.1 About the Backup and Restore Utility
  • 14.6.2 How Much Space Do I Need for Backup Files?
  • 14.6.3 Backing Up the Audit Vault Server
    • 14.6.3.1 Step 1: Configure the Backup Utility
    • 14.6.3.2 Step 2: Back Up the Audit Vault Server
    • 14.6.3.3 Step 3: Validate the Backup
  • 14.6.4 Restoring the Audit Vault Server
    • 14.6.4.1 About Restoring the Audit Vault Server
    • 14.6.4.2 Prerequisites for Restoring Audit Vault Server
    • 14.6.4.3 Step 1: Configure the Backup Utility on the Audit Vault Server
    • 14.6.4.4 Step 2: Restore Audit Vault Server
  • 14.6.5 Restoring a Backup to a New System with a New or Different IP Address
• 14.7 Enabling Oracle Database In-Memory for the Audit Vault Server
  • 14.7.1 About Enabling Oracle Database In-Memory for the Audit Vault Server
  • 14.7.2 Enabling and Allocating Memory for Oracle Database In-Memory
  • 14.7.3 Setting the Oracle Database In-Memory Options
  • 14.7.4 Disabling Oracle Database In-Memory
  • 14.7.5 Monitoring Oracle Database In-Memory Usage
• 14.8 Managing Plug-ins
• 14.9 Monitoring Server Tablespace Space Usage
• 14.10 Monitoring Server Archive Log Disk Space Use
• 14.11 Monitoring Server Flash Recovery Area
• 14.12 Monitoring Jobs
• 14.13 Scheduling Maintenance Job
• 14.14 Downloading and Using the AVCLI Command Line Interface
  • 14.14.1 About the AVCLI Command Line Interface
  • 14.14.2 Downloading the AVCLI Command Line Utility and Setting JAVA_HOME
  • 14.14.3 Starting AVCLI
    • 14.14.3.1 Starting AVCLI Interactively
    • 14.14.3.2 Starting AVCLI Using Stored Credentials
  • 14.14.4 Running AVCLI Scripts
  • 14.14.5 Specifying Log Levels for AVCLI
  • 14.14.6 Displaying Help and the Version Number of AVCLI
• 14.15 Downloading the Oracle Audit Vault and Database Firewall SDK
• 14.16 Managing Database Firewalls
  • 14.16.1 Changing the Database Firewall's Network or Services Configuration
  • 14.16.2 Viewing Network Traffic in a Database Firewall
  • 14.16.3 Capturing Network Traffic in Oracle Database Firewall
  • 14.16.4 Restarting or Powering Off Oracle Database Firewall
  • 14.16.5 Removing Oracle Database Firewall from Oracle Audit Vault Server
  • 14.16.6 Fetching an Updated Certificate from Oracle Database Firewall
  • 14.16.7 Viewing Diagnostics for Oracle Database Firewall
  • 14.16.8 Resetting Oracle Database Firewall
  • 14.16.9 Restore Enforcement Points

15 Configuring a SAN Repository

• 15.1 About Configuring a SAN Repository
• 15.2 Configuring a SAN Server to Communicate with Oracle Audit Vault and Database Firewall
• 15.3 Registering or Dropping SAN Servers in the Audit Vault Server
  • 15.3.1 Registering a SAN Server
  • 15.3.2 Dropping a SAN Server
• 15.4 Discovering Targets on a SAN Server
  • 15.4.1 About SAN Targets and Disks
  • 15.4.2 Discovering Targets on a SAN Server and Making Disks Available
  • 15.4.3 Logging Out of Targets on SAN Servers
• 15.5 Adding or Dropping SAN Disks in the Audit Vault Server Repository
  • 15.5.1 About Disk Groups in the Audit Vault Server Repository
  • 15.5.2 Adding SAN Disks to the Audit Vault Server Repository
  • 15.5.3 Dropping SAN Disks from the Audit Vault Server Repository

Part III General Reference

A AVCLI Commands Reference

• A.1 About the AVCLI Commands
• A.2 Agent Host AVCLI Commands
  • A.2.1 REGISTER HOST
  • A.2.2 ALTER HOST
  • A.2.3 LIST HOST
  • A.2.4 DROP HOST
  • A.2.5 ACTIVATE HOST
  • A.2.6 DEACTIVATE HOST
• A.3 Database Firewall AVCLI Commands
  • A.3.1 REGISTER FIREWALL
  • A.3.2 DROP FIREWALL
  • A.3.3 LIST FIREWALL
  • A.3.4 REBOOT FIREWALL
  • A.3.5 POWEROFF FIREWALL
  • A.3.6 CREATE RESILIENT PAIR
  • A.3.7 SWAP RESILIENT PAIR
  • A.3.8 DROP RESILIENT PAIR
  • A.3.9 ALTER FIREWALL
  • A.3.10 SHOW STATUS FOR FIREWALL
• A.4 Enforcement Point AVCLI Commands
  • A.4.1 CREATE ENFORCEMENT POINT
  • A.4.2 DROP ENFORCEMENT POINT
  • A.4.3 LIST ENFORCEMENT POINT
  • A.4.4 START ENFORCEMENT POINT
  • A.4.5 STOP ENFORCEMENT POINT
  • A.4.6 ALTER ENFORCEMENT POINT
• A.5 Secured Target AVCLI Commands
  • A.5.1 REGISTER SECURED TARGET
  • A.5.2 ALTER SECURED TARGET
  • A.5.3 UPLOAD OR DELETE WALLET FILE
  • A.5.4 LIST ADDRESS FOR SECURED TARGET
  • A.5.5 LIST SECURED TARGET
  • A.5.6 LIST SECURED TARGET TYPE
  • A.5.7 LIST ATTRIBUTE FOR SECURED TARGET
  • A.5.8 LIST METRICS
  • A.5.9 DROP SECURED TARGET
• A.6 Target Group AVCLI Commands
  • A.6.1 ADD TARGET
  • A.6.2 DELETE TARGET
• A.7 Audit Trail Collection AVCLI Commands
  • A.7.1 START COLLECTION FOR SECURED TARGET
  • A.7.2 STOP COLLECTION FOR SECURED TARGET
  • A.7.3 LIST TRAIL FOR SECURED TARGET
  • A.7.4 DROP TRAIL FOR SECURED TARGET
• A.8 SMTP Connection AVCLI Commands
  • A.8.1 REGISTER SMTP SERVER
  • A.8.2 ALTER SMTP SERVER
  • A.8.3 ALTER SMTP SERVER ENABLE
  • A.8.4 ALTER SMTP SERVER DISABLE
  • A.8.5 ALTER SMTP SERVER SECURE MODE ON
  • A.8.6 ALTER SMTP SERVER SECURE MODE OFF
  • A.8.7 TEST SMTP SERVER
  • A.8.8 LIST ATTRIBUTE OF SMTP SERVER
  • A.8.9 DROP SMTP SERVER
• A.9 Security Management AVCLI Commands
  • A.9.1 ALTER DATA ENCRYPTION
  • A.9.2 SHOW DATA ENCRYPTION STATUS
  • A.9.3 GRANT SUPERADMIN
  • A.9.4 REVOKE SUPERADMIN
  • A.9.5 GRANT ACCESS
  • A.9.6 REVOKE ACCESS
  • A.9.7 GRANT ADMIN
  • A.9.8 REVOKE ADMIN
  • A.9.9 ALTER USER
• A.10 SAN Storage AVCLI Commands
  • A.10.1 REGISTER SAN SERVER
  • A.10.2 ALTER SAN SERVER
  • A.10.3 LIST TARGET FOR SAN SERVER
  • A.10.4 DROP SAN SERVER
  • A.10.5 LIST DISK
  • A.10.6 ALTER DISKGROUP
  • A.10.7 LIST DISKGROUP
  • A.10.8 LIST SAN SERVER
  • A.10.9 SHOW iSCSI INITIATOR DETAILS FOR SERVER
• A.11 Remote File System AVCLI Commands
  • A.11.1 REGISTER REMOTE FILESYSTEM
  • A.11.2 ALTER REMOTE FILESYSTEM
  • A.11.3 DROP REMOTE FILESYSTEM
  • A.11.4 LIST EXPORT
  • A.11.5 LIST REMOTE FILESYSTEM
  • A.11.6 SHOW STATUS OF REMOTE FILESYSTEM
• A.12 Server Management AVCLI Commands
  • A.12.1 ALTER SYSTEM SET
  • A.12.2 SHOW CERTIFICATE
  • A.12.3 DOWNLOAD LOG FILE
• A.13 Collection Plug-In AVCLI Commands
  • A.13.1 DEPLOY PLUGIN
  • A.13.2 LIST PLUGIN FOR SECURED TARGET TYPE
  • A.13.3 UNDEPLOY PLUGIN
• A.14 General Usage AVCLI Commands
  • A.14.1 CONNECT
  • A.14.2 STORE CREDENTIALS
  • A.14.3 SHOW USER
  • A.14.4 CLEAR LOG
  • A.14.5 HELP
  • A.14.6 -HELP
  • A.14.7 -VERSION
  • A.14.8 QUIT
• A.15 AVCLI User Commands
  • A.15.1 CREATE AUDITOR
  • A.15.2 ALTER AUDITOR
  • A.15.3 DROP AUDITOR
  • A.15.4 CREATE ADMIN
  • A.15.5 ALTER ADMIN
  • A.15.6 DROP ADMIN

B Plug-in Reference

• B.1 About Oracle Audit Vault and Database Firewall Plug-ins
• B.2 Plug-ins Shipped with Oracle Audit Vault and Database Firewall
  • B.2.1 Out-of-the Box Plug-ins at a Glance
  • B.2.2 Oracle Database
  • B.2.3 Microsoft SQL Server
  • B.2.4 Sybase ASE
  • B.2.5 Sybase SQL Anywhere
  • B.2.6 IBM DB2
  • B.2.7 MySQL
  • B.2.8 Oracle Solaris
  • B.2.9 Linux
  • B.2.10 IBM AIX
  • B.2.11 Microsoft Windows
  • B.2.12 Microsoft Active Directory
  • B.2.13 Oracle ACFS
  • B.2.14 Oracle Big Data Appliance
  • B.2.15 Summary of Data Collected for Each Audit Trail Type
• B.3 Scripts for Oracle AVDF Account Privileges on Secured Targets
  • B.3.1 About Scripts for Setting up Oracle Audit Vault and Database Firewall Account Privileges
  • B.3.2 Oracle Database Setup Scripts
  • B.3.3 Sybase ASE Setup Scripts
    • B.3.3.1 About the Sybase ASE Setup Scripts
    • B.3.3.2 Setting Up Audit Data Collection Privileges for a Sybase ASE Secured Target
    • B.3.3.3 Setting Up Stored Procedure Auditing Privileges for a Sybase ASE Secured Target
  • B.3.4 Sybase SQL Anywhere Setup Scripts
  • B.3.5 Microsoft SQL Server Setup Scripts
    • B.3.5.1 About the SQL Server Setup Script
    • B.3.5.2 Setting Up Audit Data Collection Privileges for a SQL Server Secured Target
    • B.3.5.3 Setting Up Stored Procedure Auditing Privileges for a SQL Server Secured Target
  • B.3.6 IBM DB2 for LUW Setup Scripts
    • B.3.6.1 About the IBM DB2 for LUW Setup Scripts
    • B.3.6.2 Setting Up Audit Data Collection Privileges for IBM DB2 for LUW
    • B.3.6.3 Setting Up SPA Privileges for an IBM DB2 for LUW Secured Target
  • B.3.7 MySQL Setup Scripts
• B.4 Audit Collection Consideration
  • B.4.1 Additional Information for Audit Collection from Oracle Active Data Guard
• B.5 Audit Trail Cleanup
  • B.5.1 Oracle Database Audit Trail Cleanup
    • B.5.1.1 About Purging the Oracle Database Secured Target Audit Trail
    • B.5.1.2 Scheduling an Automated Purge Job
  • B.5.2 SQL Server Audit Trail Cleanup
  • B.5.3 MySQL Audit Trail Cleanup
• B.6 Procedure Look-ups: Connect Strings, Collection Attributes, Audit Trail Locations
  • B.6.1 Secured Target Locations (Connect Strings)
  • B.6.2 Collection Attributes
    • B.6.2.1 About Collection Attributes
    • B.6.2.2 Oracle Database Collection Attributes
    • B.6.2.3 IBM DB2 for LUW Collection Attribute
    • B.6.2.4 MySQL Collection Attributes
    • B.6.2.5 Oracle ACFS Collection Attributes
  • B.6.3 Audit Trail Locations

C REDO Logs Audit Data Collection Reference

• C.1 About the Recommended Settings for Collection from REDO Logs
• C.2 Oracle Database 11g Release 2 (11.2) and 12c Secured Target Audit Parameter Recommendations
• C.3 Oracle Database 11g Release 1 (11.1) Secured Target Audit Parameter Recommendations
• C.4 Oracle Database 10g Release 2 (10.2) Secured Target Audit Parameter Recommendations
• C.5 Populating Client ID In Reports for REDO Collector

D Ports Used by Audit Vault and Database Firewall

• D.1 Ports Required When Database Firewall is Deployed for Secured Targets
• D.2 Ports for Services Provided by Oracle Audit Vault Server
• D.3 Ports for Services Provided by the Database Firewall
• D.4 Ports for External Network Access by the Audit Vault Server
• D.5 Ports for External Network Access by the Database Firewall
• D.6 Ports for Internal TCP Communication

E Message Code Dictionary

• E.1 Audit Vault Messages
• E.2 Database Firewall Messages

F Security Technical Implementation Guides

• F.1 About Security Technical Implementation Guides
• F.2 Enabling and Disabling STIG Rules on Oracle Audit Vault and Database Firewall
  • F.2.1 Enabling STIG Rules on Oracle Audit Vault and Database Firewall
  • F.2.2 Disabling STIG Rules on Oracle Audit Vault and Database Firewall
• F.3 Current Implementation of STIG Rules on Oracle Audit Vault and Database Firewall
• F.4 Current Implementation of Database STIG Rules
• F.5 Additional Notes
  • F.5.1 DG0008-ORACLE11 STIG Rule
  • F.5.2 DG0075-ORACLE11, DO0250-ORACLE11 STIG Rules
  • F.5.3 DG0116-ORACLE11 STIG Rule
• F.6 Current Implementation of Operating System STIG Rules

G Troubleshooting Oracle Audit Vault and Database Firewall

• G.1 Audit Vault Agent or Host Monitor is not Upgraded to the Latest Bundle Patch
• G.2 Enable Archiving Functionality Post Upgrade From BP11 to Later Releases
• G.3 Partial or No Traffic Seen for an Oracle Database Monitored by Database Firewall
• G.4 RPM Upgrade Failed
• G.5 Agent Activation Request Returns 'host is not registered' Error
• G.6 Unable to Deploy Agent on the Secondary Audit Vault Server
• G.7 Operation Fails When I Try to Build Host Monitor or Collect Oracle Database Trail
• G.8 'java -jar agent.jar' Failed on Windows Machine
• G.9 Unable to Install the Agent or Generate the agent.jar File
• G.10 Unable to Un-install the Oracle Audit Vault Agent Windows Service
• G.11 Access Denied Error While Installing Agent as a Windows Service
• G.12 Unable to Start the Agent Through the Services Applet On The Control Panel
• G.13 Error When Starting the Agent
• G.14 Error When Running Host Monitor Setup
• G.15 Alerts on Oracle Database Secured Target are not Triggered for a Long Time
• G.16 Error When Creating an Audit Policy
• G.17 Connection Problems when Using Database Firewall DPE Mode
• G.18 Audit Trail Does Not Start
• G.19 Cannot Access the Audit Vault Server UI
• G.20 Cannot See Data for My Secured Target
• G.21 Problems Pairing Oracle Database Firewall and Oracle Audit Vault Server
• G.22 User Names Do Not Appear on Database Firewall Reports
• G.23 Alerts Are Not Generated
• G.24 Problems Retrieving or Provisioning Audit Settings on Oracle Secured Target
• G.25 Operation Failed Message Appears When Attempting to Enable Oracle Audit Vault and Database Firewall Policies
• G.26 Failure While Adding Disks
• G.27 Out of Memory Error Message During Restore
• G.28 JAVA.IO.IOEXCEPTION Error
• G.29 Failed to Start ASM Instance Error
• G.30 Internal capacity exceeded messages seen in the /var/log/messages file
• G.31 A Client Is Unable To Connect To The AVS Using SSH With A Secondary Network Interface Card
• G.32 First Archive Or Retrieve Job After Upgrade
• G.33 Audit Vault Agent Installation Fails After HA Pairing Or Separation
• G.34 Error in Restoring Files
• G.35 DB2 Collector Fails Due to Source Version NULL Errors
• G.36 DB2 Collector Fails Due To Connection or Permission Issue From Database
• G.37 ORA-12660 Error While Registering Secured Target
• G.38 Failure During High Availability Pairing in Oracle Audit Vault Server
• G.39 Audit Trail Performance Issues Occur After Audit Vault Server Upgrade
• G.40 Failures Due to Dropping Users
• G.41 Failure of Agent Automatic Upgrades
• G.42 Some Services May Not Start After Backup
• G.43 Data Overflow Issues in the Oracle Audit Vault UI
• G.44 Oracle Audit Vault Agent is Unreachable and the Transaction Log Audit Trail is Frozen in Starting Status
• G.45 Scheduled PDF or XLS Reports Result in a Hung State
• G.46 Pending Reports In Scheduled Status
• G.47 The Audit Vault Logs Display A Message To Install Npcap And OpenSSL
• G.48 Host Monitor Agent Fails to Start
• G.49 Audit Trail Stopped After Relocating Windows Event Log Files
• G.50 Network Audit Trail Does Not Start on Unix Platforms
• G.51 Audit Vault Agent in Unreachable state upon Failover
• G.52 Unable to Reach Gateway Error

H Multiple Network Interface Cards

• H.1 Enabling A Secondary Network Interface For Audit Vault Server
• H.2 Configuring Physical Network Separation For Database Firewall
• H.3 Enabling NFS On Secondary Network Interface Card For Audit Vault Server
• H.4 Enabling SPA On Secondary Network Interface Card For Audit Vault Server
• H.5 Enabling SSH On A Secondary Network Interface Card For Audit Vault Server
• H.6 Applying Static Routing Rules On Network Interfaces For Audit Vault Server And Database Firewall
• H.7 Enabling Agent Connectivity On Secondary NICs for Audit Vault Server
• H.8 Enabling Agent To Operate In High Availability Environment With Secondary Network Interface Card For Audit Vault Server
• H.9 Disabling A Secondary Network Interface For Audit Vault Server
• H.10 Changing The IP Address On A Secondary Network Interface Card For Audit Vault Server
• H.11 Features Of Network Interfaces For Audit Vault Server

I Adding User Content To System Configuration Files

Index