Contents

List of Figures

List of Tables

Title and Copyright Information

Preface

• Audience
• Documentation Accessibility
• Downloading the Latest Version of this Manual
• Where to Find More Information
• Related Documents
• Conventions

Changes In This Document

• Revision History

1 Overview of Oracle Audit Vault and Database Firewall

• 1.1 Introduction to Database Security
  • 1.1.1 What Is Auditing?
  • 1.1.2 What Is Database Activity Monitoring?
  • 1.1.3 Why Auditing and Monitoring?
• 1.2 What Is Oracle Audit Vault and Database Firewall?
  • 1.2.1 Introduction to Oracle Audit Vault and Database Firewall
  • 1.2.2 Audit Data Consolidation Functions
  • 1.2.3 Oracle Database Firewall Functions
  • 1.2.4 How Oracle Audit Vault and Database Firewall Fits into the Oracle Security Architecture
• 1.3 Oracle Audit Vault and Database Firewall Architecture, Components, and Roles
  • 1.3.1 Oracle Audit Vault and Database Firewall Terminology
  • 1.3.2 Oracle Audit Vault and Database Firewall Components
    • 1.3.2.1 Introduction to Oracle Audit Vault and Database Firewall Components
    • 1.3.2.2 About Oracle Audit Vault Server
    • 1.3.2.3 About Oracle Audit Vault Information Lifecycle Management
    • 1.3.2.4 About Audit Vault Agent
    • 1.3.2.5 About Oracle Database Firewall
    • 1.3.2.6 Oracle Audit Vault and Database Firewall Components Working Together
    • 1.3.2.7 Oracle Audit Vault and Database Firewall Network Topology
  • 1.3.3 Roles and User Accounts in Oracle Audit Vault and Database Firewall
  • 1.3.4 Integrating Other Systems with Oracle AVDF
    • 1.3.4.1 Integrating Oracle AVDF with F5 BIG-IP ASM
    • 1.3.4.2 Integrating Syslog With a SIEM System
• 1.4 Understanding the Software Appliance Model
• 1.5 Oracle Audit Vault and Database Firewall and Oracle Enterprise Manager
• 1.6 Planning an Oracle Audit Vault and Database Firewall Deployment
• 1.7 Support Policy When Third Party Software is Installed on Oracle AVDF

2 Planning the Audit Vault Server Deployment

• 2.1 Introduction to Oracle Audit Vault Server Deployment
• 2.2 Planning and Rolling Out the Audit Vault Server
• 2.3 High Availability in Oracle Audit Vault and Database Firewall

3 Planning the Audit Vault Agent Deployment

• 3.1 Introduction to Oracle Audit Vault Agent Deployment
• 3.2 Understanding Audit Data Collection and Audit Policies
  • 3.2.1 Introduction to Audit Data Collection and Audit Policies
  • 3.2.2 What to Audit
    • 3.2.2.1 Auditing Relevant Activities
    • 3.2.2.2 Guidance on Auditing for Database Activity
  • 3.2.3 Predefined Unified Audit Policies for Oracle Database
• 3.3 Managing Oracle Database Audit Policies Using Oracle Audit Vault and Database Firewall
• 3.4 Monitoring Oracle Database Entitlements
• 3.5 Planning and Rolling Out Audit Vault Agent

4 Database Firewall Deployment

• 4.1 Planning the Protection Level for Your Databases
• 4.2 Overview of Oracle Database Firewall Deployment
  • 4.2.1 Introduction to Oracle Database Firewall Deployment
  • 4.2.2 In-line (bridge)
  • 4.2.3 Proxy
  • 4.2.4 Out-of-Band
  • 4.2.5 Host Monitor
• 4.3 Understanding Oracle Database Firewall Policies
  • 4.3.1 Introduction to Oracle Database Firewall Policies
  • 4.3.2 Components of an Oracle Database Firewall Policy
    • 4.3.2.1 Exception Rules
    • 4.3.2.2 Analyzed SQL
    • 4.3.2.3 Session Profiles
    • 4.3.2.4 Novelty Policies
    • 4.3.2.5 Default Rule
  • 4.3.3 Flow of SQL Through a Database Firewall Policy
  • 4.3.4 How Oracle Database Firewall Handles Unauthorized SQL
• 4.4 Planning and Rolling Out the Database Firewall

5 Oracle Audit Vault and Database Firewall Reports and Alerts

• 5.1 Introduction to Oracle Audit Vault and Database Firewall Reports
• 5.2 Built-in Reports
  • 5.2.1 How to Use the Built-in Reports
  • 5.2.2 Available Built-in Reports
  • 5.2.3 Customizing Built-in Reports
  • 5.2.4 Examples of Customizing Built-in Reports
    • 5.2.4.1 Login Failures Report
    • 5.2.4.2 Database Schema Changes
• 5.3 Custom Reports
  • 5.3.1 Introduction to Custom Reports
  • 5.3.2 Tools for Creating Your Own Custom Reports for Oracle AVDF
• 5.4 Alerts and Notifications

Index