Oracle Cloud Infrastructure Documentation

Audit Policies

An audit policy in Oracle Data Safe defines what database activities should be audited and logged for a target database; for example, administrator activity or user activity. When you register a target database, Oracle Data Safe retrieves the unified audit policies from the target database and creates corresponding audit policy resources.

Security policies in Oracle Data Safe provide a higher-level management and provisioning layer for audit policies. A security policy defines what security standards or controls should be applied on your target database; for example, Center for Internet Security (CIS) recommendations. Oracle Data Safe provides predefined security policies that simplify provisioning of auditing configurations aligned with best practices and compliance standards. To learn how to manage audit policies, see Security Policies.

Once provisioned, the underlying unified audit policies of security policies generate audit records for activities that match the configured audit conditions. In Oracle Data Safe, you can manage audit data volume on the target database by using the auto purge feature (disabled by default), and manage collected audit data retention by using audit retention settings.

Summary of Oracle Predefined Unified Audit Policies

The following table provides a quick summary of the Oracle predefined unified audit policies.

Audit Policy Name Description
ORA_STIG_RECOMMENDATIONS Audits database activities recommended by the Security Technical Implementation Guide (STIG) to help meet government and defense security compliance requirements.
ORA_LOGIN_LOGOUT Audits user login and logout activity to track database session access and user authentication events.
ORA_ALL_TOPLEVEL_ACTIONS Audits all top-level SQL actions issued directly by users, including DDL and DML operations executed at the database level.
ORA_LOGON_LOGOFF Audits user logon and logoff events to provide visibility into database session establishment and termination.
ORA_CIS_RECOMMENDATIONS Audits activities recommended by the Center for Internet Security (CIS) benchmarks to support security best practices and compliance.
ADB_PARURL_ACCESS_AUDIT Audits access to Oracle Autonomous Database PAR (Pre-Authenticated Request) URLs to monitor external data access activity.
ADB_PARURL_PKG_ACCESS_AUDIT Audits execution and access of packages related to PAR URL functionality in Autonomous Database environments.
COMMON_USER_LOGONS Audits login activity performed by common users in a multitenant Oracle Database environment.
ORA_ATP_ALL_TOPLEVEL Audits all top-level user actions in Oracle Autonomous Transaction Processing (ATP) databases.
ORA_ATP_DDL_OPERATIONS Audits Data Definition Language (DDL) operations in Oracle Autonomous Transaction Processing environments, including CREATE, ALTER, and DROP actions.
ORA_ATP_COMMON_USER_LOGONS Audits login activity by common users in Oracle Autonomous Transaction Processing environments.
COMMON_USER Audits activities performed by common users across containers in a multitenant database architecture.
SYS_USER_ACTIONS Audits actions performed by the SYS user, including privileged administrative operations.
ADB_MANDATORY_AUDIT Provides mandatory auditing for critical Oracle Autonomous Database activities that cannot be disabled.
ORA$DICTIONARY_SENS_COL_ACCESS Audits access to sensitive data dictionary columns to help protect critical database metadata and configuration information.
ADB_ADMIN_AUDIT Audits administrative actions performed within Oracle Autonomous Database environments.
ORA_RAS_POLICY_MGMT Audits Real Application Security (RAS) policy management operations, including creation and modification of security policies.
ORA_DV_AUDPOL2 Audits Oracle Database Vault security operations and policy-related activities for enhanced privileged access monitoring.
ORA_DV_AUDPOL Audits Oracle Database Vault events, including realm protection, command rules, and security administration activities.
ORA_SECURECONFIG Audits security-relevant database configuration changes and actions recommended by Oracle secure configuration best practices.
ORA_DATABASE_PARAMETER Audits changes to database initialization parameters and system configuration settings.
ORA_ACCOUNT_MGMT Audits user account management activities such as user creation, modification, password changes, and account deletion.
ORA_LOGON_FAILURES Audits failed database login attempts to help detect unauthorized access attempts and authentication issues.
ORA_RAS_SESSION_MGMT Audits Real Application Security (RAS) session management activities, including session creation and termination.
Direct DB access Audits direct access to the database, including connections that bypass application layers.
User activity auditing Audits user-initiated database activities to monitor access and operations performed by database users.
Sys top activity Audits top-level activities performed by highly privileged SYS users.
Admin user activity Audits actions performed by administrative users and privileged roles.
Database schema changes Audits schema modification activities such as CREATE, ALTER, and DROP operations on database objects.
Basic auditing Audits essential database security events including logins, account management, and schema changes.
Login failures Audits failed authentication and unsuccessful login attempts to the database.
Login events Audits successful user login and logout events for database access tracking.
Critical database activity Audits critical database operations that may impact database security, integrity, or availability.

Basic Auditing Policies

Basic audit policies represent a set of recommended audit configurations for Oracle Database. You can enable the following basic auditing policies:

  • Critical database activity
  • Login events
  • Database schema changes

Critical Database Activity

The Critical Database Activity policy allows you to audit critical database activity, for example, when a user, role, or profile is created, modified, or dropped.

The following audit policy gets provisioned on the target database:

CREATE AUDIT POLICY ORA_ADS$_CRITICAL_DB_ACTIVITY
PRIVILEGES EXEMPT ACCESS POLICY,EXEMPT REDACTION POLICY,
ADMINISTER KEY MANAGEMENT,EXPORT FULL DATABASE,IMPORT FULL DATABASE,
CREATE PUBLIC DATABASE LINK, ALTER PUBLIC DATABASE LINK, DROP PUBLIC DATABASE LINK,
CREATE PUBLIC SYNONYM, DROP PUBLIC SYNONYM,
SELECT ANY DICTIONARY, ADMINISTER DATABASE TRIGGER,
PURGE DBA_RECYCLEBIN, LOGMINING
ACTIONS CREATE USER, ALTER USER, DROP USER,
CREATE ROLE, DROP ROLE, ALTER ROLE, SET ROLE, GRANT, REVOKE,
CREATE PROFILE, ALTER PROFILE, DROP PROFILE,
CREATE PLUGGABLE DATABASE, DROP PLUGGABLE DATABASE, ALTER PLUGGABLE DATABASE,
CREATE LOCKDOWN PROFILE, ALTER LOCKDOWN PROFILE, DROP LOCKDOWN PROFILE,
ALTER DATABASE, ALTER SYSTEM,
CREATE TABLESPACE, ALTER TABLESPACE, DROP TABLESPACE,
CREATE ROLLBACK SEGMENT, ALTER ROLLBACK SEGMENT, DROP ROLLBACK SEGMENT,
CREATE DIRECTORY, DROP DIRECTORY,
CREATE DISK GROUP,ALTER DISK GROUP,DROP DISK GROUP,
CREATE PFILE,CREATE SPFILE
ACTIONS COMPONENT = datapump EXPORT,IMPORT
ACTIONS COMPONENT = DIRECT_LOAD LOAD;

AUDIT POLICY ORA_ADS$_CRITICAL_DB_ACTIVITY;
-- enabled for all users

Login Events

The Login Events policy tracks all login and logoff activities by users. For more granularity, specify the trusted users to be excluded, irrespective of whether they are Oracle-maintained users or non-Oracle-maintained users.

The following audit policy gets provisioned on the target database:

CREATE AUDIT POLICY ORA_ADS$_LOGON_EVENTS ACTIONS LOGON,LOGOFF;
CREATE AUDIT POLICY ORA_ADS$_LOGON_FAILURES ACTIONS LOGON;
AUDIT POLICY ORA_ADS$_LOGON_EVENTS EXCEPT <comma separated user list>;
AUDIT POLICY ORA_ADS$_LOGON_FAILURES whenever not successful;

Database Schema Changes

The Database Schema Changes policy tracks all Data Definition Language (DDL) commands issued by any database user, for example, when a table, database link, function, or trigger is created, modified, or dropped.

The following audit policy gets provisioned on the target database:

CREATE AUDIT POLICY ORA_ADS$_DB_SCHEMA_CHANGES
PRIVILEGES
CREATE EXTERNAL JOB, CREATE JOB, CREATE ANY JOB
ACTIONS CREATE PROCEDURE, DROP PROCEDURE, ALTER PROCEDURE,
CREATE PACKAGE, ALTER PACKAGE, DROP PACKAGE, CREATE PACKAGE BODY,
ALTER PACKAGE BODY, DROP PACKAGE BODY,
CREATE FUNCTION, DROP FUNCTION, ALTER FUNCTION,
CREATE TRIGGER, ALTER TRIGGER, DROP TRIGGER,
CREATE LIBRARY, ALTER LIBRARY, DROP LIBRARY,
CREATE SYNONYM, DROP SYNONYM,
CREATE TABLE, ALTER TABLE, DROP TABLE, TRUNCATE TABLE,
CREATE DATABASE LINK, ALTER DATABASE LINK, DROP DATABASE LINK,
CREATE INDEX, ALTER INDEX, DROP INDEX,
CREATE OUTLINE, ALTER OUTLINE,DROP OUTLINE,
CREATE CONTEXT, DROP CONTEXT,
CREATE ATTRIBUTE DIMENSION,ALTER ATTRIBUTE DIMENSION,DROP ATTRIBUTE DIMENSION,
CREATE DIMENSION,ALTER DIMENSION,DROP DIMENSION,
CREATE INDEXTYPE,ALTER INDEXTYPE,DROP INDEXTYPE,
CREATE OPERATOR,ALTER OPERATOR,DROP OPERATOR,
CREATE JAVA,ALTER JAVA,DROP JAVA,
CREATE MINING MODEL,ALTER MINING MODEL,DROP MINING MODEL,
CREATE TYPE BODY,ALTER TYPE BODY,DROP TYPE BODY,
CREATE TYPE,ALTER TYPE,DROP TYPE,
CREATE MATERIALIZED VIEW,ALTER MATERIALIZED VIEW,DROP MATERIALIZED VIEW,
CREATE MATERIALIZED VIEW LOG, ALTER MATERIALIZED VIEW LOG,DROP MATERIALIZED VIEW LOG,
CREATE MATERIALIZED ZONEMAP, ALTER MATERIALIZED ZONEMAP,DROP MATERIALIZED ZONEMAP,
CREATE VIEW, ALTER VIEW, DROP VIEW,
CREATE ANALYTIC VIEW, ALTER ANALYTIC VIEW, DROP ANALYTIC VIEW,
CREATE SEQUENCE, ALTER SEQUENCE, DROP SEQUENCE,
CREATE CLUSTER, ALTER CLUSTER, DROP CLUSTER,TRUNCATE CLUSTER;

AUDIT POLICY ORA_ADS$_DB_SCHEMA_CHANGES;
-- enabled for all users

Admin User Activity Policy

The Admin User Activity policy lets you audit all activities by privileged administrators. These administrators can make significant changes to the wider system. A database administrator (DBA) can have access to sensitive data that is not protected by realms and can exfiltrate it.

The Admin User Activity policy audits all activities for any user who has one of the following privileges or roles:

Admin Privileges

  • SYSOPER
  • SYSDG
  • SYSKM
  • SYSRAC
  • SYSBACKUP

Roles

  • DBA
  • DATAPUMP_EXP_FULL_DATABASE
  • DATAPUMP_IMP_FULL_DATABASE
  • EXP_FULL_DATABASE
  • IMP_FULL_DATABASE

The following audit policy gets provisioned on the target database:

CREATE AUDIT POLICY "ORA_ADS$_ADMIN_USER_ACTIVITY" ACTIONS ALL
WHEN 'SYS_CONTEXT(''USERENV'', ''CURRENT_USER'') NOT IN
(''CTXSYS'',''ORDSYS'',''OJVMSYS'',''DVSYS'',''SI_INFORMTN_SCHEMA'',
''AUDSYS'',''GSMADMIN_INTERNAL'',''ORDPLUGINS'',''DIP'',''MDSYS'',
''OLAPSYS'',''ORDDATA'',''LBACSYS'',''SYSKM'',''OUTLN'',
''ORACLE_OCM'',''SYS$UMP'',''SYSRAC'',''ANONYMOUS'',''GGSYS'',
''REMOTE_SCHEDULER_AGENT'',''SYSBACKUP'',''DBSFWUSER'',''MDDATA'',
''APPQOSSYS'',''DBSNMP'',''GSMUSER'',''GSMCATUSER'',''XS$NULL'',
''SYSTEM'',''SYS'',''SYSDG'',''WMSYS'',''XDB'',''DVF'')'
EVALUATE PER STATEMENT ONLY TOPLEVEL;

AUDIT POLICY ORA_ADS$_ADMIN_USER_ACTIVITY
BY USERS WITH GRANTED ROLES DBA,
DATAPUMP_EXP_FULL_DATABASE,
DATAPUMP_IMP_FULL_DATABASE,
EXP_FULL_DATABASE,
IMP_FULL_DATABASE;

AUDIT POLICY ORA_ADS$_ADMIN_USER_ACTIVITY
BY PUBLIC, SYSDG, SYSKM, SYSRAC, SYSBACKUP;

Patch Installation Steps

The ORA_ADS$_ADMIN_USER_ACTIVITY policy requires support for TOPLEVEL, which is included starting in Oracle Database 19c. For databases older than Oracle Database 19c, apply the required patch from My Oracle Support before provisioning this policy.

Follow these steps to download the patch:

  1. Log in to My Oracle Support.
  2. Select the Patches & Updates tab.
  3. Search for patch number 21493004 and platform Linux x86-64.
  4. Select and download the patch corresponding to the Oracle Database release of the target database.

For Oracle Database 19c, the following audit policy also gets provisioned:

CREATE AUDIT POLICY ORA_ADS$_SYS_TOP_ACTIVITY
ACTIONS ALL ONLY TOPLEVEL;

AUDIT POLICY ORA_ADS$_SYS_TOP_ACTIVITY by SYS;

User Activity Auditing Policy

The User Activity Auditing policy tracks all activity by users who may have access to sensitive data or who are under observation. Be sure to specify which users to audit. These users could be non-admin but privileged users.

When enabling this policy in the interface, you must specify non-Oracle-maintained users to audit.

The following audit policy gets provisioned on the target database:

CREATE AUDIT POLICY ORA_ADS$_USER_ACTIVITY ACTIONS ALL
WHEN 'SYS_CONTEXT(''USERENV'', ''CURRENT_USER'') NOT IN
(''DIP'',''WMSYS'',''XDB'',''ORDDATA'',''OLAPSYS'',''MDSYS'',
''ORDPLUGINS'',''GSMADMIN_INTERNAL'',''SI_INFORMTN_SCHEMA'',
''ANONYMOUS'',''GGSYS'',''DBSFWUSER'',''APPQOSSYS'',''DBSNMP'',
''GSMUSER'',''SYSDG'',''SYS$UMF'',''ORACLE_OCM'',''OUTLN'',
''SYSKM'',''SYS'',''SYSTEM'',''XS$NULL'',''GSMCATUSER'',
''MDDATA'',''SYSBACKUP'',''REMOTE_SCHEDULER_AGENT'',''SYSRAC'',
''CTXSYS'',''DVF'',''OJVMSYS'',''DVSYS'',''AUDSYS'',''ORDSYS'',
''LBACSYS'')'
EVALUATE PER STATEMENT;

AUDIT POLICY ORA_ADS$_USER_ACTIVITY
BY <comma-separated non-Oracle maintained user list>;

This audit policy is intended for non-Oracle users whose activity needs to be monitored.

The policy excludes the following Oracle users:

  • ANONYMOUS
  • APPQOSSYS
  • AUDSYS
  • CTXSYS
  • DBSFWUSER
  • DBSNMP
  • DIP
  • DVF
  • DVSYS
  • GGSYS
  • GSMADMIN_INTERNAL
  • GSMCATUSER
  • GSMUSER
  • LBACSYS
  • MDDATA
  • MDSYS
  • OLAPSYS
  • OJVMSYS
  • ORACLE_OCM
  • ORDDATA
  • ORDPLUGINS
  • ORDSYS
  • OUTLN
  • REMOTE_SCHEDULER_AGENT
  • SI_INFORMTN_SCHEMA
  • SYS
  • SYS$UMF
  • SYSBACKUP
  • SYSDG
  • SYSKM
  • SYSRAC
  • SYSTEM
  • WMSYS
  • XDB
  • XS$NULL

Custom Policies

Custom policies represent a set of custom audit policies that define audit configurations unique to your scenario, for example tracking sensitive data access. You can create custom audit policies in the target database and Oracle Data Safe retrieves them. You can then enable or disable them.

Oracle Predefined Policies

Oracle predefined unified audit policies represent a set of pre-designed, best practice audit policies provided by Oracle Database. They cover audit settings that are commonly relevant to security. Because predefined unified audit policies vary across Oracle Database releases, check the version-specific Oracle Database Security Guide appropriate for your target database.

Oracle predefined unified audit policies are retrieved from the target database by Oracle Data Safe.

Examples include:

  • ORA_ACCOUNT_MGMT
  • ORA_DATABASE_PARAMETER
  • ORA_SECURECONFIG
  • ORA_DV_AUDPOL
  • ORA_DV_AUDPOL2
  • ORA_RAS_POLICY_MGMT
  • ORA_RAS_SESSION_MGMT
  • ORA_LOGON_FAILURES
  • COMMON_USER
  • ADB_ADMIN_AUDIT
  • ADB_MANDATORY_AUDIT