Configuring Hybrid Cloud Target Using TCP

You can configure cloud targets for DBCS instances in TCP mode. The Audit Vault server and Audit Vault agent are installed on-premises.

Step 1: Registering On-premises Host on the Audit Vault Server

This configuration step registers the on-premises host in the Audit Vault server.

In case there is already a registered on-premises host in the Audit Vault server installed on the agent for monitoring Oracle Database Cloud Services instances, bypass this procedure. Otherwise, the steps are similar for all target databases that are on-premises.

See Also: Registering Hosts on the Audit Vault Server

Step 2: Installing Audit Vault Agent on Registered On-premises Hosts

This configuration step installs Oracle Audit Vault agents on registered on-premises hosts.

Note:

If there is already an Audit Vault agent installed on an on-premises host that is planned for monitoring DBCS instances then ignore this step. In case there are no agents installed, there are specific requirements for the Audit Vault agents that monitor DBCS instances. The requirements or features are as follows:

1. The agent has to run on-premise.

2. A minimum of one agent must be dedicated to monitor only DBCS instances. There may be multiple agents dedicated to monitor only DBCS instances.

3. The agent should not run on the Audit Vault server.

1. Install the Audit Vault agent on the on-premises host.

   See Also: Deploying the Audit Vault Agent on Host Computers for detailed steps on installing on-premises host.

2. Start the Audit Vault agent.

Step 3: Creating User Accounts on Oracle Database Cloud Service Target Instances

This configuration step creates user accounts on Oracle Database Cloud Service target instances.

Note: The connection methodology differs from on-premises deployments for TCP connections.

Prerequisite

• You must open port 1521 on the DBCS instance for TCP connection so you can use SQL*Plus and SQL*Developer. TCP connection is encrypted by default. It utilizes the native encryption. See Opening Ports on Oracle Database Cloud Service for more information.

Procedure for installation

1. Ensure that the connection has been established to the DBCS instances through TCP as user with SYSDBA administrative privilege.

2. Scripts and respective actions:

   Script	Action
   oracle_DBSecCentral_dbcs_user_setup.sql	To setup target user account.
   oracle_DBSecCentral_dbcs_drop_db_permissions.sql	To revoke permission from user.

3. Run the script in order to setup target user account in specific mode:

   oracle_DBSecCentral_dbcs_user_setup.sql <username> <mode>

   Where <username> is the user name of the Hybrid cloud target user.

   The <mode> can be one of the following:

   Mode	Purpose
   SETUP	To enable stored procedure auditing and collect data from Oracle Cloud instance TABLE audit trail in Oracle Database Security Central.
   RETRIEVE_DB_POLICIES	To set up privileges for retrieving audit policies, SQL Firewall policies and Database Vault policies for Oracle Cloud instance.
   ASSESSMENT_DISCOVERY	To enable user assessment, security assessment and sensitive data discovery for Oracle Cloud instance.
   AUDIT_ADMIN	To manage audit policies for Oracle Cloud instance.

Step 4: Setting Up or Reviewing Audit Policies on Target Oracle Database Cloud Service Instances

This configuration step explains how to manage audit policies on target Oracle Database Cloud Service instances.

Check the audit polices that are enabled and change them as needed. For Oracle Database 11g release 11.2 and Oracle Database 12c instances where the Unified audit is not enabled, it is possible to provision audit policies from the Audit Vault server. If the Unified Trail is enabled on Oracle12c instances, ensure to change the audit policies manually on the DBCS instance.

Note: Ensure to understand the audit settings on the DBCS instances before starting the audit data collection process. Currently one Audit Vault agent supports up to a maximum of 10 cloud target audit trails. The collection speed is up to 25 million audit records per target audit trail, per day. The recommended Audit Vault agent configuration can be found in the Oracle Database Security Central Installation Guide.

Run the DBMS_AUDIT_MGMT package on the DBCS instances for audit clean up, after the data is collected by on-premises Audit Vault Server. The Audit Vault Server supports data retention policies for every target and meets compliance requirements. It allows configuring different retention policies for on-premises and DBCS instances.

Storage requirements on the Audit Vault Server also must be reviewed to ensure enough storage is available, while adding more on-premises or DBCS instance targets to the Audit Vault Server.

Step 5: Creating Targets on Oracle Audit Vault Server for Oracle Database Cloud Service Instances

This configuration step creates targets on Oracle Audit Vault Servers for Oracle Database Cloud Service instances.

To connect to the DBCS instance the configuration is the same as for on-premise targets. The user must define these specific settings on the target configuration page.

1. Log in to Audit Vault console with as an administrator.

2. Select Targets.

3. Select Register button on the right.

4. Enter a Name for thet and select from the Type menu.

5. Optionally fill in the Description field.

6. Under the Audit Connection Details sub, choose the Advanced option.

7. In the Protocol menu, select TCP.

8. In the Target Location field, enter the following settings:

   jdbc:oracle:thin:@//<host_ip>:<port_number>/<service_name>

   Alternatively, you can accomplish this uing the Basic option. Enter the details in Host Name/IP Address, Port, Service Name fields.

9. Enter the User Name and Password.

10. Select Save to save the configuration changes.

Step 6: Starting Audit Trail on Audit Vault Server for Oracle Database Cloud Service Instances

This configuration step starts the audit trail on Oracle Audit Vault Server for Oracle Database Cloud Service instances.

Use this procedure to start an audit trail on the Audit Vault Server for the DBCS instance.

1. Log in to the Audit Vault console as an administrator.

2. In the Targets, select the newly registered target.

3. Under Audit Data Collection section, select Add. The Add Audit Trail dialog is displayed.

4. Select Audit Trail Type as TABLE.

   Note: Other trail types are not supported for DBCS target instances.

5. Select the appropriate values in the Trail Location from the drop down menu.

   The supported table trails for Oracle DBCS target are:

   1. UNIFIED_AUDIT_TRAIL

   2. SYS.AUD$

   3. SYS.FGA_LOG$

   4. DVSYS.AUDIT_TRAIL$

6. Select the Agent Host.

7. Select Save to add the audit trail.