O Configuring Quick JSON Target Type to Collect Audit Data from MongoDB

Learn how to collect MongoDB audit data using Oracle DBSecCentral’s Quick JSON target type.

MongoDB audit data is available in multiple formats like BSON, JSON, or Syslog. Oracle DBSecCentral supports audit data collection from Enterprise Edition in JSON format only.

To register MongoDB as a target, select the target type as Quick JSON. Later provide the required collection attributes for the fields in the MongoDB audit trail, as mentioned in the table below. Quick JSON uses this mapping to read the MongoDB audit file and map it to the fields in the Audit Vault Server.

Additionally, when adding audit trail for the MongoDB target, provide the location of MongoDB audit files. Ensure the Audit Vault Agent user can access MongoDB JSON audit file. If required grant read permissions to the file.

Use Quick JSON target type for reading from JSON audit files without any conversion of data. For situations where the JSON data needs to be converted before it is stored in the Audit Vault Server, use the JSON custom collector.

Table 1 Collection attributes and values

Audit Vault Collection Attribute	MongoDB JSON File Value
`av.collector.qck.starttag`	`atype`
`av.collector.qck.eventtime`	`$.ts.$date`
`av.collector.qck.username`	`$.users[0].user`
`av.collector.qck.os.username`	`$.users[0].user`
`av.collector.qck.eventname`	`$.atype`
`av.collector.qck.commandclass`	`$.atype`
`av.collector.qck.client.ip`	`$.remote.ip`
`av.collector.qck.targetobject`	`$.atype`
`av.collector.qck.targettype`	`$.atype`
`av.collector.qck.eventstatus`	`$.result`
`av.collector.qck.errorid`	`$.result`
`av.collector.qck.errormessage`	`$.result`
`av.collector.qck.target.entity`	`$.param.ns`
`av.collector.qck.target.user`	`$.param.user`
`av.collector.qck.target.role`	`$.param.role`

Note: Delete the attribute av.collector.timezoneoffset during QuickJSON target creation. This attribute is not required for collecting audit data from MongoDB.

See Also: