Unified Audit Policy AVCLI Commands

You can find general information on unified audit policy related AVCLI commands.

ENABLE UNIFIED AUDIT POLICY

Use the ENABLE UNIFIED AUDIT POLICY command to enable a unified audit policy.

To enable a unified audit policy for a target. This command provisions the unified audit policy specified on the target.

Syntax

ENABLE UNIFIED AUDIT POLICY <policy name> [EXCLUDE USERS <user names>] [LIST OF USERS <user names>] ON TARGET <target name>

This command provisions the unified audit policy with the specified policy name on the specific target. The policy name must be specified with the actual name.

Arguments

Argument	Description
policy name	The name of policy to be provisioned or enabled.
user names	A list of users separated by comma. This is optional.
target name	The name of specific target for which the unified audit policies is to be enabled.
EXCLUDE USERS	Optional parameter required for LOGON EVENTS and USER ACTIVITY. The list of user names must be separated by comma.
LIST OF USERS	Optional parameter required for LOGON EVENTS and USER ACTIVITY. The list of user names must be separated by comma.

Result

The job to provision audit policy is successfully submitted. The status of the job can be viewed in the Oracle Database Security Central console. Provisioning audit policy takes at least a minute to complete.

Examples

enable unified audit policy tp1 on target t1;

Toggles policy tp1 of target t1 to ON.

enable unified audit policy 'User Activity' list of users 'BOB,JOHN' on target t1;

Enables User Activity policy for users BOB and JOHN on target t1.

enable unified audit policy 'Logon Events' exclude users 'BOB,JOHN' on target t1;

Enables LOGON EVENTS policy for users BOB and JOHN on target t1.

Edit Unified Audit Policy

Custom and Oracle Predefined Unified policies can be enforced on users, roles, and on specific event conditions (successful, unsuccessful, or both).

Syntax

ENABLE UNIFIED AUDIT POLICY <policy name> ON TARGET <target name> [WHENEVER SUCCESSFUL | WHENEVER NOT SUCCESSFUL]

ENABLE UNIFIED AUDIT POLICY <policy name> ON TARGET <target name> FOR USERS EXCEPT <user names> [WHENEVER SUCCESSFUL] [WHENEVER NOT SUCCESSFUL]

ENABLE UNIFIED AUDIT POLICY <policy name> ON TARGET <target name> { [FOR USERS <user names> WHENEVER SUCCESSFUL] [FOR USERS <user names> WHENEVER NOT SUCCESSFUL] [FOR USERS <user names>] [FOR USERS WITH ROLES <role names> WHENEVER SUCCESSFUL] [FOR USERS WITH ROLES <role names> WHENEVER NOT SUCCESSFUL] [FOR USERS WITH ROLES <role names>]}

Arguments

Argument	Description
policy name	The name of policy to be provisioned or enabled.
target name	The name of the specific target for which the unified audit policies have to be enabled.
FOR USERS EXCEPT	Optional parameter. The list of user names must be separated by comma.
FOR USERS	Optional parameter. The list of user names must be separated by comma.
FOR USERS WITH ROLES	Optional parameter. The list of roles must be separated by comma.
WHENEVER SUCCESSFUL	Optional parameter. The policy is enabled for success events.
WHENEVER NOT SUCCESSFUL	Optional parameter. The policy is enabled for fail events.

Examples

enable unified audit policy tp1 on target t1;

Toggles policy tp1 of target t1 to ON.

enable unified audit policy on target t1 'User Activity' for users 'BOB,JOHN';

Enables ‘User Activity’ policy for users BOB and JOHN on target t1.

enable unified audit policy on target t1 'Logon Events' for users except 'BOB,JOHN';

Enables ‘Logon Events’ policy for users BOB and JOHN on target t1.

enable unified audit policy tp2 on target t1 for users 'SCOTT' whenever successful for users with roles 'DBA' whenever not successful;

Enables policy tp2 for users SCOTT whenever it is successful and for users with granted roles dba whenever is not successful on target t1.

enable unified audit policy tp3 on target t1 for users 'HR';

Enables policy tp2 for users HR for both success/failure events on target t1.

Enabling Security Technical Implementation Guidelines (STIG) Compliance

A new category Security Technical Implementation Guidelines (STIG) is available for Unified audit policy. Security Technical Implementation Guidelines (STIG) category can be enabled on Oracle Database targets to make the target STIG compliant. Security Technical Implementation Guidelines (STIG) category is available for Oracle Database target starting with version 21.

Syntax

ENABLE UNIFIED AUDIT POLICY "Security Technical Implementation Guidelines (STIG)" ON TARGET <target name>;

This command enables the following predefined policies available in Oracle Database version starting with 21.

Predefined Audit Policies Name	Can be enabled for users	Event Condition
`ORA_STIG_RECOMMENDATIONS`	All users	Success Failure
`ORA_LOGON_LOGOFF`	All users	Success Failure
`ORA_ALL_TOPLEVEL_ACTIONS`	Privileged users	Success Failure

Privileged users are users retrieved from the user entitlement job.

In case the user entitlement job was never retrieved, then the audit provisioning job will retrieve the user entitlement first to get the privileged users before enabling the above policies in target database.

ENABLE UNIFIED AUDIT POLICY "Security Technical Implementation Guidelines (STIG)" ON TARGET <target name> FOR USERS <user names>;

This command enables following Oracle Predefined policies available in Oracle Database version starting with 21:

ORA_STIG_RECOMMENDATIONS audit policy will be enabled for all users for both successful and failed events.
ORA_LOGON_LOGOFF audit policy will be enabled for all users for both successful and failed events.
ORA_ALL_TOPLEVEL_ACTIONS will be enabled for users provided in the enable statement for both successful and failed events.

Arguments

Argument	Description
target name	The name of the specific target for which the unified audit policies have to be enabled.
FOR USERS	Optional parameter. The list of user names must be separated by comma.

LIST UNIFIED AUDIT POLICIES

Use the LIST UNIFIED AUDIT POLICIES command to list all the various unified core, oracle pre-defined, custom, and all the unified policies of a specific target.

To view all the various unified core, Oracle pre-defined, custom, and all the unified policies of a specific target. The output is displayed in the format |Unified Policy Name|Enabled (Yes/No)|.

Syntax

LIST UNIFIED AUDIT CORE POLICIES FOR TARGET <target name>

This command lists all the core policies for the specified target.

LIST UNIFIED AUDIT ORACLE PREDEFINED POLICIES FOR TARGET <target name>

This command lists all the Oracle pre-defined policies for the specified target.

LIST UNIFIED AUDIT CUSTOM POLICIES FOR TARGET <target name>

This command lists all the custom policies for the specified target.

LIST UNIFIED AUDIT POLICIES FOR TARGET <target name>

This command lists all the unified policies for the specified target.

Arguments

Argument	Description
target name	The name of specified target for which the unified audit policies need to be viewed.

Examples

list unified audit policies for target tg1;

Lists all the unified audit policies (for example core, custom, and others) for tg1.

list unified audit oracle predefined policies for target tg1;

Lists all the Oracle pre-defined policies for tg1.

list unified audit custom policies for target tg1;

Lists all the custom policies for tg1.

list unified audit policies for target tg1;

Lists all the unified policies for tg1.

DISABLE UNIFIED AUDIT POLICY

Use the DISABLE UNIFIED AUDIT POLICY command to disable a unified audit policy.

To disable a unified audit policy. This command provisions the unified audit policy specified on the target and turns it off. The policy name must be specified properly.

Syntax

DISABLE UNIFIED AUDIT POLICY <policy name> ON TARGET <target name>

Arguments

Argument	Description
policy name	The name of policy to be disabled.
target name	The name of specific target for which the unified audit policies is to be disabled.

Result

Examples

disable unified audit policy tp1 on target t1;

Disables the policy tp1 on t1.

RETRIEVE AUDIT POLICIES

Use the RETRIEVE AUDIT POLICIES command to retrieve audit policies configured on the target.

Syntax

RETRIEVE AUDIT POLICIES FROM TARGET <target name>

This command retrieves audit policies configured on the specified target.

Arguments

Argument Description

Argument	Description
target name	The name of the specific target for which the audit policies have to be retrieved. The name is case-sensitive and must be one of the registered targets. See LIST TARGET for a list of registered targets. Special characters (`&<>"/;,*\|=% --`) cannot be used for target names.

target name

The name of the specific target for which the audit policies have to be retrieved.

The name is case-sensitive and must be one of the registered targets. See LIST TARGET for a list of registered targets. Special characters (&<>"/;,*|=% --) cannot be used for target names.

Result

The job to retrieve audit settings is submitted successfully. The status of the job can be viewed in the Oracle Database Security Central console.

In case the audit setting retrieval job fails due to connection issues, then check the connection details of the specified target.