Using Database Vault with DBSecCentral

In order to use Database Vault with Oracle DBSecCentral, you will need to grant the DV_MONITOR, and DV_SECANALYST roles. This can be done through the oracle_user_setup.sql. Additionally, you will need the credentials for a user that has the DV_ADMIN role granted.

Prerequisites

Complete these prerequisites before using Database Vault in Oracle Database Security Central.

• Enable Database Vault on your database. For more information see Configuring and Enabling Oracle Database Vault in the Oracle AI Database Vault Administrator’s Guide.

• If you don’t have an existing user for auditing, create a user account for Oracle Database Security Central on the Oracle Database. For example:

  CREATE USER <username> IDENTIFIED BY <password>

  You will use this user name and password when registering this Oracle Database as a target in the Audit Vault Server.

• Add the Oracle Database as a target in the Audit Vault Server. See Registering or Removing Targets in the Audit Vault Server

  Tip: Database Vault policy retrieval happens automatically when a new target is registered. If you intend to use Oracle DBSecCentral to view and manage Database Vault policies on an Oracle Database not yet registered with DBSecCentral, follow the Grant Privileges to the DBSecCentral User procedure before registering the target Oracle Database.

Grant Privileges to the DBSecCentral User

Before Database Vault can be used with DBSecCentral, download and run the target setup script on the Oracle Database to add privileges to the user as follows.

1. Download the Oracle Database setup script:

   1. Log in to the Oracle Database Security Central console as an administrator.

   2. Select Targets.

   3. Select Target Setup Script .

2. Run the setup script:

   Note: The downloaded zip file contains SQL scripts for several functions, this workflow is only to provide privileges for Database Vault.

   1. Connect as the SYS user with the SYSDBA privilege. For example:

      CONNECT SYS / AS SYSDBA

   2. Run the following command for RETRIEVE_DB_POLICIES mode:

      @oracle_user_setup.sql <username> RETRIEVE_DB_POLICIES

      The RETRIEVE_DB_POLICIES mode provides the DV_SECANALYST role which is only used for Database Vault policy retrieval. In order for DBSecCentral to manage Database Vault policies, follow Set Credentials Needed for Database Vault Policy Management.

   3. Run the following command for AUDIT_ADMIN mode:

      @oracle_user_setup.sql <username> AUDIT_ADMIN

      The AUDIT_ADMIN mode provides the AUDIT_ADMIN role which enables a user to create, view, and manage audit policies, data, and trail. For more information on the AUDIT_ADMIN role About Using Oracle AI Database Auditing with Oracle Database Vault in the Oracle AI Database Vault Administrator’s Guide.

Start the Simulation Log Collection

Use the procedure documented in Configuring Audit Trail Collection to start the DVSYS.DBA_DV_SIMULATION_LOG audit trail.

Postrequisites

Retrieve existing Database Vault policies on a database by either manual or automatic retrieval:

• Manually Retrieve Database Vault Policies

• Taking advantage of automatic Database Vault policy retrieval during target registration. See Registering or Removing Targets in the Audit Vault Server