Using SQL Firewall with DBSecCentral

You can use DBSecCentral to administer and manage SQL Firewall on Oracle AI Database 26ai targets.

SQL Firewall is part of the Oracle AI Database kernel, see the Oracle AI Database Oracle SQL Firewall User’s Guide for detailed information about the capabilities and configuration of SQL Firewall.

Prerequisites

Complete these prerequisites before using SQL Firewall in Oracle Database Security Central.

If you don’t have an existing user for auditing, create a user account for Oracle Database Security Central on the Oracle AI Database. For example:
```
CREATE USER <username> IDENTIFIED BY <password>
```
You will use this user name and password when registering this Oracle Database as a target in the Audit Vault Server.
Add the Oracle AI Database 26ai as a target in the Audit Vault Server. See Registering or Removing Targets in Audit Vault Server

Enable and Disable SQL Firewall on the Target Database

To enable or disable SQL Firewall, log in to the target database and use the ENABLE and DISABLE procedures in the SYS.DBMS_SQL_FIREWALL package.

Grant Privileges to the DBSecCentral User

Before SQL Firewall can be used with DBSecCentral, download and run the target setup script on the Oracle AI Database to add privileges to the user as follows.

Download the Oracle AI Database setup script:
1. Log in to the Oracle Database Security Central console as an administrator.
2. Select Targets.
3. Select Target Setup Script .
Run the setup script:

Note: The downloaded zip file contains SQL scripts for several functions, this workflow is only to provide privileges for SQL Firewall.
1. Connect as the SYS user with the SYSDBA privilege. For example:
```
CONNECT SYS / AS SYSDBA
```
2. Run the following script:
```
@oracle_user_setup.sql <username> RETRIEVE_DB_POLICIES
```
  Note: If you need to manage SQL Firewall, you must also grant the SETUP privilege. The SETUP mode grants the SQL_FIREWALL_ADMIN role, which is required to access the DBMS_SQL_FIREWALL package. It also grants the privileges required to run the SYS.DBA_SQL_FIREWALL_VIOLATIONS audit trail, allowing DBSec Central to collect SQL Firewall violation information.

Start the SQL Firewall Violations Audit Trail

Use the procedure documented in Configuring Audit Trail Collection to start the SYS.DBA_SQL_FIREWALL_VIOLATIONS audit trail.

Enable Automated Cleanup of the SQL Firewall Violation Logs

If the av.collector.enable_trail_cleanup audit collection attribute is set to yes, then SQL Firewall violation logs that are over one week old with be purged from the database automatically. This purge job will run once every 24 hours, running for the first time after the SYS.DBA_SQL_FIREWALL_VIOLATIONS audit trail has been running continuously for 24 hours.

See Modifying Targets and Audit Trail Cleanup for more information on how to set the audit collection attribute.

Oracle Database Setup Scripts