Configuring Database Firewall Policies for Policy Pattern

Learn how to configure Database Firewall policy rules for patterns in the SQL statements.

To set the policy rules for different patterns:

  1. Log in to the Oracle Database Security Central console as an auditor.

  2. Select Policies.

  3. Select Database Firewall Policies in the left navigation menu.

  4. Select the specific policy. The details of the policy are displayed on the page.

  5. Select Configuration in the top right corner.

  6. Select Policy Pattern

  7. In this configure the following:

       
    Pattern Type Action
    Log Pattern Select the option Strip binary objects and comments from log files checkbox to strip binary objects and comments from SQL statements before logging them into Audit Vault Server.
    Action Rule Pattern
    1. In the Threshold action reset time (minutes) field, enter an integer for the number of minutes. If you have set a threshold in any of your policy rules, and the Threshold Action in your rule is taken, the action is not repeated for the time specified here. This prevents too many block or warn actions for the same rule.
    2. In the Action without substitution field, select one of the actions (No response or Drop connection) if any of the Database Firewall policy rules is set to Block, and you have not specified a substitute statement in the rule.
    Syntax Rule Pattern

    Select whether to treat Double quoted strings as identifiers. This determines whether double quoted strings in SQL statements are treated as identifiers or string constants. If you deselect this checkbox, sensitive data masking (if used) will mask text in double quotes.

    For Case sensitive match select whether this policy does case sensitive matching for the following:

    1. Client program name
    2. Database username
    3. Operating system username

  8. Select Save.