Configuring Policies for Unknown Traffic

Learn how to configure Database Firewall policy for unknown traffic.

Database Firewall policy rules can be configured for SQL statements that are not recognized for the following possible reasons:

• Database Firewall is unable to parse the SQL statement

• Semantics of SQL statement is not valid

• Communication protocol used by the client program and the target database is not supported by Database Firewall

Note: Interpretation of Java code is not supported by Database Firewall.

To set the policy rules for unknown traffic:

1. Log in to the Oracle Database Security Central console as an auditor.

2. Select Policies.

3. Select Database Firewall Policies in the left navigation menu.

4. Select the name of the specific policy. The details of the policy are displayed on the page.

5. Select Configuration in the top right corner.

6. Select Unknown Traffic sub tab in the main page.

7. Assign the Action, Logging Level, and Threat Severity accordingly.

8. Optionally select Set threshold for escalating action checkbox to apply relevant action after unknown traffic statements exceed the number of times specified as the threshold limit. Then, enter the following

   1. Threshold: Enter the number of times unknown traffic must be seen before the escalation action is taken.

   2. Threshold Time (in seconds): Set the threshold time.

   3. Threshold Action: Select Alert or Block as the action taken after the threshold is met.

   4. Substitution SQL (Optional): When Block is selected for Threshold Action, enter a SQL statement to substitute for the unknown SQL statement.

   See Also: Blocking SQL and Creating Substitute Statements