Fine-grained policies

Fine-grained audit policies can be created and enabled to audit specific resources or activities.

About Fine-Grained Auditing

Fine-grained auditing (FGA) enables you to create a policy that defines specific conditions that must exist for the audit to occur.

For example, fine-grained auditing lets you audit the following types of activities:

• Using an IP address from outside the corporate network

• Selecting or updating a table column

• Modifying a value in a table column

A fine-grained audit policy provides granular auditing of select, insert, update, and delete operations. Furthermore, you reduce the amount of audit information generated by restricting auditing to only the conditions that you want to audit. This creates a more meaningful audit trail that supports compliance requirements. For example, a central tax authority can use fine-grained auditing to track access to tax returns to guard against employee snooping, with enough detail to determine what data was accessed. It is not enough to know that a specific user used the SELECT privilege on a particular table. Fine-grained auditing provides a deeper audit, such as when the user queried the table or the computer IP address of the user who performed the action.

Using Event Handlers in Fine-Grained Auditing

In a fine-grained audit policy, you can specify an event handler to process an audit event.

The event handler provides flexibility in determining how to handle a triggering audit event. For example, it could write the audit event to a special audit table for further analysis, or it could send a pager or an email alert to a security administrator. This feature enables you to fine-tune audit responses to appropriate levels of escalation.

For additional flexibility in implementation, you can employ a user-defined function to determine the policy condition, and identify a relevant column for auditing (audit column). For example, the function could allow unaudited access to any salary as long as the user is accessing data within the company, but specify audited access to executive-level salaries when they are accessed from outside the company.

Auditing Specific Columns and Rows

A fine-grained audit policy can target one or more specific columns, called a relevant column, to be audited if a condition is met.

This feature enables you to focus on particularly important, sensitive, or privacy-related data to audit, such as the data in columns that hold credit card numbers, patient diagnoses, Social Security numbers, and so on. A relevant-column audit helps reduce the instances of false or unnecessary audit records, because the audit is triggered only when a particular column is referenced in the query.

You further can fine-tune the audit to specific columns and rows by adding a condition to the audit policy. For example, suppose you enter the following fields in the Create Fine Grained Audit page:

• Condition: department_id = 50

• Columns: salary, commission_pct

This setting audits anyone who tries to select data from the salary and commission_pct columns of employees in Department 50.

If you do not specify a relevant column, then Oracle Database applies the audit to all the columns in the table; that is, auditing occurs whenever any specified statement type affects any column, whether or not any rows are returned.

Creating Fine-Grained Audit Policies

Follow these steps to create fine-grained audit policies.

1. Log in to Oracle Database Security Central Console as an auditor.

2. Select Policies.

3. Select the database you want to manage audit policies for.

4. Click the Find-Grained policies section.

5. Select Create.

6. Define the audit policy as follows:

   • Policy Name - Enter a name for this fine-grained audit policy.

   • Audit Trail - Select from one of the following audit trail types:

     Definition	Description
     Database	Writes the policy records to the database audit trail. In Oracle AI Database 26ai this in the UNIFIED_AUDIT_TRAIL dictionary view and in prior releases it is the SYS.FGA_LOG$ system table.
     Database with SQL Text	Performs the same function as the Database option, but also populates the SQL bind and SQL text CLOB-type columns of the UNIFIED_AUDIT_TRAIL (Oracle AI Database 26ai) or SYS.FGA_LOG$ (prior to Oracle AI Database 26ai) tables.
     XML	Writes the policy records to an operating system XML file. To find the location of this file, a database administrator can run the following command in SQL*Plus: SQL> SHOW PARAMETER AUDIT_FILE_DEST
     XML with SQL Text	Performs the same function as the XML option, but also includes all columns of the audit trail, including SQLTEXT and SQLBIND values.

     Warning: Be aware that sensitive data, such as credit card numbers, appear in the audit trail if you collect SQL text.

   • Schema - Select a schema to audit.

   • Objects - Select an object to audit.

   • Statements - Select one or more SQL statements to be audited. The available options are: DELETE, INSERT, SELECT, or UPDATE.

   • Columns - (Optional) Enter the names of the database columns (relevant columns) to audit. Separate each column name with a comma. If you enter more than one column, select All or Any as the condition that triggers this policy.

   • Conditions - (Optional) Enter a boolean condition to filter row data. For example, department_id = 50 .

     If this field is blank or null, auditing occurs regardless of condition.

   • Handler Schema - (Required if you specify an event handler function) Enter the name of the schema account in which the event handler was created. For example: SEC_MGR

   • Handler Package - (Required if you specify an event handler function) Enter the name of the package in which the event handler was created. For example: OE_FGA_POLICIES

   • Handler Function - (Optional) Enter the name of the event handler. For example: CHECK_OE_VIOLATIONS

7. Select Save.

Manage Fine-Grained Audit Policies

Follow these steps to enable, disable, or delete fine-grained audit policies.

1. Log in to Oracle Database Security Central Console as an auditor.

2. Select Policies.

3. Select the database you want to manage audit policies for.

4. Click the Find-Grained policies section.

5. Select the audit policies you want to enable or disable.

6. Select Enable, Disable, or Delete.

7. Select OK.