Introducing

Before you start using , you should understand how its components such as targets and policies work.

Downloading the Latest Version of This Manual

Before using , you should ensure that you have the latest version of the documentation.

You can download the latest version of this manual from the following website:

https://docs.oracle.com/en/database/oracle/database-security-central/sigau/index.html

You can find documentation for other Oracle products at the following website:

https://docs.oracle.com

Learning About

You should understand the features, components, users, and deployment of .

To find this information, refer to * Concepts Guide*.

The Auditor’s Role

An auditor manages database security posture and compliance activities using Oracle database security console.

After the administrator registers the targets, the auditor can strengthen database security by configuring Audit, Database Vault, Database Firewall, and SQL Firewall policies. The auditor can also monitor database activity collection by reviewing the status of audit trails and Database Firewall operations, and can create alert policies as needed. To support compliance requirements, the auditor can review and manage database activity reports.

An auditor uses the console to configure the following:

• Targets - As an auditor, you can specify audit and/or firewall policies for the target you are monitoring.

  Note: For each target you are monitoring, the administrator must configure a target in the Audit Vault Server.

• Unified Policy Management - For any supported database, you can use Oracle Audit Vault and Database Firewall to design Audit, Database Vault, Database Firewall, and SQL Firewall policies based on your requirements.

• Audit Policies - For Oracle databases, you can use to design audit policies and provision them to the database.

• Alerts - You can create simple or complex alerts based on conditions you specify for the targets you are monitoring. You can also specify alert notifications using email templates.

• Audit Trails - For any target type, you can monitor the status of audit trails and see audit reports.

• Reports - You can schedule and generate a number of audit and firewall reports in , create report notifications, as well as add your own customized reports.

**Auditor Roles in **

There are three auditor roles in , with different access levels:

• Super Auditor - This role has access to all targets and can grant access to specific targets and groups to an auditor. A super auditor can also assign the super auditor role to others.

• Auditor- This role can only see data for targets to which they have been granted access by a super auditor.

• Readonly Auditor - This role has read only access to targets, audit trails, Database Firewall monitoring points, dashboard, reports, charts, access rights data, and can add filters.

See Also:

• Understanding Targets

• Managing Policies

• Database Firewall Policies

• Creating Audit Policies for Oracle Databases

• Creating Alerts

• Viewing a List of Audit Trails for a Target

• Reports

• Managing Access and Other Settings

Understanding Targets

A target is any supported database or non-database that you monitor with .

Targets can be monitored by the Audit Vault Agent, the Database Firewall, or the SQL Firewall.

The administrator creates and configures targets, providing host addresses, usernames, passwords, and other necessary information.

For a target to be monitored by Database Firewall, the administrator must configure the Database Firewall, and also configure a monitoring point for every target.

Once targets are configured, an auditor can do the following for each one:

• Analyze and investigate the risks, and plan for mitigation as per organization policies.

• Enable stored procedure auditing (SPA)

• If the target is a database by a Database Firewall:

  • Design and apply a firewall policy

  • View the status of configured monitoring points

• If the target is an Oracle database:

  • Define and provision the Audit policies, Database Vault, or SQL Firewall policies based on your requirements.

  • Retrieve security assessment, user assessment, and discover sensitive objects for the target.

• Generate a variety of reports

• Monitor audit trail status

Super auditors can create target groups for access control purposes. Super auditors grant auditors access to individual targets or to target groups.

See Also: Managing Targets

Understanding Firewall Policies

A Firewall policy monitors Oracle Database statements, objects, privileges, or fine-grained auditing.

See Also:

• Chapter 4 of * Concepts Guide* for detailed information.

• Database Firewall Policies

• SQL Firewall Policies

Understanding Audit Policies and Audit Data Collection

Learn how audit policies determine what audit data is collected.

See Also:

• Unified Policy Management chapter of the * Concepts Guide*.

• Creating Audit Policies for Oracle Databases

Understanding Database Vault Policies

Learn about how Database Vault can be used to protect your database.

See Also:

• Unified Policy Management chapter of the * Concepts Guide*.

• Database Vault Policies

Configuring Alerts and Notifications

lets you define rule-based alerts on audit records and specify notification actions for those alerts.

Whenever an audit event meets the rule or condition defined in the alert definition, an alert is raised and a notification is sent as specified. You can define alerts by type of target, the number of times an event occurs, and by using available fields in audit records to define a Boolean condition that must be met. You can also configure email templates to be used for alert notifications.

You can monitor and respond to alerts from the console and from alert reports.

See Also: Creating Alerts

Generating Reports

As an auditor, you can generate various audit reports for the targets to which you have access.

You can schedule, print, and/or email the reports to others, in PDF or XLS format. Reports include information on audit data, assessments, and stored procedures. You can also generate compliance reports to meet regulations associated with credit card, financial, data protection, and health care-related data.

also lets you browse and customize report data interactively, and upload your own custom reports created with third party tools.

See Also:

• Reports

• User Assessment

Creating Users and Managing Access

A super auditor creates auditor accounts, and manages auditor access to targets and target groups.

See Also: Managing Access and Other Settings for information on these functions.

Logging in and Understanding the Console UI

After you log in to the console, you can work with various tabbed pages and lists of objects.

Logging in to the Console

To log in to the console, you must have a valid user name and password.

To log in to the console:

1. From a browser, enter the following URL:

   https://*host*/console

   where host is the server where you installed Audit Vault Server.

   For example:

   https://192.0.2.1/console

2. In the Login page, enter your user name and password, and then select Login.

   The Home page appears.

Understanding the Tabs in the Console UI

An auditor or super auditor can see the auditor’s dashboard on the home page and the functions that are available for the auditor roles.

Home page

The Home tab on the console has the following sections:

• Database fleet activity monitoring agents

• Oracle Database fleet security posture

• Key risks to review

• Database configuration

  • Users

  • Sensitive data

There is an option to filter the display by time period.

Other tabs

• Targets - Manage schedules for assessment and sensitive data discovery, setup target groups and view audit trails and monitoring points configured for a target.

• Discover & Classify - Discover and identify sensitive data, and create reusable sets, such as IP addresses, OS users, database users, and roles, for use across Security Central features.

• Policies - Manage Audit, Database Vault, Firewall (Oracle SQL Firewall and Database Firewall), and Alert policies.

• Alerts - Manage alerts.

• Reports - Generate default reports, schedule reports, customize reports online, and upload your custom reports.

• Settings - Change your password, create and manage email distribution lists, configure email notification templates for alerts and reports, view audit trail and monitoring point status, manage user accounts and access, and view job status.

Working with Lists of Objects in the UI

Throughout the Audit Vault Server UI, you will see lists of objects such as reports, users, targets, firewall policies, and so on.

You can filter and customize any of these lists of objects in the same way as you can for reports. This section provides a summary of how you can filter and custom the display of lists of objects.

See Also: Filtering Data in a Report

To filter and control the display of lists of objects in the Audit Vault Server UI:

1. Select the report, list, or column heading.

2. You can customize the list, by selecting any of the following available options:

   • Sort Ascending

   • Sort Descending

   • Hide Column

   • Control Break