Manage SQL Firewall

Managing your SQL Firewall policies and configurations helps ensure that your databases are protected from threats while also ensuring that intended SQL actions can be taken on your databases. See the below topics for information on how to update your SQL Firewall configurations and policies.

Delete Learned SQL Data for a User

Deleting will remove the learned SQL for the selected database user. You typically have to delete the learned SQL when you need to remove SQL Firewall protection for a database user who is no longer active or has changed responsibilities in the system.

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
Expand the Firewall Policies tab on the left navigation menu.
Select Oracle SQL Firewall.
Select the database corresponding to the user(s) you wish to delete learned SQL for.
Expand the SQL learning for users section.
Select the user(s) you want to delete learning for.
Select Delete.
Select Ok in the confirmation.

Deleting learned SQL will not have an impact on already created or enabled SQL Firewall policies.

Create a Session Context Only SQL Firewall Policy

You can only create and apply this policy to users that have no SQL Firewall learnings and SQL Firewall policies associated with them.

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
Expand the Firewall Policies tab on the left navigation menu.
Select Oracle SQL Firewall.
Select the database you want to update SQL Firewall policies for.
Expand the SQL Firewall policy for users section.
Select Create.
Select the Actions on violations option.
- Allow and log - This option will observe and allow all SQL statements and connections to the database while logging any violations.
- Block and log - This option will block any SQL statements and database connections not listed in the policy and log the violations. Consider this option when you want SQL Firewall to prevent unauthorized SQL traffic to the database.
Decide if the policy will apply to top level SQL.

During the learning phase, SQL Firewall records the SQL workload to build the allowlist. If Top Level SQL is selected, only the top-level SQL or PL/SQL statement is learned. If Top Level SQL is not selected, SQL Firewall also learns and records all SQL statements executed within the PL/SQL statement.
Enter in the allowed values for client IP, client program, and OS users.
Select Save.

Update SQL Firewall Policies

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
Expand the Firewall Policies tab on the left navigation menu.
Select Oracle SQL Firewall.
Select the database you want to update SQL Firewall policies for.
Expand the SQL Firewall policy for users section.
Select a database user name.

This will take you to the policy details page.
(Optional) Update the Enforcement policy in the Enforcement option section.
- SQL statements - This option enforces the checks only on the SQL statements.
- Session contexts - This option enforces the checks only on the database connection paths.
- SQL statements & session contexts - This options enforces both SQL statements and session context.
(Optional) Update the Actions on violations in the Enforcement option section.
- Allow and log - This option will observe and allow all SQL statements and connections to the database while logging any violations.
- Block and log - This option will block any SQL statements and database connections not listed in the policy and log the violations. Consider this option when you want SQL Firewall to prevent unauthorized SQL traffic to the database.
(Optional) Add or remove SQL statements to/from the SQL Firewall policy in the SQL statement section.
Select Save.

Note: Ensure that:

If you modify an existing SQL Firewall policy by adding SQL statements to the Allowed SQLs and encounter the “ORA-48718: Invalid SQL signature. Provide a valid SQL signature that have been collected from violation logs.” error, it may indicate that the SQL signatures for the selected violation entries have not yet been retrieved into DBSec Central.
When SQL Firewall violation data is collected from the SYS.DBA_SQL_FIREWALL_VIOLATIONS audit trail, the corresponding SQL signatures are not immediately available for use in policy modifications. Run a Retrieve operation for SQL Firewall on the target to refresh the SQL signatures from the database. After the retrieval completes, the SQL statements from the violation logs can be successfully added to the SQL Firewall policy.

Export and Import SQL Firewall Policies

SQL Firewall policies can be exported and imported as .json files into a secondary DBSecCentral system.

Note: The maximum supported file size for import and export operations is 1 GB.

Export

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
Expand the Firewall Policies tab on the left navigation menu.
Select Oracle SQL Firewall.
Select the database you want to export policies for.
Expand the SQL Firewall policy for users section.
Select the user you want to export policies for.

You can only export one database user's policies at a time.
Select Export
Create a password for the .json file.
Select Save.

Import

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
Expand the Firewall Policies tab on the left navigation menu.
Select Oracle SQL Firewall.
Select the database you want to export policies for.
Expand the SQL Firewall policy for users section.
Select Import
Chose the location of the file
Enter the password for the .json file.
Select Save.

Disable or Enable SQL Firewall Policies

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
Expand the Firewall Policies tab on the left navigation menu.
Select Oracle SQL Firewall.
Select the database you want to enable or disable policies for.
Expand the SQL Firewall policy for users section.
Select the user(s) you want to enable or disable policies for.
Select Disable or Enable. Disabling will stop the SQL Firewall from evaluating any incoming SQL traffic against this SQL Firewall policy. However, this will not delete the policy and it can be enabled again later.

Delete SQL Firewall Policies

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
Expand the Firewall Policies tab on the left navigation menu.
Select Oracle SQL Firewall.
Select the database you want to delete policies for.
Expand the SQL Firewall policy for users section.
Select the user(s) you want to delete policies for.
Select Delete.
Select Ok.

This will delete the SQL Firewall policy and a SQL learning will have to be initiated again to re-create this policy.