Oracle Defined Policies

Oracle defined audit policies are audit policies that cover common security scenarios.

To enable or disable Oracle defined audit policies:

  1. Log in to Oracle Database Security Central Console as an auditor.

  2. Select Policies.

  3. In the left navigation, select Audit Policies.

  4. Select the database you want to manage audit policies for.

  5. The Oracle defined policies tab is selected by default.

  6. Expand the section for the types of audit policies.

  7. Select the audit policies you want to enable or disable

  8. Select Enable or Disable.

  9. If you are enabling a policy, provide the required information based on the selected policy. Depending on the policy, you may need to specify one or more of the following: Object list, User list, Role list, Trusted IP address, OS user, or client program list, whether to audit successful actions, failed actions, or both.

    Note: For IP address, OS user, client program, object, user, or role lists, you can specify global sets. Using global sets simplifies future updates, such as adding additional objects, users, or roles, and makes it easier to propagate changes across multiple databases.

  10. Select Enable or Disable.

Database Actions

System Configuration Changes

This policy is enabled internally for the Oracle predefined policies listed below, auditing both successful and unsuccessful events for all database users.

ORA_DATABASE_PARAMETER: For more information see Oracle Database Parameter Changes Predefined Unified Audit Policy in the Oracle AI Database Security Guide

ORA_SECURECONFIG: For more information see Secure Options Predefined Unified Audit Policy in the Oracle AI Database Security Guide

Critical Database Activity

Audits all critical database actions including user and role changes, and data exports/imports.

This policy is enabled internally for the policies listed below, auditing both successful and unsuccessful events for all database users.

ORA_ACCOUNT_MGMT: For more information see User Account and Privilege Management Predefined Unified Audit Policy in the Oracle AI Database Security Guide.

ORA_AV$_CRITICAL_DB_ACTIVITY: Is defined by the policy below:

CREATE AUDIT POLICY ORA_AV$_CRITICAL_DB_ACTIVITY PRIVILEGES EXEMPT ACCESS POLICY,
EXEMPT REDACTION POLICY,
ADMINISTER KEY MANAGEMENT,
EXPORT FULL DATABASE,
IMPORT FULL DATABASE,
CREATE PUBLIC DATABASE LINK,
ALTER PUBLIC DATABASE LINK,
DROP PUBLIC DATABASE LINK,
CREATE PUBLIC SYNONYM,
DROP PUBLIC SYNONYM,
SELECT ANY DICTIONARY,
ADMINISTER DATABASE TRIGGER,
PURGE DBA_RECYCLEBIN,
LOGMINING ACTIONS CREATE USER,
ALTER USER,
DROP USER,
CREATE ROLE,
DROP ROLE,
ALTER ROLE,
SET ROLE,
GRANT,
REVOKE,
CREATE PROFILE,
ALTER PROFILE,
DROP PROFILE,
CREATE PLUGGABLE DATABASE,
DROP PLUGGABLE DATABASE,
ALTER PLUGGABLE DATABASE,
CREATE LOCKDOWN PROFILE,
ALTER LOCKDOWN PROFILE,
DROP LOCKDOWN PROFILE,
ALTER DATABASE,
ALTER SYSTEM,
CREATE TABLESPACE,
ALTER TABLESPACE,
DROP TABLESPACE,
CREATE ROLLBACK SEGMENT,
ALTER ROLLBACK SEGMENT,
DROP ROLLBACK SEGMENT,
CREATE DIRECTORY,
DROP DIRECTORY,
CREATE DISK GROUP,
ALTER DISK GROUP,
DROP DISK GROUP,
CREATE PFILE,
CREATE SPFILE ACTIONS COMPONENT = datapump EXPORT,
IMPORT ACTIONS COMPONENT = DIRECT_LOAD LOAD;

Security Policy Activity

Audits all security events including Database Vault realms and schema changes, Oracle Label Security policy and object modifications, Real Application Security session and administrative actions, and access to dictionary sensitive columns.

This policy is enabled internally for the Oracle predefined policies listed below, auditing both successful and unsuccessful events for all database users.

Related Topics

User Actions

User Login Events

User Login Events audits login and logout activity for a specified list of database users, and captures every unsuccessful login.

The policy enables the corresponding Oracle predefined or creates a new policy based on the target version.

Admin User Activity

Admin User Activity audits all activities by admin users and users that have been granted admin roles.

Admin users are any of the following:

Users are audited if they have been granted any of the following admin roles:

The following audit policies get provisioned on the target database:

CREATE AUDIT POLICY ORA_AV$_ADMIN_USER_ACTIVITY ACTIONS ALL WHEN SYS_CONTEXT('USERENV','CURRENT_USER') NOT IN ()
EVALUATE PER STATEMENT ONLY TOPLEVEL;

AUDIT POLICY ORA_AV$_ADMIN_USER_ACTIVITY BY USERS WITH GRANTED ROLES DBA, AUDIT_ADMIN, DV_ADMIN, SQL_FW_ADMIN;
CREATE AUDIT POLICY ORA_AV$_SYS_TOP_ACTIVITY ACTIONS ALL ONLY TOPLEVEL;

AUDIT POLICY ORA_AV$_SYS_TOP_ACTIVITY by SYS, SYSOPER, SYSDG, SYSKM, SYSBACKUP, SYSRAC;

Note: If your Oracle Database version is either 18c or 12.2, you need to apply patch 21493004 from My Oracle Support to enable the Admin User Activity audit policy.

Dormant User Activity

Dormant User Activity audits all actions performed by dormant users who have not logged in to the database for over 90 days as identified by the user assessment job. Ensure the user assessment job is completed before enabling this policy.

The Dormant User Activity policy is defined as follows:

CREATE AUDIT POLICY ORA_AV$_DORMANT_USER_ACTIVITY ACTIONS ALL
WHEN 'SYS_CONTEXT(''USERENV'', ''CURRENT_USER'') NOT IN ('list of oracle maintained users')' EVALUATE PER STATEMENT AUDIT ONLY TOPLEVEL;

User Activity

The User Activity tracks all activity by users who may have access to sensitive data or who are under observation. These users could be “non-admin but privileged” users. When enabling this policy in the interface, you must specify non-Oracle maintained users to audit.

The User Activity policy is defined as follows:

CREATE AUDIT POLICY ORA_AV$_USER_ACTIVITY ACTIONS ALL

WHEN SYS_CONTEXT('USERENV','CURRENT_USER') NOT IN (<list of oracle maintained users>) EVALUATE PER STATEMENT

Policy can be enabled for privileged users identified by user assessment job or for manual user or global user set.

Data Access

Database Schema Changes

Database Schema Changes policy audits all DDL operations including create, alter, and delete of tables, views, indexes, procedures jobs, and related objects.

The Database Schema Changes policy is defined as follows and is enabled for all the database users, auditing both successful and not successful events.

 CREATE AUDIT POLICY ORA_AV$_DB_SCHEMA_CHANGES PRIVILEGES CREATE EXTERNAL JOB, CREATE JOB, CREATE ANY JOB ACTIONS CREATE PROCEDURE, DROP PROCEDURE, ALTER PROCEDURE, CREATE PACKAGE, ALTER PACKAGE, DROP PACKAGE, CREATE PACKAGE BODY, ALTER PACKAGE BODY, DROP PACKAGE BODY, CREATE FUNCTION, DROP FUNCTION, ALTER FUNCTION, CREATE TRIGGER, ALTER TRIGGER, DROP TRIGGER, CREATE LIBRARY, ALTER LIBRARY, DROP LIBRARY, CREATE SYNONYM, DROP SYNONYM,
CREATE TABLE, ALTER TABLE, DROP TABLE, TRUNCATE TABLE, CREATE DATABASE LINK, ALTER DATABASE LINK, DROP DATABASE LINK, CREATE INDEX, ALTER INDEX, DROP INDEX, CREATE OUTLINE, ALTER OUTLINE,DROP OUTLINE, CREATE CONTEXT, DROP CONTEXT, CREATE ATTRIBUTE DIMENSION,ALTER ATTRIBUTE DIMENSION,DROP ATTRIBUTE DIMENSION,
CREATE DIMENSION,ALTER DIMENSION,DROP DIMENSION, CREATE INDEXTYPE,ALTER INDEXTYPE,DROP INDEXTYPE, CREATE OPERATOR,ALTER OPERATOR,DROP OPERATOR, CREATE JAVA,ALTER JAVA,DROP JAVA, CREATE MINING MODEL,ALTER MINING MODEL,DROP MINING MODEL, CREATE TYPE BODY,ALTER TYPE BODY,DROP TYPE BODY, CREATE TYPE,ALTER TYPE,DROP TYPE, CREATE MATERIALIZED VIEW,ALTER MATERIALIZED VIEW,DROP MATERIALIZED VIEW , CREATE MATERIALIZED VIEW LOG, ALTER MATERIALIZED VIEW LOG,DROP MATERIALIZED VIEW LOG, CREATE MATERIALIZED ZONEMAP, ALTER MATERIALIZED ZONEMAP,DROP MATERIALIZED ZONEMAP, CREATE VIEW, ALTER VIEW, DROP VIEW,CREATE ANALYTIC VIEW, ALTER ANALYTIC VIEW, DROP ANALYTIC VIEW, CREATE SEQUENCE, ALTER SEQUENCE, DROP SEQUENCE, CREATE CLUSTER, ALTER CLUSTER, DROP CLUSTER,TRUNCATE CLUSTER;

Local Database Activity

Local Database Activity policy audits all actions performed via local database connections (including BEQ), where client IP information is not captured.

The Local Database Activity policy is defined as follows and is enabled based on user input provided.

CREATE AUDIT POLICY ORA_AV$_DIRECT_DB_ACCESS
ACTIONS ALL
WHEN '(SYS_CONTEXT(''USERENV'',''IP_ADDRESS'') IS NULL)' EVALUATE PER SESSION ONLY TOPLEVEL;

Non-Trusted Path Auditing

The Non-Trusted Path Auditing policy audits actions performed through non-trusted access paths to detect the use of application accounts outside authorized access channels.

When enabling this policy, specify one or more trusted path attributes, such as IP addresses, operating system (OS) users, and client programs. Also specify the application users or roles to audit, the database objects and actions to audit, and whether to audit successful operations, failed operations, or both.

Audit records are generated when the selected users perform the configured actions on the specified database objects through an access path that does not match the configured trusted path criteria.

This policy is defined and enabled based on the user input provided.

Sensitive Data Access Monitoring

The Sensitive Data Access Monitoring policy audits DML (INSERT, UPDATE, DELETE) operations, and optionally SELECT operations, on sensitive objects identified by the sensitive data discovery job.

When enabling this policy, specify the users or roles to audit, the database objects to audit, the actions to audit, and whether to audit successful operations, failed operations, or both. You can use the sensitive objects identified by the sensitive data discovery job, specify a manual object list, or use Sensitive Object global sets to define the objects to be audited.

This policy is defined and enabled based on the user input provided.

Compliance

Center for Internet Security (CIS) Configuration

CIS is a world-recognized organization that provides consensus-based best practices for helping organizations assess and improve their cyber security posture. They provide resources, such as configuration assessment tools, secure configuration benchmarks, security metrics, and certifications. One of the main objectives of the organization is to help businesses prioritize what they need to do for security, and they strive to provide recommendations in simple, non-technical terms.

This policy is enabled internally for the Oracle predefined policies listed below, auditing both successful and unsuccessful events for all database users.

ORA_CIS_RECOMMENDATIONS ORA_LOGON_LOGOFF for Oracle Database 21c and ORA_LOGIN_LOGOUT for Oracle AI Database 26ai.

Related Topics

Security Technical Implementation Guidelines (STIG)

Security Technical Implementation Guidelines (STIG) can be enabled on Oracle Database targets starting with version 21.

When Security Technical Implementation Guidelines (STIG) is provisioned, the following unified policies are enabled on the target database.

Predefined audit policy name Enabled for users Event condition
ORA_STIG_RECOMMENDATIONS All users
  • Success
  • Failure
ORA_LOGIN_LOGOUT All users
  • Success
  • Failure
ORA_ALL_TOPLEVEL_ACTIONS Privileged users
  • Success
  • Failure

You can use the privileged users identified by the user assessment job, specify your own list of users, or use a global set.

Related Topics

Security Technical Implementation Guidelines (STIG)