Preparing Targets for Sensitive Data Discovery and Global Sets

You can create global sets, including privileged users, sensitive objects, IP addresses, and more, for your Oracle Databases as part of Global Sets.

In order to create these global sets, privileged users and sensitive objects need to be discovered on your Oracle Database by adding privileges to the database user and gathering statistics, respectively.

Related Topics

Data Discovery & Classification

Prerequisites for Enabling Sensitive Data Discovery

Complete these prerequisites before enabling Sensitive Data Discovery in .

If you don’t have an existing user for auditing, create a user account for on the Oracle AI Database. For example:

CREATE USER <username> IDENTIFIED BY <password>

You will use this user name and password when registering this Oracle Database as a target in the Audit Vault Server.

Add the Oracle AI Database as a target in the Audit Vault Server. See Registering or Removing Targets in Audit Vault Server

Managing Privileges for Discovering Privileged Users and Sensitive Objects

Before global Privileged User Sets can be used, download and run the target setup script on the Oracle Database to add privileges to the user as follows.

Downloading Oracle Database Setup Scripts

To download the scripts from the console:

Log in to the console as an administrator.
Select Targets.
Select Target Setup Script .

Download and run the target setup script on the Target Oracle database to add privileges to the user.

You can also access the scripts in the following directory (Linux example):

/opt/avdf/defaultagent/av/plugins/com.oracle.av.plugin.oracle/config/

Enabling User Privileges for Oracle Database for Discovering Privileged Users and Sensitive Objects

To add the required privileges, run the setup scripts from the previous steps:

Note: The downloaded zip file contains SQL scripts for several functions, this workflow is only to enable the discovery of privileged users and sensitive objects.

Connect as the SYS user with the SYSDBA privilege. For example:
```
CONNECT SYS / AS SYSDBA
```

Run the following script:

@oracle_user_setup.sql <username> <ASSESSMENT_DISCOVERY>

Revoking User Privileges for Oracle Database for Discovering Privileged Users and Sensitive Objects

To disable discovery of privileged users and sensitive objects for the target, revoke the privileges of the user:

Connect to the database as the SYS user with the SYSDBA privilege.

Run the following script:

@oracle_drop_db_permissions.sql <username> <ASSESSMENT_DISCOVERY>

Managing Statistics Gathering for Discovering Sensitive Objects

Before global Sensitive Object Sets can be used, statistics need to be gathered on the Oracle Database.

Connect as the SYS user with the SYSDBA privilege. For example:
```
CONNECT SYS / AS SYSDBA
```
Run this command:
```
exec DBMS_STATS.GATHER_DATABASE_STATS
```
Alternatively, you can run the DBMS_STATS procedure for all objects in a particular schema:
```
exec DBMS_STATS.GATHER_SCHEMA_STATS(<schema_name>);
```

Note: To invoke this procedure you must be the owner of the table, or you need the ANALYZE ANY privilege. For objects owned by SYS, you must be either the owner of the table, or you need the ANALYZE ANY DICTIONARY privilege or the SYSDBA privilege.