Before using Database Vault with DBSecCentral

To use Database Vault with Oracle Database Security Central, you will need to grant the DV_MONITOR, and DV_SECANALYST roles. This can be done through the oracle_user_setup.sql. These roles are required to retrieve and display Database Vault policies.

To manage Database Vault policies, provide the credentials for a user with the DV_ADMIN role. Oracle Database Security Central temporarily stores these credentials only for the duration of the current session. When the session ends, the credentials are automatically cleared and are not retained.

Before you begin

Complete these prerequisites before using Database Vault in Oracle Database Security Central.

• Enable Database Vault on your database. For more information see Configuring and Enabling Oracle Database Vault in the Oracle AI Database Database Vault Administrator’s Guide.

• If you don't have an existing user for auditing, create a user account for Oracle Database Security Central on the Oracle Database. For example:

  SQL> CREATE USER *`username`* IDENTIFIED BY *`password`*

  You will use this user name and password when registering this Oracle Database as a target in the Audit Vault Server.

• Add the Oracle Database as a target in the Audit Vault Server. See Registering or Removing Targets in the Audit Vault Server

  Tip: Database Vault policy retrieval happens automatically when a new target is registered. If you intend to use Oracle DBSecCentral to view and manage Database Vault policies on an Oracle Database not yet registered with DBSecCentral, follow the Grant Privileges to the DBSecCentral User procedure before registering the target Oracle Database.

• Ensure the target user has sufficient privileges granted for audit policy management. An administrator can grant these using the instructions in Oracle Database Setup Scripts

Start the Simulation Log Collection

Use the procedure documented in Configuring Audit Trail Collection to start the DVSYS.DBA_DV_SIMULATION_LOG audit trail.

Retrieve existing Database Vault policies

Retrieve existing Database Vault policies on a database by either manual or automatic retrieval:

• Manually Retrieve Database Vault Policies

• Taking advantage of automatic Database Vault policy retrieval during target registration. See Registering or Removing Targets in the Audit Vault Server

Manually Retrieve Database Vault Policies

Existing Database Vault policies can be retrieved by Oracle DBSecCentral after the appropriate permissions are granted.

1. Log in to Oracle Database Security Central Console as an auditor.

2. Select Policies

3. Select Database Vault Policies from the left navigation menu.

4. Select the database(s) you want to retrieve policies for.

5. Select Retrieve policies.

Note:

• Existing realms, command rules, and authorizations will be retrieved from the database(s) and stored in the Audit Vault Server database. In the Oracle Database Security Central console these policies will be available as object protection policies, SQL command protection policies, and administrative controls, respectively.

• All Database Vault policy data will be purged after 6 months from the time of data retrieval.

Set or Update the Credentials Needed for Database Vault Policy Management

You need to provide the credentials of a database user that has the DV_ADMIN role in order for Oracle DBSecCentral to manage Database Vault policies.

1. Log in to Oracle Database Security Central Console as an auditor.

2. Select Policies

3. Select Database Vault Policies from the left navigation menu.

4. Select the target database you want Oracle DBSecCentral to manage Database Vault policies for.

5. Select Provide credentials to manage policies.

6. Provide the username and password of the database user that has the DV_ADMIN role granted.

7. Select Save.

You will need to provide the credentials each session.