Provisioning Traditional Audit Settings

Traditional audit settings are used to monitor SQL statements, schema objects, privileges, and fine-grained auditing.

Note: Traditional auditing is desupported in Oracle AI Database 26ai. Oracle recommends that you use unified auditing. The traditional auditing tab is not visible in the Oracle Database Security Central console for Oracle AI Database 26ai databases.

Related Topics

Provisioning Unified Audit Policies

About Creating Audit Policy Settings

After you retrieve audit policies you can go the target database, select the settings you need from the existing policies, and create new policies if needed.

Caution:

Any audit setting that is not indicated as Needed in the Oracle Database Security Central console will be turned off on the target. See “Specifying which Audit Policies are Needed”.
After you have updated and/or created the audit policies for a target Oracle Database, you can provision the audit policy changes to that database.

Specifying which Audit Policies are Needed

After you retrieve the audit policies from the target Oracle Database, you can view and modify them as needed.

Remember that you are modifying audit policies in use at the time you retrieved them. If you think they may have changed, you should retrieve them again.

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
In the left navigation, select Audit Policies.
Select the database you want to manage audit policies for.
Expand the Traditional audit settings section.

The section displays the audit policies in use and marked as needed for the audit types:
- Statement
- Object
- Privilege
Select the link of the specific audit type to update the settings. For example, Object.

The Object audit policies for the specific target are displayed on the page. These are the current audit policies. The second column displays a problem icon if there is a difference between the setting at the target database, and the setting in Oracle Database Security Central.
Select the check boxes for each audit setting you determine is needed, then select Set as Needed.
To remove audit policies, select the check boxes for the ones you want to remove, then select Set as Not Needed.
To create new audit policies for the audit type, select Create.

Creating Audit Policies for SQL Statements

Auditors can create and manage audit policies for SQL statements.

About SQL Statement Auditing

Statement auditing audits SQL statements by type of statement, not by the specific schema objects on which the statement operates.

Statement auditing can be broad or focused (for example, by auditing the activities of all database users or only a select list of users). Typically broad statement auditing audits the use of several types of related actions for each option. These statements are in the following categories:

Data definition statements (DDL). For example, AUDIT TABLE audits all CREATE TABLE and DROP TABLE statements. AUDIT TABLE tracks several DDL statements regardless of the table on which they are issued. You can also set statement auditing to audit selected users or every user in the database.
Data manipulation statements (DML). For example, AUDIT SELECT TABLE audits all SELECT ... FROM TABLE or SELECT ... FROM VIEW statements, regardless of the table or view.

Defining SQL Statement Audit Settings

Any auditor can define a SQL statement audit policy.

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
Select the database you want to manage audit policies for.
Expand the Traditional audit policies section.
Select Statement in the column Audit Type.

The statement audit settings of the specific target is displayed.
Select Create.
In this page, define the audit policy as follows:
- Audit Actions By - Choose the users to audit:
  - Both: Audits all users, including proxy users.
  - Proxy: Audits the proxy user for the database. When you select this option, the Proxy User field appears, in which you must specify at least one user.
  - User: Audits the user to which this setting applies. If you select this option, you must select a user from the Users drop-down list.
- Execution Condition - Choose one of the following:
  - Both: Audits both successful and failed statements
  - On Success: Audits the statement if it is successful
  - On Failure: Audits the statement if it fails
- DML Audit Granularity - Choose audit granularity for DML statements:
  - Access: Creates an audit record each time the operation occurs
  - Session: Creates an audit record the first time an operation occurs in the current session
  DDL statements are always audited by access.
- Statements Audit Type - Select the SQL statements to audit by double clicking a statement type to move it to the box on the right. You can use the double arrows to move all statements to the right or back to the left.
Select Save.

The new audit settings are added to the statement audit settings page.

Understanding the Statement Audit Settings

The Statement Audit Settings page shows status information such as whether the statement is audited or if the statement audit policy is active. Table 1 lists the columns used in the Statement page.

Table 1 Columns in the Statement Audit

Column	Description
(Left most column)	A checkbox for selecting the audit setting.
(Problem icon)	An exclamation mark icon indicates one of the following conditions: The setting is marked as needed in Oracle Database Security Central, but is not in use in the target database. The setting is in use at the target database, but is not marked as needed in Oracle Database Security Central.
Setting	The statement that is audited.
In Use	A green check mark indicates if the setting is active in the target database. A red cross mark indicates if it has not been provisioned or is not active.
Needed	A green check mark indicates if the audit setting is marked as needed in Oracle Database Security Central. A red cross mark indicates if the audit setting is marked as not needed. If an audit setting that is not in use is set to needed, a green check mark appears after provisioning in the In Use column. If an audit setting that is in use is set to not needed, the audit setting is no longer displayed after provisioning.
Audit granularity	The granularity of auditing: `ACCESS` or `SESSION`
Execution Condition	The execution condition audited: `SUCCESS`, `FAILURE`, or `BOTH`
Proxy User	The proxy user for the database, if any.
User	The user to which this setting applies, if any.

Creating Audit Policies for Schema Objects

Auditors can create and manage schema object audit policies.

About Schema Object Auditing

Schema object auditing is the auditing of specific statements on a particular schema object, such as AUDIT SELECT ON HR.EMPLOYEES.

Schema object auditing is very focused, auditing only a specific statement on a specific schema object for all users of the database.

For example, object auditing can audit all SELECT and DML statements permitted by object privileges, such as SELECT or DELETE statements on a given table. The GRANT and REVOKE statements that control those privileges are also audited.

Object auditing lets you audit the use of powerful database commands that enable users to view or delete very sensitive and private data. You can audit statements that reference tables, views, sequences, standalone stored procedures or functions, and packages.

Oracle Database sets schema object audit options for all users of the database. You cannot set these options for a specific list of users.

Defining Schema Object Audit Settings

Any auditor can define a schema object audit policy.

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
Select the database you want to manage audit policies for.
Expand the Traditional audit policies section.
Select Object in the column Audit type.

The object audit settings of the specific target is displayed.
Select Create.
In the Object Audit Settings page, define the settings as follows:
- Object Type - Select the type of object to audit from the drop-down list, such as TABLE, LOB, RULE, or VIEW.
- Object - Select a specific object of the object type you selected.
- Execution Condition - Choose one of the following:
  - Both: Audits both successful and failed statements
  - On Success: Audits the statement if it is successful
  - On Failure: Audits the statement if it fails
- DML Audit Granularity - Choose audit granularity for DML statements:
  - Access: Creates an audit record each time the operation occurs
  - Session: Creates an audit record the first time an operation occurs in the current session
  DDL statements are always audited by access.
- Statements Audit Type - Select the SQL statements to audit by double clicking a statement type to move it to the box on the right. You can use the double arrows to move all statements to the right or back to the left.
Select Save.

The newly defined object audit settings is added to the Object Audit Settings page.

Understanding the Object Audit Settings Page

The Object Audit Settings page shows object status information such as the object that is being audited and whether the policy is active. Table 2 lists the columns used in the Object page.

Table 2 Columns in the Object Audit Settings Page

Column	Description
(Leftmost column)	A checkbox for selecting the audit setting
Problem icon	An exclamation mark icon indicates one of the following conditions: The setting is marked as needed in Oracle Database Security Central, but is not in use in the target database. The setting is in use at the target database, but is not marked as needed in Oracle Database Security Central.
Setting	The statement that is audited
In Use	The arrow points upward if the setting is active in the target database, and downward if it has not been provisioned or is not active.
Needed	The arrow points upward if the audit setting is marked as needed in Oracle Database Security Central, and downward if the audit setting is marked as not needed. If an audit setting that is not in use is set to needed, the In Use arrow points up after provisioning. If an audit setting that is in use is set to not needed, the audit setting is no longer displayed after provisioning.
Name	The name of the object in the specified schema.
Type	The object (such as a database table) to which this setting applies
Owner Name	The database schema to which this setting applies
Audit Granularity	The granularity of auditing: `ACCESS` or `SESSION`
Execution Condition	The execution condition audited: `SUCCESS`, `FAILURE`, or `BOTH`

Creating Audit Policies for Privileges

Auditors can create and manage privilege audit policies.

About Privilege Auditing

Privilege auditing is the auditing of SQL statements that use a system privilege.

You can audit the use of any system privilege. Like statement auditing, privilege auditing can audit the activities of all database users or only a specified list of users.

For example, if you enable AUDIT SELECT ANY TABLE, Oracle Database audits all SELECT tablename statements issued by users who have the SELECT ANY TABLE privilege. This type of auditing is very important for the Sarbanes-Oxley (SOX) Act compliance requirements. Sarbanes-Oxley and other compliance regulations require the privileged user be audited for inappropriate data changes or fraudulent changes to records.

Privilege auditing audits the use of powerful system privileges enabling corresponding actions, such as AUDIT CREATE TABLE. If you set both similar statement and privilege audit options, then only a single audit record is generated. For example, if the statement clause TABLE and the system privilege CREATE TABLE are both audited, then only a single audit record is generated each time a table is created. The statement auditing clause, TABLE, audits CREATE TABLE, ALTER TABLE, and DROP TABLE statements. However, the privilege auditing option, CREATE TABLE, audits only CREATE TABLE statements, because only the CREATE TABLE statement requires the CREATE TABLE privilege.

Privilege auditing does not occur if the action is already permitted by the existing owner and schema object privileges. Privilege auditing is triggered only if these privileges are insufficient, that is, only if what makes the action possible is a system privilege.

Privilege auditing is more focused than statement auditing for the following reasons:

It audits only a specific type of SQL statement, not a related list of statements.
It audits only the use of the target privilege.

Defining Privilege Audit Settings

Any auditor can define a privilege audit policy.

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
Select the database you want to manage audit policies for.
Expand the Traditional audit policies section.
Select Privilege in the column Audit Type.

The privilege audit settings of the specific target is displayed.
Select Create .
In the Create Privilege Audit Settings page, define the privilege audit policy as follows:
- Audited By - Choose the users to audit:
  - Both: Audits all users, including proxy users.
  - Proxy: Audits the proxy user for the database. When you select this option, the Proxy Users field appears, in which you must specify at least one user. To display a list of proxy users and their targets for selection, select up-arrow icon on the right of the field.
  - User: Audits the user to which this setting applies. When you select this option, the Users field appears, and you must specify a user from the drop-down list.
- Execution Condition - Choose one of the following:
  - Both: Audits both successful and failed privilege use
  - On Success: Audits the privilege use if it is successful
  - On Failure: Audits the privilege use if it fails
- DML Audit Granularity - Choose audit granularity for DML statements:
  - Access: Creates an audit record each time the operation occurs
  - Session: Creates an audit record the first time an operation occurs in the current session
  DDL statements are always audited by access.
- Statements Audit Type - Select the privileges to audit by double clicking a statement type to move it to the box on the right.
  
  You can use the double arrows to move all statements to the right or back to the left.
Select Save.

The newly defined privilege audit settings is added to the list in the Privilege Audit Settings page.

Understanding the Privilege Audit Settings Page

The Privilege Audit Settings page shows status information such as the privileges being audited and whether an audit policy is active. Table 3 lists the columns used in the Privilege Audit Settings page.

Table 3 Columns in the Privilege Audit Settings Page

Column	Description
(Leftmost column)	A checkbox for selecting the audit setting
Problem icon	An exclamation mark icon indicates one of the following conditions: The setting is marked as needed in Oracle Database Security Central, but is not in use in the target database. The setting is in use at the target database, but is not marked as needed in Oracle Database Security Central.
Setting	The statement that is audited
In Use	The arrow points upward if the setting is active in the target database, and downward if it has not been provisioned or is not active.
Needed	The arrow points upward if the audit setting is marked as needed in Oracle Database Security Central, and downward if the audit setting is marked as not needed. If an audit setting that is not in use is set to needed, the In Use arrow points up after provisioning. If an audit setting that is in use is set to not needed, the audit setting is no longer displayed after provisioning.
Audit granularity	The granularity of auditing: `BY ACCESS` or `BY SESSION`
Execution Condition	The execution condition audited: `SUCCESS`, `FAILURE`, or `BOTH`
User	The user to which this setting applies, if any
Proxy User	The proxy user for the database, if any

Exporting Audit Settings to a SQL Script

You can export audit policy settings for a target to a SQL script from Oracle Database Security Central.

Then you can give the script to a database administrator for the target Oracle Database to use to update the audit settings on that database.

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
In the left navigation, select Audit Policies.
Select the database you want to manage audit policies for.
Expand the Traditional audit policies section.
Select one or more check boxes for the audit types that you want to export: Statement, Object, or Privilege.
Select Export/Provision.

The Export/Provision Audit Settings page appears. It displays the exportable audit commands.
Select Export, then Export.
Select OK to confirm.
Save the SQL file to a location on your system.
Give the saved script to the database administrator for that target.

The database administrator can then apply the policies to the target. To verify that the settings have been updated, you can retrieve the audit settings.

Related Topics

Provisioning Traditional Audit Policies from the Audit Vault Server

You can provision the traditional audit policy settings directly from the Audit Vault Server to the target Oracle Database.

This updates the audit policies in the target without the intervention of a database administrator. However, a database administrator can modify or delete these audit policies, as well as add new ones. For this reason, you should periodically retrieve the settings to ensure that you have the latest audit policies.

Log in to Oracle Database Security Central Console as an auditor.
Select Policies.
In the left navigation, select Audit Policies.
Select the database you want to manage audit policies for.
Expand the Traditional audit policies section.
Select one or more check boxes for the audit types that you want to provision: Statement, Object, or Privilege.
Select Provision.

The Export/Provision Audit Settings page appears. It displays the exportable audit commands, and allowing you to verify them before provisioning. The audit settings can be either exported to a file or provisioned directly to the target.
Select Provision.
Ensure the target user has sufficient privileges granted for audit policy management using the privilege script.

Note: Ensure the target user has sufficient privileges granted for audit policy management. This can be accomplished by running Oracle Database Setup Scripts.
Select Provision.
Select OK to confirm.
To check the provisioning status, select Settings, Jobs. When the job is submitted successfully, the Audit Settings job is displayed on the page under Job Type column.