Session Context Rule

Learn about the Session Context rule.

A session from a SQL client program trying to connect to the target database, contains information like Host IP address, Database user name, operating system user name and client program name. These are referred as session context attributes. Session Context rule is applied on the session context attributes. For example, allowing SQL statements from a trusted allow list client IP address range. It also allows to block SQL statements originating outside the expected IP address range.

The following sets are used when creating the Session Context rule:

1. IP Address Set

2. DB User Set

3. OS User Set

4. Client Program Set

Note: All session context rules irrespective of the action, that is, block, alert, or pass, are evaluated during the login and logout events.

To create a session context rule:

1. Log in to the Oracle Database Security Central console as an auditor.

2. Select Policies.

3. Select Database Firewall Policies in the left navigation menu.

4. Select the name of an existing custom policy, or select Create to create a new one.

   Note: Though the page displays both User-defined Database Firewall Policies and Oracle Pre-defined Database Firewall Policies, only User-defined Database Firewall Policies can be created.

5. In the Database Firewall Policy Rules section, expand the Session Context section.

6. Select Add. The Session Context dialog is displayed.

7. Enter a Rule Name and optionally Description.

8. For the following fields listed under Ruleset section:

   1. IP Address Set: Select to include or exclude, and then select an IP address set from the list.

   2. DB User Set: Select to include or exclude, and then select a database user set.

   3. OS User Set: Select to include or exclude, and then select an OS user set.

   4. Client Program Sets: Select to include or exclude, and then select a SQL client program.

   Note:

   • There is no limit on the number of items that can be included in these sets.

   • You can use * (asterisk) as a wildcard for all the sets except IP Address Set.

   • There is an option in all the sets to make it case sensitive or otherwise. This can be done by selecting or deselecting the checkbox in the global policy configuration, and selecting Policy Pattern, and then Case sensitive match.

   • For example, if you select to include an IP Address Set, and exclude a DB User Set, then this Session Context rule will only apply to SQL traffic from the selected IP Address Set. However, it does not apply to the SQL traffic from the database users in the selected DB User Set.

9. Select the appropriate options available in the following fields under Action section:

   1. Action

   2. Logging Level

   3. Threat Severity

   4. Optionally select Set threshold for escalating action if you want to apply a different escalation action after a threshold. Enter the following:

      1. Threshold: Enter the number of times SQL match must exceed before the escalation action is taken.

      2. Threshold Time (in seconds)

      3. Threshold Action: Select Alert or Block as the action taken after the threshold is met.

      4. Substitution SQL: (Optional) If you selected Block for the Threshold Action, enter a statement to substitute for the SQL statement matching this rule.

10. Select Save.