SQL Command Protection Policies

SQL command protection policies are known as command rules in Database Vault.

Learn about Command Rules in the Oracle AI Database Database Vault Administrator’s Guide.

Create SQL Command Protection Policies

SQL command protection policies can be created directly in Oracle DBSecCentral once credentials for Database Vault policy management are provided.

1. Log in to Oracle Database Security Central Console as an auditor.

2. Select Policies.

3. Select Database Vault Policies from the left navigation menu.

4. Select the target database you want Oracle DBSecCentral to manage Database Vault policies for.

5. Provide user credentials following the steps in Set or Update the Credentials Needed for Database Vault Policy Management.

6. Expand the SQL command protection section.

7. Select Create.

8. Provide the details for SQL commands to restrict, schemas to be protected, conditions under which the SQL commands can be executed, audit policy rules.

9. Select Create.

Modify SQL Command Protection Policies

SQL command protection policies that were created in Oracle DBSecCentral can be modified once credentials for Database Vault policy management are provided. You can only modify SQL command protection policies created in Oracle DBSecCentral and not command rules created directly on the target database.

1. Log in to Oracle Database Security Central Console as an auditor.

2. Select Policies.

3. Select Database Vault Policies from the left navigation menu.

4. Select the target database you want Oracle DBSecCentral to manage Database Vault policies for.

5. Provide user credentials following the steps in Set or Update the Credentials Needed for Database Vault Policy Management.

6. Expand the SQL command protection section.

7. Select the SQL command protection policy you want to edit.

8. Provide the details for SQL commands to restrict, schemas to be protected, conditions under which the SQL commands can be run, and audit policy details.

9. Select Save.

Enable, Enable in Simulation Mode, Disable, or Delete SQL Command Protection Policies

Enabling, enabling in simulation mode, disabling, or deleting SQL command protection policies, Database Vault command rules, in Oracle DBSecCentral follow a similar workflow.

Note:

• You can only delete the SQL command protection policies that are in a disabled state.
• Oracle defined SQL Command Protection Policies cannot be deleted from Oracle DBSecCentral.
• SQL Command Protection Policies that are associated with rule sets, which contain Oracle defined rules cannot be deleted from Oracle DBSecCentral.

1. Log in to Oracle Database Security Central Console as an auditor.

2. Select Policies.

3. Select Database Vault Policies from the left navigation menu.

4. Select the target database you want Oracle DBSecCentral to manage Database Vault policies for.

5. Provide user credentials following the steps in Set or Update the Credentials Needed for Database Vault Policy Management.

6. Expand the SQL command protection section.

7. Select the SQL command protection policy you want to manage.

8. Select the action you want to perform.

Related Topics

• Using Simulation Mode to Log Realm and Command Rule Errors