SQL Statement Rule

Learn about the SQL Statement rule.

Database Firewall extracts and analyzes SQL statements from network traffic. It groups similar SQL statements into clusters. Such clusters can be further grouped to form cluster sets. SQL Statement rule is used to configure actions that the Database Firewall must take on a SQL statement belonging to cluster sets.

Allow list (white list) or deny list based policies can be created using this rule. The allow list of SQL clusters can be created by sending known or expected SQL statements from trusted applications over a period of time. Include allow list of SQL cluster sets and configure to allow SQL statements with clusters belonging to the allow list, when creating the SQL Statement rule.

Make use of profiles to create a deny list based policy. For example, create cluster sets for sensitive data, and then create a profile of database administrators (DBA). Configure a rule to block SQL statements from DBA profile users with clusters matching the created cluster set. In this case the rule works as deny list.

To create a SQL Statement rule:

1. Log in to the Oracle Database Security Central console as an auditor.

2. Select Policies.

3. Select Database Firewall Policies in the left navigation menu.

4. Select the name of an existing policy or select Create to create a new one.

5. Expand the SQL Statement section.

6. Select Add.

7. In the SQL Statement dialog, enter a Rule Name.

8. Optionally enter the Description.

9. Select the Profile from the list.

10. In the Cluster Set(s) field, select the cluster in the Available column and move to the Selected column. Refer to the section on how to create cluster sets. Create a cluster set prior to creating a policy rule for SQL Statement.

11. In the Action section, enter the details for Action, Logging Level, and Threat Severity fields to apply to SQL statements of this cluster type.

12. Optionally select the checkbox for Set threshold for escalating action field, if an action is required on the SQL statement that matches this cluster threshold times. Upon selecting this checkbox, enter the following:

    1. Threshold: Enter the number of times a SQL statement must match this cluster before the escalation action is taken.

    2. Threshold Time (in seconds): Enter the time in seconds.

    3. Threshold Action: Select Alert or Block as the action taken after the threshold is met.

    4. Substitution SQL: If you selected Block for the Threshold Action, then enter a statement to substitute for the SQL matching this rule.

13. Select Save.