Audit Vault Server Events and their Attributes

Oracle DBSecCentral monitors the stream of events that occur in target systems.

About Audit Vault Server Events and Attributes

Learn about Audit Vault Server events, fields, and audit records.

Monitoring the activity, the stream of events, that occur in a target system is the essence of Oracle Database Security Central. These events are described by fields. A collection of fields describing a single event that occurred on the target system is an audit record.

The following applies for Oracle Database Security Central:

• Each target logs events as audit events that occur on that target. Audit records capture information about audit events.

• Audit records typically have a target type event name that describes what happened to what type of object. They also contain the target of the action that happened. In addition, they must contain a time when the action occurred, the subject, or actor, who caused the action to happen, and may also contain additional data.

  Audit Vault Server organizes the fields of an audit record into these groups: core fields, extension fields, large fields, and marker fields.

Understanding Core Fields

Learn what core fields are, and what their purpose is with Oracle Database Security Central actions.

Core fields are the fundamental fields that describe an event, and most audit records contain some or all of these fields. However, not all core fields are required in every audit record.

Starting with Oracle Database Security Central release 12.1.1, the core fields which describe the actions occurred are:

• CommandClass field: The action that caused the audit record to be generated.

• UserName and OsUserName fields: The subject or user who performed the action.

• EventTime field: When, what time, the action occurred.

• ClientHostName, ClientIp, and other related fields: Where, what location, of the action.

• TargetType, TargetOwner, and TargetObject fields: The object type, object owner, or target of the action.

See Also: Core Fields for a complete list of core fields.

CommandClass and Target Types

Learn about the core fields CommandClass and TargetType in Oracle Database Security Central.

The CommandClass and TargetType fields have well-known values, which cover a set of general-purpose events that occur in targets belonging to various domains, such as databases or operating systems.

Some examples of the CommandClass values are Logon, Select, Update, and Shutdown.

Related Topics

• Audit Vault Server Fields

• Actions and Target Types

Other Oracle Audit Vault Fields

In addition to core fields, Oracle Audit Vault Server can interpret Large Fields, Marker fields, and Extension Fields.

About Large Fields

In Oracle Database Security Central, large fields are fields that contain arbitrarily large amount of data.

Large fields are fields that contain arbitrarily large amount of data.

Related Topics

• Large Fields

About Extension Field

In Oracle Database Security Central, Extension fields provide a way to make target fields that do not have a semantically equivalent Oracle Audit Vault field, and do not map to Core or Large fields.

As a developer, you can determine the format used to store extension fields.

Related Topics

• Extension Field

About Marker Fields

In Oracle Database Security Central, Marker fields provide unique identifiers of a record in an audit trail.

A marker field is constructed out of one or more fields in an audit record.

Related Topics

• Marker Field

Storing Audit Records in Audit Vault

When you develop plug-ins for Oracle Database Security Central, Oracle recommends that you follow Oracle guidelines for storing audit records.

As a plug-in developer, you must map the various events that occur within targets, and their fields, to the various fields allowed by Oracle Audit Vault. If a field in the audit record maps to one of the named fields (core, large, or marker fields) in Audit Vault, then you should map it as such.If a field in the audit record does not map to one of the named fields, then you can map it to an extension field of your choosing.

For the Action and TargetType Oracle Audit Vault Server fields, see the list of field values. If your audit record maps to one of these values semantically, then Oracle strongly encourages you to use that value. However, you are free to use other values than the Oracle Audit Vault Server fields.

Oracle strongly encourages you to follow these basic guidelines when you store values in Oracle Audit Vault:

• Do not store IDs that reference objects in the target database. Oracle Audit Vault does not have access to these objects. Consequently, values that refer to objects in the target database are meaningless. Instead, store literal names of objects, so that they can be understood by the auditors.

• Follow defined Audit Vault conventions. For example, all the ACTION fields and TARGET TYPE fields in Oracle Audit Vault have uppercase values. \Oracle recommends that you follow this convention, unless this convention is not applicable to your target type, and would cause the data stored in Oracle Audit Vault to be interpreted incorrectly.

• Map to the values if possible. For example, if TABLE exists in the list as a TargetType, do not add an audit record with the TargetType of DATABASE TABLE.

Finally, if you think a field in the audit record of a target merits becoming a core field, then Oracle recommends that you contact Oracle, so that this field can be reviewed and added to the model appropriately.

Related Topics

• Actions and Target Types