CSV File Collection Plug-in Example

Learn about the CSV plug-in mapper file and plug-in manifest file attributes and fields for Oracle Database Security Central.

CSV File Collection Plug-In Mapper File

See a CSV template collector file example, and find out about the attributes and fields used with CSV file collection in Oracle Database Security Central.

There are both mandatory attributes and fields, and fields that are not mandatory, but that can cause your audit records to be treated as invalid.

Mandatory Attributes and Fields for CSV File Collection Plug-In Mapper Files

securedTargetType
maxSecuredTargetVersion
version
HeaderInfo
RecordInfo
EventTimeUTC
CommandClass transformations
EventStatus transformations
MarkerField

Standard Fields for CSV File Collection Plug-In Mapper Files

Source names that map to these Oracle Audit Vault Server fields are not mandatory. However, if the information specified by these fields is not provided, then when data collection starts, all audit records are treated as invalid:

UserName
CommandClass

Example 7 Sample CSV File Collection Plug-in Mapper File

<?xml version="1.0" encoding="UTF-8"?>
<AVCSVCollectorTemplate securedTargetType="csv_file_secured_target" maxSecuredTargetVersion="11.0" version="1.0">
   <!--Example Template for CSV template collector-->
   <!-- Attributes: "securedTargetType", "maxSecuredTargetVersion" and
   "version" are mandatory attributes, "minSecuredTargetVersion"
   attribute is optional -->
   <!-- Accepted Format for min/maxSecuredTargetVersion and version
   attribute value is numbers separated by dots (For example:
   12.2,10.3.2, 11.2.3.0 etc..)-->
   <!-- Header Information like CSV Header start tag -->
   <HeaderInfo>
      <!-- Mandatory: HeaderInfo-->
      <!-- Hardcoded to CSV -->
      <StartTag>CSV</StartTag>
   </HeaderInfo>
   <!-- Record Information like Record Start tag and conformation to hold
   original record -->
   <RecordInfo>
      <!-- Mandatory: RecordInfo -->
      <!-- Hardcoded to CSV -->
      <StartTag>CSV</StartTag>
   </RecordInfo>
   <!-- Gives Mapping Information of Source Fields to various AV Fields
   (core and large fields) -->
   <!-- Not Allowed: many-to-one mapping from source field to
   AV Server fields -->
   <FieldMappingInfo>
      <!-- Mapping of Source Fields to Core Fields of AV server
      Source fields specified in core field mappings must be
      either string OR convertible to string -->

	  <!-- CSV files have "COMMA" as field delimiter -->
	  <!-- The first field has index 0, second field has index 1 and so on -->

      <CoreFields>
	     <!-- In our CSV sample data, EVENT_TIME field has index 2 -->
	     <!-- Hence 2 is used in below EventTimeUTC mapping -->
         <Map>
            <Name>2</Name>
            <MapTo>EventTimeUTC</MapTo>
            <TimestampPattern>yyyy-MM-dd'T'HH:mm:ss.SSSZ</TimestampPattern>
         </Map>
         <Map>
            <!-- If UserName core field mapping is not provided, Audit Data
            Collection still starts successfully, but every audit record
            will be treated as invalid -->
            <Name>5</Name>
            <MapTo>UserName</MapTo>
         </Map>

         <Map>
            <!-- If source name, the ACTION field, for CommandClass
            core field mapping is not provided, Audit Data Collection
            still starts successfully, but all audit records are treated
            as invalid -->
            <Name>1</Name>
            <MapTo>CommandClass</MapTo>
            <!-- Mandatory: value transformations from source to Action
            field value. Value of "to" Attribute is from AV Event set -->
            <Transformation>
               <ValueTransformation from="createUser" to="CREATE" />
               <ValueTransformation from="createCollection" to="CREATE" />
               <ValueTransformation from="authenticate" to="AUTHENTICATE" />
               <ValueTransformation from="dropCollection" to="DROP" />
               <ValueTransformation from="dropUser" to="DROP" />
            </Transformation>
         </Map>
         <Map>
            <Name>1</Name>
            <MapTo>TargetObject</MapTo>
            <Transformation>
               <FieldTransformation from="createUser" to="6" />
               <FieldTransformation from="createCollection" to="6" />
               <FieldTransformation from="authenticate" to="6" />
               <FieldTransformation from="dropCollection" to="6" />
               <FieldTransformation from="dropUser" to="6" />
            </Transformation>
         </Map>
		 <Map>
            <Name>1</Name>
            <MapTo>TargetType</MapTo>
            <Transformation>
               <ValueTransformation from="createUser" to="USER" />
               <ValueTransformation from="createCollection" to="COLLECTION" />
               <ValueTransformation from="authenticate" to="USER" />
               <ValueTransformation from="dropCollection" to="COLLECTION" />
               <ValueTransformation from="dropUser" to="USER" />
            </Transformation>
         </Map>
         <Map>
            <Name>3</Name>
            <MapTo>ClientIP</MapTo>
         </Map>

         <Map>
            <Name>7</Name>
            <MapTo>EventStatus</MapTo>
            <!-- Specifying value transformation for Status source field value.
            Mandatory: EventStatus value transformation.
            There are three possible values for EventStatus:
            SUCCESS, FAILURE, UNKNOWN -->
            <Transformation>
               <ValueTransformation from="0" to="FAILURE" />
               <ValueTransformation from="100" to="SUCCESS" />
               <ValueTransformation from="200" to="UNKNOWN" />
            </Transformation>
         </Map>
      </CoreFields>
      <!-- Mapping of Source Fields to Large Fields of AV server i.e fields
      with huge content -->
      <!-- Source fields specified in large field mappings must be of SQL
      Datatype:CLOB OR SQL Datatype:String OR convertible to String -->
      <LargeFields>
         <Map>
            <Name>11</Name>
            <MapTo>CommandText</MapTo>
         </Map>
         <Map>
            <Name>12</Name>
            <MapTo>CommandParam</MapTo>
         </Map>
      </LargeFields>
      <!-- These Source fields will be collected in a single extension
      field, all name-value pairs are separated by standard delimiter -->
      <!-- Source fields specified in extension field mapping must be of
      SQL Datatype:String OR convertible to String -->
      <ExtensionField>
         <ComplexName>
            <Name>10</Name>
            <DisplayName>sessionid</DisplayName>
         </ComplexName>
         <ComplexName>
            <Name>13</Name>
            <DisplayName>entryid</DisplayName>
         </ComplexName>
      </ExtensionField>
      <!-- This is group of source fields for uniquely identifying each
      Audit Record Marker -->
      <!-- Source fields specified to be used as Marker field mapping must
      be of SQL Datatype:String OR convertible to String -->
      <!-- Mandatory: Source fields for MarkerField -->
      <MarkerField>
         <Name>10</Name>
         <Name>13</Name>
      </MarkerField>
   </FieldMappingInfo>
</AVCSVCollectorTemplate>

Related Topics

Audit Vault Server Fields

CSV File Collection Plug-In Manifest File

See a CSV file collection plug-in manifest file example used with CSV file collection in Oracle Database Security Central.

This is a sample manifest file for an CSV file collection plug-in.

Example 8 Sample Manifest File for a CSV File Collection Plug-in

<?xml version="1.0" encoding="UTF-8"?>
<plugin xmlns="http://xmlns.oracle.com/av/plugin" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.oracle.com/av/plugin plugin-manifest.xsd" name="Oracle-XML-Template" id="com.oracle.av.plugin" version="1.0" provider-name="Oracle Corp." copyright="Copyright Oracle Corp. 2011">
   <!-- targetVersion: Version of Oracle Audit Vault supported by
   this plugin. This is represented by the "min" attribute of
   targetVersion> tag -->
   <targetVersion min="20.4.0.0.0" />
   <extensionSet>
      <extensionPoint type="securedTargetType">
         <!-- fileList: Lists *all* the files that ship with the plugin -->
         <fileList>
            <jars />
            <templates>
               <include file="CSVSource-Mapper.xml" />
            </templates>
            <bin />
            <config />
            <shell />
            <patch />
            <unresolved-external />
         </fileList>
         <!-- securedTargetTypeInfo: Contains source type and trail information-->
         <securedTargetTypeInfo name="csv_file_secured_target" />
         <!-- trailType: contains trail type, location , classname for
         source type testSource -->
         <trailInfo>
            <trailType>DIRECTORY</trailType>
            <className name="oracle.av.platform.agent.collfwk.ezcollector.csv.GenericCSVFileCollectorFactory" />
         </trailInfo>
      </extensionPoint>
   </extensionSet>
</plugin>