JSON REST Collection Plug-in Example

Learn about the JSON REST plug-in mapper file and plug-in manifest file attributes and fields for Oracle Database Security Central.

JSON REST Collection Plug-In Mapper File

See a JSON REST template collector file example, and find out about the attributes and fields used with JSON file collection in Oracle Database Security Central.

There are both mandatory attributes and fields, and fields that are not mandatory, but that can cause your audit records to be treated as invalid.

Mandatory Attributes and Fields for JSON REST Collection Plug-In Mapper Files

• securedTargetType

• maxSecuredTargetVersion

• version

• HeaderInfo

• RecordInfo

• EventTimeUTC

• CommandClass transformations

• EventStatus transformations

• MarkerField

• QueryFormat

• TimeFormat

• NextLinkStartTag

• NextLinkPattern

• RESTAuthentication

• BasicAuth

Standard Fields for JSON REST Collection Plug-In Mapper Files

Source names that map to these Oracle Audit Vault Server fields are not mandatory. However, if the information specified by these fields is not provided, then when data collection starts, all audit records are treated as invalid:

• UserName

• CommandClass

Example 9 Sample JSON REST Collection Plug-in Mapper File

<?xml version="1.0" encoding="UTF-8"?>
<AVJSONCollectorTemplate securedTargetType="JSONSOURCE" maxSecuredTargetVersion="11.0" version="1.0">
   <!--Example Template for JSON template collector-->
   <!-- Attributes: "securedTargetType", "maxSecuredTargetVersion" and
   "version" are mandatory attributes, "minSecuredTargetVersion"
   attribute is optional -->
   <!-- Accepted Format for min/maxSecuredTargetVersion and version
   attribute value is numbers separated by dots (For example:
   12.2,10.3.2, 11.2.3.0 etc..)-->

   <!-- REST url corresponding to the the specific audit trail -->
   <ResourceName>/audit_events/get_events/</ResourceName>
   <!-- Header Information like JSON Header start tag -->
   <HeaderInfo>
      <!-- Mandatory: HeaderInfo-->
      <!-- Value in this tag gives Root tag of the JSON audit file-->
      <StartTag>ITEMS</StartTag>
   </HeaderInfo>
   <!-- Record Information like Record Start tag and conformation to hold
   original record -->
   <RecordInfo>
      <!-- Mandatory: RecordInfo -->
      <!-- Provides starting tag of audit record in JSON audit file -->
      <StartTag>SESSION_ID</StartTag>
   </RecordInfo>
   <!-- Details of the REST Service -->
   <ServiceDetails>
      <!-- Query format for providing the start time and end time query parameters -->
      <QueryFormat>{startTime}/{endTime}</QueryFormat>
	  <!-- Timestamp format for start time and end time -->
      <TimeFormat>yyyy-MM-dd hh:mm:ss.SSS</TimeFormat>
      <NextLink>
	     <!-- Next link start tag -->
         <NextLinkStartTag>next</NextLinkStartTag>
		 <!-- Next link pattern -->
         <NextLinkPattern>$.next.$ref</NextLinkPattern>
      </NextLink>
	  <!-- Authentication mechanism for REST Service -->
      <RESTAuthentication>
	     <!-- Username and password based Basic Authentication -->
         <BasicAuth/>
      </RESTAuthentication>
   </ServiceDetails>
   <!-- Gives Mapping Information of Source Fields to various AV Fields
   (core and large fields) -->
   <!-- Not Allowed: many-to-one mapping from source field to
   AV Server fields -->
   <FieldMappingInfo>
      <!-- Mapping of Source Fields to Core Fields of AV server
      Source fields specified in core field mappings must be of SQL
      Datatype: String OR convertible to String -->
      <CoreFields>
         <Map>
            <Name>$.EVENT_TIME</Name>
            <MapTo>EventTimeUTC</MapTo>
            <TimestampPattern>yyyy-MM-dd HH:mm:ss.SSS</TimestampPattern>
         </Map>
         <Map>
            <!-- If UserName core field mapping is not provided, Audit Data
            Collection still starts successfully, but every audit record
            will be treated as invalid -->
            <Name>$.USER_ID</Name>
            <MapTo>UserName</MapTo>
         </Map>
         <Map>
            <Name>$.OS_USER_ID</Name>
            <MapTo>OSUserName</MapTo>
         </Map>
         <Map>
            <!-- If source name, the ACTION field, for CommandClass
            core field mapping is not provided, Audit Data Collection
            still starts successfully, but all audit records are treated
            as invalid -->
            <Name>$.ACTION</Name>
            <MapTo>CommandClass</MapTo>
            <!-- Mandatory: value transformations from source to Action
            field value. Value of "to" Attribute is from AV Event set -->
            <Transformation>
               <ValueTransformation from="1" to="CREATE" />
               <ValueTransformation from="2" to="INSERT" />
               <ValueTransformation from="3" to="SELECT" />
               <ValueTransformation from="4" to="CREATE" />
               <ValueTransformation from="15" to="READ" />
               <ValueTransformation from="30" to="LOGON" />
               <ValueTransformation from="34" to="LOGOFF" />
               <ValueTransformation from="35" to="ACQUIRE" />
            </Transformation>
         </Map>
         <Map>
            <Name>$.OBJ_NAME</Name>
            <MapTo>TargetObject</MapTo>
         </Map>
         <Map>
            <Name>$.USER_HOST</Name>
            <MapTo>ClientHostName</MapTo>
         </Map>
         <Map>
            <Name>$.OBJ_CREATOR</Name>
            <MapTo>TargetOwner</MapTo>
         </Map>
         <Map>
            <Name>$.STATUS</Name>
            <MapTo>EventStatus</MapTo>
            <!-- Specifying value transformation for Status source field value.
            Mandatory: EventStatus value transformation.
            There are three possible values for EventStatus:
            SUCCESS, FAILURE, UNKNOWN -->
            <Transformation>
               <ValueTransformation from="0" to="FAILURE" />
               <ValueTransformation from="1" to="SUCCESS" />
               <ValueTransformation from="2" to="UNKNOWN" />
            </Transformation>
         </Map>
      </CoreFields>
      <!-- Mapping of Source Fields to Large Fields of AV server i.e fields
      with huge content -->
      <!-- Source fields specified in large field mappings must be of SQL
      Datatype:CLOB OR SQL Datatype:String OR convertible to String -->
      <LargeFields>
         <Map>
            <Name>$.SQL_TEXT</Name>
            <MapTo>CommandText</MapTo>
         </Map>
         <Map>
            <Name>$.COMMAND_PARAMETER</Name>
            <MapTo>CommandParam</MapTo>
         </Map>
      </LargeFields>
      <!-- These Source fields will be collected in a single extension
      field, all name-value pairs are separated by standard delimiter -->
      <!-- Source fields specified in extension field mapping must be of
      SQL Datatype:String OR convertible to String -->
      <ExtensionField>
         <Name>$.DB_ID</Name>
         <Name>$.INSTANCE</Name>
         <Name>$.PROCESS</Name>
         <Name>$.TERMINAL</Name>
      </ExtensionField>
      <!-- This is group of source fields for uniquely identifying each
      Audit Record Marker -->
      <!-- Source fields specified to be used as Marker field mapping must
      be of SQL Datatype:String OR convertible to String -->
      <!-- Mandatory: Source fields for MarkerField -->
      <MarkerField>
         <Name>$.SESSION_ID</Name>
         <Name>$.ENTRY_ID</Name>
      </MarkerField>
   </FieldMappingInfo>
</AVJSONCollectorTemplate>

Related Topics

• Audit Vault Server Fields

JSON REST Collection Plug-In Manifest File

See a JSON REST collection plug-in manifest file example used with JSON file collection in Oracle Database Security Central.

This is a sample manifest file for an JSON REST collection plug-in.

Example 10 Sample Manifest File for a JSON REST Collection Plug-in

<?xml version="1.0" encoding="UTF-8"?>
<plugin xmlns="http://foobar.example.com/av/plugin" xmlns:xsi="http://foobar.example.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.oracle.com/av/plugin plugin-manifest.xsd" name="Oracle-XML-Template" id="com.oracle.av.plugin" version="1.0" provider-name="Oracle Corp." copyright="Copyright Oracle Corp. 2011">
   <!-- targetVersion: Version of Oracle Audit Vault supported by
   this plugin. This is represented by the "min" attribute of
   targetVersion> tag -->
   <targetVersion min="11.1.0.0.0" />
   <extensionSet>
      <extensionPoint type="securedTargetType">
         <!-- fileList: Lists *all* the files that ship with the plugin -->
         <fileList>
            <jars />
            <templates>
               <include file="RESTJSONSource-Mapper.xml" />
            </templates>
            <bin />
            <config />
            <shell />
            <patch />
            <unresolved-external />
         </fileList>
         <!-- securedTargetTypeInfo: Contains source type and trail information-->
         <securedTargetTypeInfo name="json_rest_secured_target" />
         <!-- trailType: contains trail type, location , classname for
         source type testSource -->
         <trailInfo>
            <trailType>REST</trailType>
            <className name="oracle.av.platform.agent.collfwk.ezcollector.json.JSONRESTCollectorFactory" />
         </trailInfo>
         <!-- eventPatch: OPTIONAL field that indicates any event patches
         that need to be applied as part of plugin deployment
         The files listed here must be present in the patch
         tag entries. The order in which the patches need to
         applied can be controlled via the "order" attribute
         Patches with lower "order" value will be applied first -->
         <eventPatch name="p6753288_11.1.2.0.0_GENERIC.zip" order="2" />
      </extensionPoint>
   </extensionSet>
</plugin>