Schema For EZCollector Plug-in Mapper File

See how to set up a schema for an EZCollector plug-in mapper file for Oracle Database Security Central.

In the following example, you can see how to set up a schema:

Example 10 EZCollector Plug-in Mapper File

<?xml version="1.0"?>

<!--
 Copyright (c) 2013, 2019, Oracle and/or its affiliates. All rights reserved.
-->

<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<!--Existing Set of Core Fields-->
<xsd:simpleType name="CoreFieldValues">
	<xsd:restriction base="xsd:string">
	<xsd:enumeration value="EventTimeUTC"/>
	<xsd:enumeration value="UserName"/>
	<xsd:enumeration value="OSUserName"/>
	<xsd:enumeration value="CommandClass"/>
	<xsd:enumeration value="TargetObject"/>
	<xsd:enumeration value="ClientHostName"/>
	<xsd:enumeration value="ClientIP"/>
	<xsd:enumeration value="ClientProgramName"/>
	<xsd:enumeration value="TargetOwner"/>
	<xsd:enumeration value="ErrorId"/>
	<xsd:enumeration value="ErrorMessage"/>
	<xsd:enumeration value="EventStatus"/>
	<xsd:enumeration value="EventName"/>
	<xsd:enumeration value="TargetType"/>
	<xsd:enumeration value="TerminalName"/>
	<xsd:enumeration value="ClientId"/>
	</xsd:restriction>
</xsd:simpleType>

<!--Existing Set of Large Fields-->
<xsd:simpleType name="LargeFieldValues">
	<xsd:restriction base="xsd:string">
		<xsd:enumeration value="CommandText"/>
		<xsd:enumeration value="CommandParam"/>
	</xsd:restriction>
</xsd:simpleType>

<!-- Field ValueTransformation Type-->
<xsd:complexType name="ValueTransformationType">
	<xsd:attribute name="from" type="xsd:string" use="required"/>
	<xsd:attribute name="to" type="xsd:string" use="required"/>
</xsd:complexType>

<!-- Field FieldTransformation Type-->
<xsd:complexType name="FieldTransformationType">
	<xsd:attribute name="from" type="xsd:string" use="required"/>
	<xsd:attribute name="to" type="xsd:string" use="required"/>
</xsd:complexType>

<!-- Field Transformation Type-->
<xsd:complexType name="TransformationType">
	<xsd:sequence>
		<xsd:element name="ValueTransformation" type="ValueTransformationType" minOccurs="0" maxOccurs="2000" />
		<xsd:element name="FieldTransformation" type="FieldTransformationType" minOccurs="0" maxOccurs ="2000" />
	</xsd:sequence>
</xsd:complexType>

<!--FieldMappingInfo-->
<xsd:complexType name="FieldMappingInfoType">
	<xsd:all>
		<!-- Core Field Mapping-->
		<xsd:element name="CoreFields" minOccurs="1" maxOccurs="1">
			<xsd:complexType>
				<xsd:sequence>
					<xsd:element name="Map" minOccurs="1" maxOccurs ="14">
						<xsd:complexType>
							<xsd:all>
								<xsd:element name="Name" type="xsd:string" />
								<xsd:element name="MapTo" type="CoreFieldValues" />
								<xsd:element name="TimestampPattern" type="xsd:string" minOccurs="0" maxOccurs="1" />
								<xsd:element name="Transformation" type="TransformationType" minOccurs="0" maxOccurs="1" />
							</xsd:all>
						</xsd:complexType>
					</xsd:element>
				</xsd:sequence>
			</xsd:complexType>
		</xsd:element>
		<!-- Large Field Mapping -->
		<xsd:element name="LargeFields" minOccurs="0" maxOccurs="1">
			<xsd:complexType>
				<xsd:sequence>
					<xsd:element name="Map" minOccurs="0" maxOccurs="2">
						<xsd:complexType>
							<xsd:all>
								<xsd:element name="Name" type="xsd:string" />
								<xsd:element name="MapTo" type="LargeFieldValues" />
								<xsd:element name="Transformation" type="TransformationType" minOccurs="0" maxOccurs="1" />
							</xsd:all>
						</xsd:complexType>
					</xsd:element>
				</xsd:sequence>
			</xsd:complexType>
		</xsd:element>
		<!-- List of fields to be mapped to extensible fields-->
		<xsd:element name="ExtensionField" minOccurs="0" maxOccurs="1">
			<xsd:complexType>
				<xsd:sequence>
					<xsd:element name="Name" type="xsd:string" minOccurs="0" maxOccurs ="500" />
					<xsd:element name="ComplexName" minOccurs="0" maxOccurs ="500" >
						<xsd:complexType>
							<xsd:all>
								<xsd:element name="Name" type="xsd:string" />
								<xsd:element name="RegExp" type="xsd:string" />
							</xsd:all>
						</xsd:complexType>
					</xsd:element>
				</xsd:sequence>
			</xsd:complexType>
		</xsd:element>
		<!-- List of fields which uniquely identify each audit record-->
		<xsd:element name="MarkerField" minOccurs="1" maxOccurs="1">
			<xsd:complexType>
				<xsd:sequence>
					<xsd:element name="Name" type="xsd:string"  minOccurs="1" maxOccurs="20"/>
				</xsd:sequence>
			</xsd:complexType>
		</xsd:element>
	</xsd:all>
</xsd:complexType>

<!-- Filter Type-->
<xsd:complexType name="FilterType">
	<xsd:sequence>
		<!-- Provide all Included or Excluded values for given source field name-->
		<xsd:element name="Value" minOccurs="1" maxOccurs="1000" type="xsd:string"/>
	</xsd:sequence>
</xsd:complexType>

<!-- Event Filter Type-->
<xsd:complexType name="EventFilterType">
	<xsd:sequence>
	<!-- Source Field Name through which audit events will be filtered-->
	<xsd:element name="FieldName" type="xsd:string"/>
	<xsd:choice>
		<!-- Use either Include or Exclude to filter audit events-->
		<xsd:element name="Include" type="FilterType" minOccurs="1" maxOccurs="1"/>
		<xsd:element name="Exclude" type="FilterType" minOccurs="1" maxOccurs="1"/>
	</xsd:choice>
	</xsd:sequence>
</xsd:complexType>
</xsd:schema>