Auditing Activities with the Predefined Unified Audit Policies

Oracle Database provides predefined unified audit policies that cover commonly used security-relevant audit settings.

Related Topics

About Auditing Activities with the Predefined Unified Audit Policies

Oracle Database has a set of predefined unified audit policies that address most auditing needs.

These audit policies address common scenarios such as capturing login failures and secure options and requirements by the Security Internet Implementation Guide and the Center for Internet Security Recommendations.

You might see certain predefined audit policies that have already been enabled by default in your database. You can see the list of enabled audit policies by querying the AUDIT_UNIFIED_ENABLED_POLICIES data dictionary view. You can enable predefined audit policies by using the AUDIT PL/SQL statement.

To find the latest list of Oracle-supplied predefined unified audit policies, query the AUDIT_UNIFIED_POLICIES data dictionary view as follows:

SELECT DISTINCT POLICY_NAME FROM AUDIT_UNIFIED_POLICIES WHERE ORACLE_SUPPLIED = 'YES';

If you are using Oracle Data Safe or Oracle Audit Vault and Database Firewall (AVDF) to monitor the database activity across your enterprise, these products also offer a number of predefined audit policies in addition to the ones provided in the Oracle Database. You can provision these policies with a single click.

Related Topics

Secure Options Predefined Unified Audit Policy

The ORA_SECURECONFIG unified audit policy provides audit options using Oracle Database security best practices.

For new databases, this policy is enabled by default for both pure unified auditing and mixed-mode auditing environments. This policy is not enabled for databases that were upgraded from earlier versions, except if you have created a new database from the previous release and then upgrade it to the current release.

Note: Only user SYS can alter or drop this predefined policy.

The following statement shows the ORA_SECURECONFIG unified audit policy definition.

PRIVILEGES ALTER ANY TABLE, CREATE ANY TABLE, DROP ANY TABLE,
            CREATE ANY PROCEDURE, DROP ANY PROCEDURE, ALTER ANY PROCEDURE,
            GRANT ANY PRIVILEGE, GRANT ANY OBJECT PRIVILEGE, GRANT ANY ROLE,
            AUDIT SYSTEM, CREATE EXTERNAL JOB, CREATE ANY JOB,
            CREATE ANY LIBRARY,
            EXEMPT ACCESS POLICY,
            CREATE USER, DROP USER,
            ALTER DATABASE, ALTER SYSTEM,
            CREATE PUBLIC SYNONYM, DROP PUBLIC SYNONYM,
            CREATE SQL TRANSLATION PROFILE, CREATE ANY SQL TRANSLATION
PROFILE,
            DROP ANY SQL TRANSLATION PROFILE, ALTER ANY SQL TRANSLATION
PROFILE,
            TRANSLATE ANY SQL,
            EXEMPT REDACTION POLICY,
            PURGE DBA_RECYCLEBIN, LOGMINING,
            ADMINISTER KEY MANAGEMENT, BECOME USER,
            ADMINISTER FINE GRAINED AUDIT POLICY,
            ADMINISTER REDACTION POLICY,
            ADMINISTER ROW LEVEL SECURITY POLICY,
            GRANT ANY SCHEMA PRIVILEGE,
            CREATE ANY DOMAIN, ALTER ANY DOMAIN,
            DROP ANY DOMAIN,
            CREATE ANY MLE, ALTER ANY MLE, DROP ANY MLE,
            ADMINISTER SQL FIREWALL
 ACTIONS ALTER USER, CREATE ROLE, ALTER ROLE, DROP ROLE,
            SET ROLE, CREATE PROFILE, ALTER PROFILE,
            DROP PROFILE, CREATE DATABASE LINK,
            ALTER DATABASE LINK, DROP DATABASE LINK,
            CREATE DIRECTORY, DROP DIRECTORY,
            CREATE PLUGGABLE DATABASE,
            DROP PLUGGABLE DATABASE,
            ALTER PLUGGABLE DATABASE,
            ALTER DATABASE DICTIONARY,
            EXECUTE ON REMOTE_SCHEDULER_AGENT.ADD_AGENT_CERTIFICATE;

Note: An audit policy created on any standard action(s): CREATE USER, ALTER USER, DROP USER, GRANT, REVOKE, CREATE ROLE, ALTER ROLE, DROP ROLE, and CHANGE PASSWORD will also audit the respective RAS action(s). Oracle has added the equivalent RAS component action(s), such as GRANT PRIVILEGE and GRANT ROLE, to the audit policy definition if the policy contained any of the previously stated standard actions, such as GRANT. The XS component actions added to the audit policy definition are visible in AUDIT_UNIFIED_POLICIES.

To enable ORA_SECURECONFIG audit policy, run the following:

AUDIT POLICY ORA_SECURECONFIG;

Oracle Database Parameter Changes Predefined Unified Audit Policy

The ORA_DATABASE_PARAMETER policy audits commonly used Oracle Database parameter modification commands.

Note: Only user SYS can alter or drop this predefined policy.

The following statement shows the ORA_DATABASE_PARAMETER unified audit policy definition. By default, this policy is not enabled.

ACTIONS ALTER DATABASE, ALTER SYSTEM, CREATE SPFILE;

To enable ORA_DATABASE_PARAMETER, run the following command:

AUDIT POLICY ORA_DATABASE_PARAMETER;

User Account and Privilege Management Predefined Unified Audit Policy

The ORA_ACCOUNT_MGMT policy audits commonly used user account and privilege settings.

Note: Only user SYS can alter or drop this predefined policy.

The following statement shows the ORA_ACCOUNT_MGMT unified audit policy definition. By default, this policy is not enabled.

ACTIONS CREATE USER, ALTER USER, DROP USER, CREATE ROLE, DROP ROLE,
  ALTER ROLE, SET ROLE, GRANT, REVOKE;

Note: An audit policy created on any standard action(s): CREATE USER, ALTER USER, DROP USER, GRANT, REVOKE, CREATE ROLE, ALTER ROLE, DROP ROLE, and CHANGE PASSWORD will also audit the respective RAS action(s). Oracle has added the equivalent RAS component action(s), such as GRANT PRIVILEGE and GRANT ROLE, to the audit policy definition if the policy contained any of the previously stated standard actions, such as GRANT. The XS component actions added to the audit policy definition are visible in AUDIT_UNIFIED_POLICIES.

To enable ORA_ACCOUNT_MGMT, run the following command:

AUDIT POLICY ORA_ACCOUNT_MGMT;

Center for Internet Security Recommendations Predefined Unified Audit Policy

The ORA_CIS_RECOMMENDATIONS policy performs audits that the Center for Internet Security (CIS) recommends.

Note: Only user SYS can alter or drop this predefined policy.

The following statement shows the ORA_CIS_RECOMMENDATIONS unified audit policy definition. By default, this policy is not enabled.

PRIVILEGES SELECT ANY DICTIONARY, ALTER SYSTEM
ACTIONS CREATE USER, ALTER USER, DROP USER,
        CREATE ROLE, DROP ROLE, ALTER ROLE,
        GRANT, REVOKE, CREATE DATABASE LINK,
        ALTER DATABASE LINK, DROP DATABASE LINK,
        CREATE PROFILE, ALTER PROFILE, DROP PROFILE,
        CREATE SYNONYM, DROP SYNONYM,
        CREATE PROCEDURE, DROP PROCEDURE,
        ALTER PROCEDURE, ALTER SYNONYM, CREATE FUNCTION,
        CREATE PACKAGE, CREATE PACKAGE BODY,
        ALTER FUNCTION, ALTER PACKAGE, ALTER SYSTEM,
        ALTER PACKAGE BODY, DROP FUNCTION,
        DROP PACKAGE, DROP PACKAGE BODY,
        CREATE TRIGGER, ALTER TRIGGER,
        DROP TRIGGER;

Note: An audit policy created on any standard action(s): CREATE USER, ALTER USER, DROP USER, GRANT, REVOKE, CREATE ROLE, ALTER ROLE, DROP ROLE, and CHANGE PASSWORD will also audit the respective RAS action(s). Oracle has added the equivalent RAS component action(s), such as GRANT PRIVILEGE and GRANT ROLE, to the audit policy definition if the policy contained any of the previously stated standard actions, such as GRANT. The XS component actions added to the audit policy definition are visible in AUDIT_UNIFIED_POLICIES.

To enable ORA_CIS_RECOMMENDATIONS, run the following command:

AUDIT POLICY ORA_CIS_RECOMMENDATIONS;

Related Topics

Security Technical Implementation Guide Predefined Unified Audit Policies

You can use predefined unified audit policies to implement Security Technical Implementation Guide (STIG) audit requirements.

STIG Recommendations Predefined Unified Audit Policy

The ORA_STIG_RECOMMENDATIONS policy performs audits that the Security Technical Implementation Guide (STIG) recommends.

Note: Only user SYS can alter or drop this predefined policy.

The following statement shows the ORA_STIG_RECOMMENDATIONS unified audit policy definition. By default, this policy is not enabled.

PRIVILEGES ALTER SESSION
ACTIONS CREATE FUNCTION, ALTER FUNCTION, DROP FUNCTION,
	CREATE PACKAGE, ALTER PACKAGE, DROP PACKAGE,
	CREATE PROCEDURE, ALTER PROCEDURE, DROP PROCEDURE,
	CREATE TRIGGER, ALTER TRIGGER, DROP TRIGGER,
	CREATE PACKAGE BODY, ALTER PACKAGE BODY,
	DROP PACKAGE BODY,
	CREATE TYPE, ALTER TYPE, DROP TYPE,
	CREATE TYPE BODY, ALTER TYPE BODY, DROP TYPE BODY,
	CREATE LIBRARY, ALTER LIBRARY, DROP LIBRARY,
	CREATE JAVA, ALTER JAVA, DROP JAVA,
	CREATE OPERATOR, ALTER OPERATOR, DROP OPERATOR,
	CREATE TABLE, ALTER TABLE, DROP TABLE,
	CREATE VIEW, ALTER VIEW, DROP VIEW,
	CREATE MATERIALIZED VIEW, ALTER MATERIALIZED VIEW,
	DROP MATERIALIZED VIEW,
	CREATE ASSEMBLY, ALTER ASSEMBLY, DROP ASSEMBLY,
	CREATE SYNONYM, ALTER SYNONYM, DROP SYNONYM,
	CREATE USER, ALTER USER, DROP USER,
	GRANT, REVOKE,
	CREATE ROLE, ALTER ROLE, DROP ROLE, SET ROLE,
	CREATE PROFILE, ALTER PROFILE, DROP PROFILE,
	CREATE LOCKDOWN PROFILE, ALTER LOCKDOWN PROFILE,
	DROP LOCKDOWN PROFILE,
	ALTER SYSTEM, ALTER DATABASE, ALTER PLUGGABLE DATABASE,
	CREATE SPFILE, ALTER DATABASE DICTIONARY,
	ADMINISTER KEY MANAGEMENT,
	EXECUTE ON DBMS_JOB, EXECUTE ON DBMS_RLS,
	EXECUTE ON DBMS_REDACT, EXECUTE ON DBMS_TSDP_MANAGE,
	EXECUTE ON DBMS_TSDP_PROTECT,
	EXECUTE ON DBMS_NETWORK_ACL_ADMIN,
	EXECUTE ON DBMS_SCHEDULER
ACTIONS COMPONENT = OLS ALL';

Note: An audit policy created on any standard action(s): CREATE USER, ALTER USER, DROP USER, GRANT, REVOKE, CREATE ROLE, ALTER ROLE, DROP ROLE, and CHANGE PASSWORD will also audit the respective RAS action(s). Oracle has added the equivalent RAS component action(s), such as GRANT PRIVILEGE and GRANT ROLE, to the audit policy definition if the policy contained any of the previously stated standard actions, such as GRANT. The XS component actions added to the audit policy definition are visible in AUDIT_UNIFIED_POLICIES.

For STIG compliance, enable the ORA_STIG_RECOMMENDATIONS unified audit policy for all users.

AUDIT POLICY ORA_STIG_RECOMMENDATIONS;

All Top Level Actions Predefined Unified Audit Policy

The ORA_ALL_TOPLEVEL_ACTIONS policy performs audits of all top level actions of privileged users.

Note: Only user SYS can alter or drop this predefined policy.

The following statement shows the ORA_ALL_TOPLEVEL_ACTIONS unified audit policy definition. By default, this policy is not enabled.

ACTIONS ALL ONLY TOPLEVEL;

For STIG compliance, enable the ORA_ALL_TOPLEVEL_ACTIONS unified audit policy for all Oracle-defined and site specific privileged users. For example, the following statement audits the Oracle-defined privileged user SYS and site defined privileged user SITEADMIN:

AUDIT POLICY ORA_ALL_TOPLEVEL_ACTIONS BY SYS, SITEADMIN;

Logon and Logout Predefined Unified Audit Policy

The ORA_LOGIN_LOGOUT policy (previously called ORA_LOGON_FAILURES) tracks logon and logoff operations.

This policy is required for both the Center for Internet Security (CIS) and Security for Technical Implementation Guides (STIG) requirements. For CIS and STIG compliance, you must ensure that the ORA_LOGIN_LOGOUT unified audit policy is enabled for all users.

For new databases, this policy is enabled by default. This policy is not enabled for databases that were upgraded from earlier versions. Note that if you have configured a unified audit policy for LOGON statements, then audit records for both direct logins as well as ALTER SESSION and SET CONTAINER statements are generated.

The following statement shows the ORA_LOGIN_LOGOUT unified audit policy definition.

ACTIONS LOGON, LOGOFF;

Note: Only user SYS can alter or drop this predefined policy.

AUDIT POLICY ORA_LOGIN_LOGOUT WHENEVER NOT SUCCESSFUL;

ORA_DICTIONARY Sensitive Column Queries Predefined Unified Audit Policy

The ORA$DICTIONARY_SENS_COL_ACCESS predefined audit policy audits the sensitive columns in the Oracle Optimizer dictionary tables.

This predefined policy monitors and audits access to sensitive columns in the Oracle Optimizer dictionary tables. When enabled, this policy writes an audit record whenever the sensitive columns in oracle optimizer dictionary tables gets accessed. If disabled, then this policy does not audit access to these tables. If these tables are frequently accessed, then auditing actions can create too many audit records, which causes performance problems.

These tables are as follows:

Optimizer Dictionary Table Columns
SYS.HIST_HEAD$ minimum, maximum, lowval, hival
SYS.HISTGRM$ endpoint, epvalue_raw
SYS.WRI$_OPTSTAT_HISTHEAD_HISTORY minimum, maximum, lowval, hival
SYS.WRI$_OPSTAT_HISTGRM_HISTORY endpoint, epvalue_raw

This policy cannot be dropped; it can only been enabled or disabled. By default, it is enabled.

Oracle Database Real Application Security Predefined Audit Policies

You can use predefined unified audit policies for Oracle Database Real Application Security events.

Related Topics

System Administrator Operations Predefined Unified Audit Policy

The ORA_RAS_POLICY_MGMT predefined unified audit policy audits policies for all Oracle Real Application Security administrative actions on application users, roles, and policies.

Note: Only user SYS can alter or drop this predefined policy.

The following statement describes the ORA_RAS_POLICY_MGMT audit policy. By default, this policy is not enabled.

ACTIONS COMPONENT=XS
  CREATE USER, UPDATE USER, DELETE USER,
  CREATE ROLE, UPDATE ROLE, DELETE ROLE, GRANT ROLE, REVOKE ROLE,
  ADD PROXY, REMOVE PROXY,
  SET USER PASSWORD, SET USER VERIFIER, SET USER PROFILE,
  CREATE ROLESET, UPDATE ROLESET, DELETE ROLESET,
  CREATE SECURITY CLASS, UPDATE SECURITY CLASS, DELETE SECURITY CLASS,
  CREATE NAMESPACE TEMPLATE, UPDATE NAMESPACE TEMPLATE, DELETE NAMESPACE TEMPLATE,
  CREATE ACL, UPDATE ACL, DELETE ACL,
  CREATE DATA SECURITY, UPDATE DATA SECURITY, DELETE DATA SECURITY,
  ENABLE DATA SECURITY, DISABLE DATA SECURITY,
  ADD GLOBAL CALLBACK, DELETE GLOBAL CALLBACK, ENABLE GLOBAL CALLBACK;

For STIG compliance, enable the ORA_RAS_POLICY_MGMT unified audit policy for all users.

AUDIT POLICY ORA_RAS_POLICY_MGMT;

Session Operations Predefined Unified Audit Policy

The ORA_RAS_SESSION_MGMT predefined unified audit policy audits policies for all run-time Oracle Real Application Security session actions and namespace actions.

Note: Only user SYS can alter or drop this predefined policy.

The following statement describes the ORA_RAS_SESSION_MGMT policy. By default, this policy is not enabled.

CREATE AUDIT POLICY ORA_RAS_SESSION_MGMT
 ACTIONS COMPONENT=XS
  CREATE SESSION, DESTROY SESSION,
  ENABLE ROLE, DISABLE ROLE,
  SET COOKIE, SET INACTIVE TIMEOUT,
  SWITCH USER, ASSIGN USER,
  CREATE SESSION NAMESPACE, DELETE SESSION NAMESPACE,
  CREATE NAMESPACE ATTRIBUTE, GET NAMESPACE ATTRIBUTE, SET NAMESPACE ATTRIBUTE,
  DELETE NAMESPACE ATTRIBUTE;

For STIG compliance, enable the ORA_RAS_SESSION_MGMT for failed operations.

AUDIT POLICY ORA_RAS_SESSION_MGMT WHENEVER NOT SUCCESSFUL;

Oracle Database Vault Predefined Unified Audit Policy for DVSYS and LBACSYS Schemas

The ORA_DV_SCHEMA_CHANGES (previously called ORA_DV_AUDPOL) predefined unified audit policy audits Oracle Database Vault DVSYS and LBACSYS schema objects.

The ORA_DV_SCHEMA_CHANGES policy audits all actions that are performed on the Oracle Database Vault DVSYS (including DVF) schema objects and the Oracle Label Security LBACSYS schema objects. It does not capture actions on the F$* factor functions in the DVF schema. By default, this policy is enabled.

Note: Only user SYS can alter or drop this predefined policy.

To view the complete definition of this policy, query the AUDIT_UNIFIED_POLICIES data dictionary view, where POLICY_NAME is ORA_DV_SCHEMA_CHANGES. Because this policy audits actions on schema objects, query the AUDIT_OPTION, OBJECT_SCHEMA, and OBJECT_NAME columns to see the audited actions and the schema objects on which they are audited.

For example:

SELECT AUDIT_OPTION || ' on ' || OBJECT_SCHEMA || '.' || OBJECT_NAME
       AS audit_option_on_objects
FROM AUDIT_UNIFIED_POLICIES
WHERE POLICY_NAME = 'ORA_DV_SCHEMA_CHANGES'
ORDER BY 1;

Related Topics

Oracle Database Vault Predefined Unified Audit Policy for Default Realms and Command Rules

The ORA_DV_DEFAULT_PROTECTION (previously called ORA_DV_AUDPOL2) predefined unified audit policy audits the Oracle Database Vault default realms and command rules.

The ORA_DV_DEFAULT_PROTECTION policy constitutes the audit settings of the Oracle Database Vault-supplied default realms and command rules. By default, this policy is enabled.

Note: Only user SYS can alter or drop this predefined policy.

To view the complete definition of this policy, query the AUDIT_UNIFIED_POLICIES data dictionary view, where POLICY_NAME is ORA_DV_DEFAULT_PROTECTION. Query the AUDIT_OPTION, OBJECT_SCHEMA, and OBJECT_NAME columns to see more details about the audit options and object-specific entries for this policy.

Related Topics

Oracle Label Security Predefined Unified Audit Policy for LBACSYS Objects

The ORA_OLS_SCHEMA_CHANGES predefined unified audit policy audits objects that are owned by the Oracle Label Security LBACSYS user.

You can use this audit policy if Oracle Database Vault is not in use. You do not need to enable this policy if the ORA_DV_SCHEMA_CHANGES predefined unified audit policy is already enabled. Uninstallation of Oracle Database Vault will drop ORA_DV_SCHEMA_CHANGES. To ensure that the LBACSYS schema objects are still audited, ORA_OLS_SCHEMA_CHANGES will be enabled during uninstallation of Oracle Database Vault if ORA_DV_SCHEMA_CHANGES was enabled.

Note: Only user SYS can alter or drop this predefined policy.

To view the complete definition of this policy, query the AUDIT_UNIFIED_POLICIES data dictionary view, where POLICY_NAME is ORA_OLS_SCHEMA_CHANGES. Because this policy audits actions on schema objects, query the AUDIT_OPTION, OBJECT_SCHEMA, and OBJECT_NAME columns to see the audited actions and the LBACSYS schema objects on which they are audited.

Related Topics