Steps to Provision Unified Audit Policies

Apart from mandatorily audited activities and predefined unified audit policies enabled by default in the Oracle database, you may need to provision additional unified audit policies based on your security and compliance needs.

• Auditing Most Commonly Used Security-Relevant Activities
  Oracle Database provides a set of predefined unified audit policies that you can choose from for the most common security-relevant activities.

• Auditing SQL Statements, Privileges, and Other Activities of Interest
  You can create custom audit policies to track access to certain objects, actions or use of privileges, or use of Oracle Database components, such as Oracle Label Security. You can conditionally enable them to reduce audit volume.

• Value-Based Fine-Grained Audit Activities
  Use fine-grained auditing if you want to perform value-based auditing to audit access to certain rows based on values in specific columns or if you want to integrate with event handlers within the Oracle database.

Auditing Most Commonly Used Security-Relevant Activities

Oracle Database provides a set of predefined unified audit policies that you can choose from for the most common security-relevant activities.

Follow these steps to enable the predefined unified audit policies:

1. Select from one of the predefined unified audit policies. You can perform the following query to find a list of these policies:

   SELECT DISTINCT POLICY_NAME FROM AUDIT_UNIFIED_POLICIES WHERE ORACLE_SUPPLIED = 'YES';

2. Use the AUDIT statement to enable the policy and optionally apply (or exclude) the audit settings to one or more users.

3. Query the UNIFIED_AUDIT_TRAIL data dictionary view to find the generated audit records.

4. Periodically archive and purge the contents of the audit trail.

Related Topics

• Auditing Activities with the Predefined Unified Audit Policies

• Enabling and Applying Unified Audit Policies to Users and Roles

• Purging Audit Trail Records

Auditing SQL Statements, Privileges, and Other Activities of Interest

You can create custom audit policies to track access to certain objects, actions or use of privileges, or use of Oracle Database components, such as Oracle Label Security. You can conditionally enable them to reduce audit volume.

Follow these steps to create and enable the custom unified audit policies:

1. In most cases, use the CREATE AUDIT POLICY statement to create an audit policy. If you must audit application context values, then use the AUDIT statement.

2. If you are creating an audit policy, then use the AUDIT statement to enable it and optionally apply (or exclude) the audit settings to one or more users, including administrative users who log in with the SYSDBA administrative privilege (for example, the SYS user).

   AUDIT also enables you to create an audit record upon an action’s success, failure, or both.

3. Query the UNIFIED_AUDIT_TRAIL view to find the generated audit records.

4. Periodically archive and purge the contents of the audit trail.

Related Topics

• Creating Custom Unified Audit Policies

• Configuring Application Context Audit Settings

• Unified Audit Policy Data Dictionary Views

• Purging Audit Trail Records

Value-Based Fine-Grained Audit Activities

Use fine-grained auditing if you want to perform value-based auditing to audit access to certain rows based on values in specific columns or if you want to integrate with event handlers within the Oracle database.

Follow these steps to create and enable fine-grained audit policies:

1. Create a fine-grained auditing policy.

2. Use the DBMS_FGA PL/SQL package to configure fine-grained auditing policies.

3. Query the UNIFIED_AUDIT_TRAIL or ALL_AUDIT_POLICIES view to find the generated audit records.

4. Periodically archive and purge the contents of the audit trail.

Related Topics

• Value-Based Auditing with Fine-Grained Audit Policies

• Purging Audit Trail Records

Common Audit Configurations Across All PDBs

A common audit configuration is visible and enforced across all PDBs.

Audit configurations are either local or common. The scoping rules that apply to other local or common phenomena, such as users and roles, all apply to audit configurations.

Note: Audit initialization parameters exist at the CDB level and not in each PDB.

PDBs support the following auditing options:

• Object auditing

  Object auditing refers to audit configurations for specific objects. Only common objects can be part of the common audit configuration. A local audit configuration cannot contain common objects.

• Audit policies

  Audit policies can be local or common:

  • Local audit policies

    A local audit policy applies to a single PDB. You can enforce local audit policies for local and common users in this PDB only. Attempts to enforce local audit policies across all containers result in an error.

    In all cases, enforcing of a local audit policy is part of the local auditing framework.

  • Common audit policies

    A common audit policy applies to all containers. When you create a common audit policy, prefix the name with C## or c## (for example, c##all_select_pol). This policy can only contain actions, system privileges, common roles, and common objects. You can apply a common audit policy only to common users. Attempts to enforce a common audit policy for a local user across all containers result in an error.

    Audit records for common audit policies are always written to the PDB in which the auditable event occurs.

A common audit configuration is stored in the SYS schema of the root. A local audit configuration is stored in the SYS schema of the PDB to which it applies.

Audit trails are stored in the SYS or AUDSYS schemas of the relevant CDB or PDB container. Operating system and XML audit trails for PDBs are stored in subdirectories of the directory specified by the AUDIT_FILE_DEST (deprecated) initialization parameter.

General Audit Data Dictionary Views

Oracle Database provides different types of data dictionary and dynamic views for use with unified auditing. Table 30-20 lists views that are common to all types of auditing.

Tip:

To find error information about audit policies, check the trace files. The USER_DUMP_DEST initialization parameter sets the location of the trace files.

View	Description
AUDIT_UNIFIED_ENABLED_POLICIES	Describes the conditions on which an audit policy is enabled, such as audits for the success or failure of a user’s action that is being monitored in a policy
AUDIT_UNIFIED_POLICIES	Describes the action that was intended to be audited by the audit policy
CDB_UNIFIED_AUDIT_TRAIL	Similar to the UNIFIED_AUDIT_TRAIL view, displays the audit records but from all PDBs in a multitenant environment. This view is available only in the CDB root and must be queried from there.
UNIFIED_AUDIT_TRAIL	Displays all audit records
V$OPTION	The PARAMETER column for this view always returns TRUE, which indicates that unified auditing is enabled.
V$XML_AUDIT_TRAIL	Displays standard, fine-grained, SYS, and mandatory audit records written in XML format files.

Related Topics

• Oracle AI Database Reference