Alerts Overview
You can enable alerts on your target databases to track and be notified of particular user activities and unusual behavior.
You can choose to be alerted when a database parameter or audit policy changes, a failed login by an admin occurs, a user entitlement changes, and when a user is created or deleted.
About Alerts in Oracle Data Safe
An alert message proactively notifies you when a particular audit event happens on a target database. Alerts are based on the alert policies that you enable in Oracle Data Safe.
As a prerequisite to alert notification, you need an enabled audit policy. This policy is what generates the audit event. If the generated audit event matches the alert policy enabled for the target database, an alert is raised.
Oracle Data Safe Alert Policies
In Security Center, you can provision alert policies on your target databases. An alert policy defines a database event to monitor. Alert policies are rule-based and are triggered from the audit data collected.
For example, if the ORA_LOGON_FAILURES
unified audit
policy is provisioned on the target database, then when an administrator fails to
log in to the target database, a Failed login audit record is generated because of
this policy. The generated audit record is collected by Oracle Data Safe. When the alert policy Failed Logins by Admin User
is enabled
for the target, an alert is raised by Oracle Data Safe for the Failed login audit
record
The following table lists the Oracle predefined alert policies, their severity levels, their descriptions, and the basis for each alert.
Predefined Alert | Severity Level | Description | Required audit policies to trigger alert |
---|---|---|---|
Audit policy changes | High | Modifications to audit policies such as CREATE , ALTER , DROP , AUDIT , and NOAUDIT , as well as executions of DBMS_AUDIT_MGMT or DBMS_FGA package
|
These are captured by mandatory audits in an Oracle Database. |
Database parameter changes | High | Changes to database parameters using ALTER SYSTEM statement
|
Critical Database Activity or ORA_DATABASE_PARAMETER audit policy
|
Database schema changes | Medium | Any changes to Data Definition Language (DDL) actions such as CREATE , ALTER , DROP , or TRUNCATE on database schema objects*
|
Database Schema Changes or a similar audit policy |
Failed logins by admin user | Critical | All failed login attempts by an admin user who has either administrative or system privileges | ORA_LOGIN_FAILURES (ORA_LOGIN_LOGOUT for 23ai) or a similar policy
|
Profile changes | Critical | Any changes to user profiles such as CREATE , ALTER , or DROP |
Critical Database Activity or a similar audit policy |
User creation/modification | Medium | Any changes to database users such as CREATE , ALTER , or DROP
|
Critical Database Activity, ORA_ACCOUNT_MGMT , or a similar policy
|
User entitlement changes | Medium | Any changes to user entitlement data such as GRANT or REVOKE of privileges on any database objects
|
Critical Database Activity, ORA_ACCOUNT_MGMT , or a similar policy
|
SQL Firewall violations | Critical | SQL Firewall logs violations in real-time for every unmatched scenario of database connection or SLQ command execution against the entries in the enabled allowlist rules of the SQL Firewall policy. | Enable audit when you deploy and enforce SQL Firewall policy for the database user |
*Database schema objects include: PROCEDURE, PACKAGE, PACKAGE BODY, FUNCTION, TRIGGER, LIBRARY, SYNONYM, TABLE, DATABASE LINK, INDEX, OUTLINE, CONTEXT, ATTRIBUTE DIMENSION, DIMENSION, INDEXTYPE, OPERATOR, JAVA, MINING MODEL, TYPE BODY, TYPE, MATERIALIZED VIEW, MATERIALIZED VIEW LOG, MATERIALIZED ZONEMAP, VIEW, ANALYTIC VIEW, SEQUENCE,
and CLUSTER
Target-Policy Associations
When you apply an alert policy on a target database, Oracle Data Safe creates an association between your target database and the alert policy, and automatically enables the policy on your target database. You can view associations on the Target-Policy Associations page in Security Center. You can disable or re-enable the alert policy as needed and delete the target-policy association. Disabling the alert policy does not pause audit collection. It temporarily pauses the policy evaluation for the audit event.
This is the typical use case. During a maintenance window, you know that certain activities in the database are going to generate audit events, but you do not want alert notifications sent to the administrator during this window. You can pause the alert evaluation by disabling it momentarily.
Important:
You can apply alert policies before or after audit data collection is started for a target database. But when you want to start generating alerts, first ensure that appropriate audit polices are configured, that audit collection is enabled for the audit trails, and that Oracle Data Safe is collecting audit data from the target database.Throttled Alerts
Custom and predefined alert policies will automatically be throttled, temporarily paused, by Data Safe if 1000 or more alerts are generated within a ten minute interval.
In order to prevent an overwhelming amount of alerts that can occur due to improper configuration of audit or alert policies or due to changes in the application workload generating the audit events, Data Safe will throttle, temporarily pause, an alert policy if it generates 1000 or more alerts based on the audit collection data from one audit trail on a target database within a ten minute interval. These ten minute intervals have been designated by Data Safe as every ten minutes starting from the top of the hour.
If an alert policy is throttled, you will receive an Alert Generation Throttled alert informing you of the alert policy that has been throttled. When an alert policy is throttled, it is temporarily paused for up to ten minutes, for the remainder of the same ten-minute interval that the alerts were generated in, to allow you time to analyze if this abnormal volume of alerts is because of account misconfigurations in audit or alert policies or indicative of a potential breach. Once throttling is complete at the end of the ten minute interval, the alert policy will be enabled again.
For example, if an alert policy causes over 1000 alerts between 08:03 and 08:07, then you will receive the Alert Generation Throttled alert at 8:07 and the alert will be throttled until 08:09:59 as 08:00:00 to 08:09:59 is a designated ten minute interval. However, if an alert policy causes 501 alerts between 08:05 and 08:09:59 and additionally 501 alerts between 08:10 and 08:15, assuming no other alerts, the alert policy will not throttle as neither the 08:00:00 to 08:09:59 nor the 08:10:00 to 08:19:59 interval had 1000 or more alerts.
Because alert policies are evaluated at the time of audit collection in Data Safe, it is possible that the actual audit event was generated in the target database in the past. For instance, if you start an audit trail collection for a newly registered database to bring in a year's worth of audit data, Data Safe will evaluate the alert policies based on the collected audit data that is a year old and will throttle a alert policy if it generates 1000 or more alerts within a ten minute interval while parsing through the audit data. More specifically, if parsing through six hours of past audit data takes Data Safe from 10:02 to 10:07, and over 1000 alerts were triggered for an alert policy, then that alert policy will be throttled until 10:09:59.
Throttled Alerts Report
- Created: The time when the alert policy was first throttled.
- Throttling end time: The time when the alert policy was done being throttled.
Figure 5-1 Throttled alerts report example
See View and Manage Alert Reports for more information.
All Alerts Report
Oracle Data Safe provides an interactive All Alerts report that shows you a high-level summary of your alerts. You can set filters, show and hide report columns, save your changes as a custom report, and generate and download PDF and XLS reports. You can update, delete, and generate PDF and XLS reports from custom reports. You cannot delete the All Alerts report. The following screenshot shows you an example of an All Alerts report for six target databases.
![Description of all_alerts_report.png follows Description of all_alerts_report.png follows](img/all_alerts_report.png)
Description of the illustration all_alerts_report.png
Alerts Workflow
The general steps for applying for a target database are as follows:
- Obtain permissions in Oracle Cloud Infrastructure Identity and Access Management (IAM) to inspect target databases and use the Alerts feature in the relevant compartment.
- Register your target database. A default audit profile, audit policy, and audit trail are automatically created for you.
- Review and modify the default audit profile for your target database to customize audit data retention settings and paid usage settings.
- Review and modify the default audit policy for your target database to ensure the unified audit policies that are appropriate to track activities of interest are enabled on your target database. Among those policies, decide which audit events you want to configure for proactive monitoring via alerts.
- Review the audit trails for your target database and ensure that they are started so that they can collect audit data. They should be in either the Collecting or Idle state.
- Apply alert policies to your
target database.
- When an alert policy is enabled, you can receive alerts for that policy.
- When an alert policy is disabled, alert policy evaluation is suspended. Audit policy and audit data collection remains intact.
- Set up event and alarm notifications.
For example, you can subscribe to the
Alert Generated
event to be automatically informed when an alert is generated. Additionally, you can set up an alarm to receive a notification when for example, over a 100 alerts are generated within 5 minutes.
Prerequisites for Using Alerts
These are the prerequisites for using Alerts:
- Register the target databases that you want to use with the Alerts feature.
-
Obtain permission in Oracle Cloud Infrastructure Identity and Access Management (IAM) to
use the Alerts feature in Oracle Data Safe. An OCI administrator can grant
view
ormanage
permission as needed on the following resources::data-safe-alerts
data-safe-alert-policies
data-safe-target-alert-policy-associations
data-safe-report-definitions
data-safe-work-requests
(lets you view the list of work requests and their details)
As an alternative to selectively granting permissions, you can grant permissions
on data-safe-alert-family
in the relevant compartments, which would include
permissions on all of the resources above. See data-safe-alert-family Resource in the
Administering Oracle Data Safe guide for more information.
See Also:
The Administering Oracle Data Safe guide provides these sections to help with establishing the prerequisites:- Migrate to Oracle Cloud Infrastructure You can follow the one-time migration procedure described in the guide or you can do the migration manually.
- Grant Roles to the Oracle Data Safe Service Account on Your Target Database describes the roles required for Activity Auditing and for other Oracle Data Safe features.
- Create IAM Policies for Oracle Data Safe describes the privileges required for each feature in Oracle Data Safe.