Oracle Database (v1.0.12)

A database management system designed for high performance, scalability, and secure data storage across cloud and on-premises environments.

Author
Cortex XSOAR
Support
xsoar
URL
https://www.paloaltonetworks.com/cortex
Categories
Analytics & SIEM, Database

Modeling rules (1)

Parsing rules (1)

README

This pack includes XSIAM content.

Collect Events from Vendor

In order to use the collector, you will need to perform the following steps:

Broker VM

You will need to use the information described here.\
You can configure the specific vendor and product for this instance.

  1. Navigate to Settings -> Configuration -> Data Broker -> Broker VMs.
  2. Right-click the broker VM and select Database Collector -> Activate.
  3. When configuring the Database Collector, set:
    • vendor as oracle
    • product as db

Database Collector

You will need to use the information described here.\
When configuring the Database Connection the SQL Query should look as follows:

SELECT UNIFIED_AUDIT_TRAIL.*
FROM UNIFIED_AUDIT_TRAIL
WHERE UNIFIED_AUDIT_TRAIL.EVENT_TIMESTAMP > ?
ORDER BY UNIFIED_AUDIT_TRAIL.EVENT_TIMESTAMP DESC;

Make sure to use the correct value for “Retrieval Value”, to match the Rising Column value type.