Oracle IAM (v1.0.35)

A suite of solutions that enables secure user authentication, authorization, identity governance, and access control across enterprise applications and services.

Author: Cortex XSOAR
Support: xsoar
URL: https://www.paloaltonetworks.com/cortex
Categories: Analytics & SIEM, Identity and Access Management

Integrations (1)

Oracle IAM

Modeling rules (1)

Oracle OAM Modeling Rule

Parsing rules (1)

Oracle OAM Parsing Rule

README

<~XSIAM>

Overview

A robust suite that helps organizations securely manage user identities and control access to critical systems and data. It includes components for authentication, Single Sign-On (SSO), authorization, identity lifecycle management, and federation.

This pack includes

Built-in commands for CRUD (create, read, update, and delete) operations for employee lifecycle processes.
Modeling Rule for Audit Event logs that are ingested via the Broker VM on Cortex XSIAM.
Parsing Rule for timestamp ingestion.
- The ingested Oracle OAM logs can be queried in XQL Search using the oracle_oam_raw dataset.

Supported Timestamp Formats

Ingestion is conducted according to the IAU_TSTZORIGINATING field, in UTC (+0000) format.

Data Collection

Cortex XSIAM side - Broker VM

To create or configure the Broker VM, use the information described here.

Follow the below steps to configure the Broker VM to receive Oracle OAM logs.

Navigate to Settings → Configuration → Data Broker → Broker VMs.
Right-click the broker VM and select DB Collector -> Activate.

When configuring the Database Collector, set:

Parameter	Value
`Rising Column`	Enter IAU_TSTZORIGINATING
`Retrieval value`	Specify the value from where the applet starts querying, e.g; 2025-02-02 10:30:00
`Vendor`	Enter oracle.
`Product`	Enter oam.

You will need to use the information described here.
When configuring the Database Connection the SQL Query should look as follows:

SELECT * FROM <OAM_TABLE>
WHERE IAU_TSTZORIGINATING > ?
ORDER BY IAU_TSTZORIGINATING ASC

Make sure to use the correct value for “Retrieval Value”, to match the Rising Column value type.

</~XSIAM>