Rules (XIF)
[MODEL: dataset="oracle_db_raw"]
filter
ACTION_NAME in ("AUDIT OBJECT", "NOAUDIT OBJECT", "CREATE USER", "CREATE ROLE", "DROP USER", "DROP ROLE", "SET ROLE", "SESSION REC", "SYSTEM AUDIT", "SYSTEM NOAUDIT", "AUDIT DEFAULT", "NOAUDIT DEFAULT", "SYSTEM GRANT", "SYSTEM REVOKE", "GRANT ROLE", "REVOKE ROLE")
| alter
xdm.source.user.username = OS_USERNAME,
xdm.event.operation = ACTION_NAME,
xdm.event.outcome_reason = SQL_TEXT;
filter
ACTION_NAME in ("ALTER SESSION","ALTER USER","LOGON","LOGOFF","LOGOFF BY CLEANUP")
| alter
xdm.network.session_id = to_string(SESSIONID),
xdm.source.user.username = OS_USERNAME,
xdm.source.host.hostname = USERHOST,
xdm.logon.type = AUTHENTICATION_TYPE,
xdm.source.application.name = CLIENT_PROGRAM_NAME,
xdm.event.outcome_reason = ACTION_NAME;
filter
ACTION_NAME in ("CREATE TABLE","INSERT","SELECT","CREATE CLUSTER","ALTER CLUSTER","UPDATE","DELETE","DROP CLUSTER","CREATE INDEX","DROP INDEX","ALTER INDEX","DROP TABLE","CREATE SEQUENCE","ALTER SEQUENCE","ALTER TABLE","DROP SEQUENCE","GRANT OBJECT","REVOKE OBJECT","CREATE SYNONYM","DROP SYNONYM","CREATE VIEW","DROP VIEW","VALIDATE INDEX","CREATE PROCEDURE","ALTER PROCEDURE","LOCK","NO-OP","RENAME","COMMENT","CREATE DATABASE LINK","DROP DATABASE LINK","CREATE DATABASE","ALTER DATABASE","CREATE ROLLBACK SEG","ALTER ROLLBACK SEG","DROP ROLLBACK SEG","CREATE TABLESPACE","ALTER TABLESPACE","DROP TABLESPACE","COMMIT","ROLLBACK","SAVEPOINT","PL/SQL EXECUTE","SET TRANSACTION","ALTER SYSTEM","EXPLAIN","CREATE SCHEMA","CREATE CONTROL FILE","CREATE TRIGGER","ALTER TRIGGER","DROP TRIGGER","ANALYZE TABLE","ANALYZE INDEX","ANALYZE CLUSTER","CREATE PROFILE","DROP PROFILE","ALTER PROFILE","DROP PROCEDURE","ALTER RESOURCE COST","CREATE MATERIALIZED VIEW LOG","ALTER MATERIALIZED VIEW LOG","DROP MATERIALIZED VIEW LOG","CREATE MATERIALIZED VIEW","ALTER MATERIALIZED VIEW","DROP MATERIALIZED VIEW","CREATE TYPE","DROP TYPE","ALTER ROLE","ALTER TYPE","CREATE TYPE BODY","ALTER TYPE BODY","DROP TYPE BODY","DROP LIBRARY","TRUNCATE TABLE","TRUNCATE CLUSTER","CREATE FUNCTION","ALTER FUNCTION","DROP FUNCTION","CREATE PACKAGE","ALTER PACKAGE","DROP PACKAGE","CREATE PACKAGE BODY","ALTER PACKAGE BODY","DROP PACKAGE BODY","CREATE PUBLIC SYNONYM","DROP PUBLIC SYNONYM","CREATE PUBLIC DATABASE LINK","DROP PUBLIC DATABASE LINK","EXECUTE PROCEDURE","USER COMMENT","ENABLE TRIGGER","DISABLE TRIGGER","ENABLE ALL TRIGGERS","DISABLE ALL TRIGGERS","NETWORK ERROR","EXECUTE TYPE","CREATE DIRECTORY","DROP DIRECTORY","CREATE LIBRARY","CREATE JAVA","ALTER JAVA","DROP JAVA","CREATE OPERATOR","CREATE INDEXTYPE","DROP INDEXTYPE","DROP OPERATOR","ASSOCIATE STATISTICS","DISASSOCIATE STATISTICS","CALL METHOD","CREATE SUMMARY","ALTER SUMMARY","DROP SUMMARY","CREATE DIMENSION","ALTER DIMENSION","DROP DIMENSION","CREATE CONTEXT","DROP CONTEXT","ALTER OUTLINE","CREATE OUTLINE","DROP OUTLINE","UPDATE INDEXES","ALTER OPERATOR")
| alter
xdm.database.connection_id = to_string(SESSIONID),
xdm.source.user.username = OS_USERNAME,
xdm.database.operation = ACTION_NAME,
xdm.database.statement = SQL_TEXT;