Oracle Database v1.0.11

A database management system designed for high performance, scalability, and secure data storage across cloud and on-premises environments.

Author:
Cortex XSOAR
Support:
xsoar
URL:
https://www.paloaltonetworks.com/cortex
xsiam
Analytics & SIEMDatabase

Modeling rules (2)

Parsing rules (1)

README

This pack includes XSIAM content.

Collect Events from Vendor

In order to use the collector, you will need to perform the following steps:

Broker VM

You will need to use the information described here.\
You can configure the specific vendor and product for this instance.

  1. Navigate to Settings -> Configuration -> Data Broker -> Broker VMs.
  2. Right-click the broker VM and select Database Collector -> Activate.
  3. When configuring the Database Collector, set:
    • vendor as oracle
    • product as db

Database Collector

You will need to use the information described here.\
When configuring the Database Connection the SQL Query should look as follows:

SELECT UNIFIED_AUDIT_TRAIL.*
FROM UNIFIED_AUDIT_TRAIL
WHERE UNIFIED_AUDIT_TRAIL.EVENT_TIMESTAMP > ?
ORDER BY UNIFIED_AUDIT_TRAIL.EVENT_TIMESTAMP DESC;

Make sure to use the correct value for “Retrieval Value”, to match the Rising Column value type.