Oracle IAM v1.0.34

A suite of solutions that enables secure user authentication, authorization, identity governance, and access control across enterprise applications and services.

Author:
Cortex XSOAR
Support:
xsoar
URL:
https://www.paloaltonetworks.com/cortex
agentixxsiamcloud_postureEDRcloudcloud_runtime_security
Analytics & SIEMIdentity and Access Management

Integrations (1)

Modeling rules (1)

Parsing rules (1)

README

<~XSIAM>

Overview

A robust suite that helps organizations securely manage user identities and control access to critical systems and data. It includes components for authentication, Single Sign-On (SSO), authorization, identity lifecycle management, and federation.

This pack includes

  • Built-in commands for CRUD (create, read, update, and delete) operations for employee lifecycle processes.
  • Modeling Rule for Audit Event logs that are ingested via the Broker VM on Cortex XSIAM.
  • Parsing Rule for timestamp ingestion.
    • The ingested Oracle OAM logs can be queried in XQL Search using the oracle_oam_raw dataset.

Supported Timestamp Formats

Ingestion is conducted according to the IAU_TSTZORIGINATING field, in UTC (+0000) format.

Data Collection

Cortex XSIAM side - Broker VM

To create or configure the Broker VM, use the information described here.

Follow the below steps to configure the Broker VM to receive Oracle OAM logs.

  1. Navigate to Settings → Configuration → Data Broker → Broker VMs.
  2. Right-click the broker VM and select DB Collector -> Activate.

  3. When configuring the Database Collector, set:

    Parameter Value
    Rising Column Enter IAU_TSTZORIGINATING
    Retrieval value Specify the value from where the applet starts querying, e.g; 2025-02-02 10:30:00
    Vendor Enter oracle.
    Product Enter oam.

You will need to use the information described here.
When configuring the Database Connection the SQL Query should look as follows:

SELECT * FROM <OAM_TABLE>
WHERE IAU_TSTZORIGINATING > ?
ORDER BY IAU_TSTZORIGINATING ASC

Make sure to use the correct value for “Retrieval Value”, to match the Rising Column value type.

</~XSIAM>