Skip to content

Infoblox

oracle

About

Oracle Corporation is an American multinational computer technology corporation headquartered in Austin, Texas. The company was formerly headquartered in Redwood Shores, California, until December 2020 when it moved its headquarters to Texas.

Oracle offers a comprehensive and fully integrated stack of cloud applications and platform services.

Product Details

Vendor URL: Oracle | Integrated Cloud Applications and Platform Services

Product Type: Database

Product Tier: Tier III

Integration Method: Syslog

Integration URL: How to Configure syslog Audit Logs

Log Guide: Managing Log Files - Oracle Help Center

Parser Details

Log Format: JSON

Expected Normalization Rate: 75%

Data Label: ORACLE_DB

UDM Fields (list of all UDM fields leveraged in the Parser):

Log File Field UDM Field
vendor metadata.vendor_name
product metadata.product_name
product_event metadata.product_event_type
GENERIC_EVENT/USER_LOGIN/USER_LOGOUT metadata.event_type
length additional.fields
file_name src.file.full_path
src principal.hostname
src principal.ip
dst target.hostname
dst target.ip
dhost target.hostname
dhost target.ip
shost principal.hostname
shost principal.ip
suser principal.user.userid
request target.url
AUTHTYPE_UNSPECIFIED extensions.auth.type
observer target.hostname
observer observer.hostname
observer observer.ip

Product Event Types

type,subtype severity UDM Event Classification alerting enabled
Default GENERIC_EVENT
LOGOFF USER_LOGOUT
LOGON USER_LOGIN

Log Sample

{"msg": "MACHINENAME|RLOG|John.DOE|1234567||||0|||0|12345||LOGON|100||02-DEC-21:05:01:29||\n","length": 84,"file_name": "oracle_audit.gz","product": "Oracle","vendor": "Oracle"}

Sample Parsing

metadata.event_timestamp = "2021-12-02T05:01:29Z"
metadata.event_type = "USER_LOGIN"
metadata.vendor_name = "Oracle"
metadata.product_name = "RLOG"
metadata.product_event_type = "LOGON"
additional.length = "84"
principal.user.userid = "John.Doe"
principal.namespace = "domain"
src.file.full_path = "oracle_audit.gz"
src.namespace = "COMPANYNAME"
target.hostname = "hostname2"
target.namespace = "domain"
target.asset.hostname = "hostname2"
observer.hostname = "hostname1"
observer.namespace = "domain"

Parser Alerting

This product currently does not have any Parser-based Alerting

Rules

Coming Soon