Monday, December 21, 2020

"audit_option_type" difference in CIS audit policy and Oracle shipped CIS policy

CREATE AUDIT POLICY TEST_POLICY_1 PRIVILEGES CREATE USER, ALTER SYSTEM ACTIONS CREATE USER, ALTER SYSTEM;

select /*json-formatted*/ * from audit_unified_policies where policy_name='TEST_POLICY_1';
{
      "items" : [
        {
          "policy_name" : "TEST_POLICY_1",
          "audit_condition" : "NONE",
          "condition_eval_opt" : "NONE",
          "audit_option" : "CREATE USER",
          "audit_option_type" : "SYSTEM PRIVILEGE",
          "object_schema" : "NONE",
          "object_name" : "NONE",
          "object_type" : "NONE",
          "common" : "NO",
          "inherited" : "NO",
          "audit_only_toplevel" : "NO"
        },
        {
          "policy_name" : "TEST_POLICY_1",
          "audit_condition" : "NONE",
          "condition_eval_opt" : "NONE",
          "audit_option" : "ALTER SYSTEM",
          "audit_option_type" : "SYSTEM PRIVILEGE",
          "object_schema" : "NONE",
          "object_name" : "NONE",
          "object_type" : "NONE",
          "common" : "NO",
          "inherited" : "NO",
          "audit_only_toplevel" : "NO"
        },
        {
          "policy_name" : "TEST_POLICY_1",
          "audit_condition" : "NONE",
          "condition_eval_opt" : "NONE",
          "audit_option" : "ALTER SYSTEM",
          "audit_option_type" : "STANDARD ACTION",
          "object_schema" : "NONE",
          "object_name" : "NONE",
          "object_type" : "NONE",
          "common" : "NO",
          "inherited" : "NO",
          "audit_only_toplevel" : "NO"
        },
        {
          "policy_name" : "TEST_POLICY_1",
          "audit_condition" : "NONE",
          "condition_eval_opt" : "NONE",
          "audit_option" : "CREATE USER",
          "audit_option_type" : "STANDARD ACTION",
          "object_schema" : "NONE",
          "object_name" : "NONE",
          "object_type" : "NONE",
          "common" : "NO",
          "inherited" : "NO",
          "audit_only_toplevel" : "NO"
        }
      ]
    }
  ]
}

No comments:

Post a Comment