{
    "id": "OracleDatabaseAudit",
    "title": "[Deprecated] Oracle Database Audit",
    "publisher": "Oracle",
    "descriptionMarkdown": "The Oracle DB Audit data connector provides the capability to ingest [Oracle Database](https://www.oracle.com/database/technologies/) audit events into Microsoft Sentinel through the syslog. Refer to [documentation](https://docs.oracle.com/en/database/oracle/oracle-database/21/dbseg/introduction-to-auditing.html#GUID-94381464-53A3-421B-8F13-BD171C867405) for more information.",
    "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "OracleDatabaseAudit",
            "baseQuery": "OracleDatabaseAuditEvent"
        }
    ],
    "sampleQueries": [
        {
            "description" : "Top 10 Sources",
            "query": "OracleDatabaseAuditEvent\n | summarize count() by SrcDvcHostname\n | top 10 by count_"
        }
    ],
    "dataTypes": [
        {
            "name": "Syslog (OracleDatabaseAudit)",
            "lastDataReceivedQuery": "OracleDatabaseAuditEvent\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "OracleDatabaseAuditEvent\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "write permission is required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "",
            "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias Oracle Database Audit and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Parsers/OracleDatabaseAuditEvent.txt). The function usually takes 10-15 minutes to activate after solution installation/update.",
            "instructions": [
            ]
        },
        {
            "title": "1. Install and onboard the agent for Linux",
            "description": "Typically, you should install the agent on a different computer from the one on which the logs are generated.\n\n>  Syslog logs are collected only from **Linux** agents.",
            "instructions": [
                {
                    "parameters": {
                        "title": "Choose where to install the agent:",
                        "instructionSteps": [
                            {
                                "title": "Install agent on Azure Linux Virtual Machine",
                                "description": "Select the machine to install the agent on and then click **Connect**.",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "linkType": "InstallAgentOnLinuxVirtualMachine"
                                        },
                                        "type": "InstallAgent"
                                    }
                                ]
                            },
                            {
                                "title": "Install agent on a non-Azure Linux Machine",
                                "description": "Download the agent on the relevant machine and follow the instructions.",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "linkType": "InstallAgentOnLinuxNonAzure"
                                        },
                                        "type": "InstallAgent"
                                    }
                                ]
                            }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
            ]
        },
        {
            "title": "2. Configure the logs to be collected",
            "description": "Configure the facilities you want to collect and their severities.\n\n1.  Under workspace advanced settings **Configuration**, select **Data** and then **Syslog**.\n2.  Select **Apply below configuration to my machines** and select the facilities and severities.\n3.  Click **Save**.",
            "instructions": [
                {
                    "parameters": {
                        "linkType": "OpenSyslogSettings"
                    },
                    "type": "InstallAgent"
                }
            ]
        },
        {
            "title": "3. Configure Oracle Database Audit events to be sent to Syslog",
            "description": "Follow the below instructions \n\n 1. Create the Oracle database [Follow these steps.](https://learn.microsoft.com/en-us/azure/virtual-machines/workloads/oracle/oracle-database-quick-create) \n\n 2. Login to Oracle database created from the above step [Follow these steps.](https://docs.oracle.com/cd/F49540_01/DOC/server.815/a67772/create.htm) \n\n 3. Enable unified logging over syslog by **Alter the system to enable unified logging** [Following these steps.](https://docs.oracle.com/en/database/oracle/oracle-database/21/refrn/UNIFIED_AUDIT_COMMON_SYSTEMLOG.html#GUID-9F26BC8E-1397-4B0E-8A08-3B12E4F9ED3A) \n\n 4. Create and  **enable an Audit policy for unified auditing** [Follow these steps.](https://docs.oracle.com/en/database/oracle/oracle-database/19/sqlrf/CREATE-AUDIT-POLICY-Unified-Auditing.html#GUID-8D6961FB-2E50-46F5-81F7-9AEA314FC693) \n\n 5. **Enabling syslog and Event Viewer** Captures for the Unified Audit Trail [Follow these steps.](https://docs.oracle.com/en/database/oracle/oracle-database/18/dbseg/administering-the-audit-trail.html#GUID-3EFB75DB-AE1C-44E6-B46E-30E5702B0FC4)"
        }              
    ]
}