Detections
Analytics

5.1 Ensure All Auditable System Actions Commands Are Audited

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Oracle defines ( * ) the various command categories such as DDL DML TCL etc. partly deviating from the ANSI standard.

However, these command categories are incomplete and only represent a part of the auditable commands.

For this reason, the term "Auditable System Actions" is used in the following. This type of definition allows a flexible and future-oriented possibility to add new commands and commands that will be added to future patch sets.

According to the Oracle definition* of Data Definition Language (DDL) statements, these tasks can be performed by definition:

 -

Create, modify and delete schema obje

 -

Granting and revoking privileges and roles

 -

Analyze information about a table, index or cluster

 -

Setting up auditing options

 -

Adding comments to the data dictionary

https://docs.oracle.com/en/database/oracle/oracle-database/23/sqlrf/Types-of-SQL-Statements.html

Enabling this unified action audit causes logging of all DDL commands, whether successful or unsuccessful, issued by the users regardless of the privileges held by the users to issue such statements.

Logging and monitoring of all attempts to perform these DDL commands, whether successful or unsuccessful, may provide clues and forensic evidence about potential suspicious/unauthorized activities. Any such activities may be a cause for further investigation. In addition, organization security policies and industry/government regulations may require logging of all activities involving these DDL commands.

Solution

Execute the following SQL statement to remediate this recommendation:

ALTER AUDIT POLICY CIS_LOCAL_SYSTEM_ACTIONS
ADD
ACTIONS
<DDL>;

or

ALTER AUDIT POLICY CIS_LOCAL_SYSTEM_ACTIONS
ADD
PRIVILEGES
<DDL>;

Note: If you do not have CIS_LOCAL_SYSTEM_ACTIONS please create one using the CREATE AUDIT POLICY statement. Refer to Section 8.1 where a PL/SQL block is provided to help create or modify the audit policy to remediate this item in both container and pluggable database.

Impact:

Auditing all DDL can result in rapid growth of the audit trail, particularly in active or dynamic environments. This may lead to storage management challenges and require regular maintenance (e.g., purging or archiving old audit records). The audit trail may consume excessive space, leading to issues such as system slowdowns or errors when storage limits are reached if it is not carefully managed.

See Also

https://workbench.cisecurity.org/benchmarks/16474

Item Details

References: CSCv7|6.3

Plugin: OracleDB

Control ID: c75fee1143541d241bb2852cbe7ed1e7863a030aad87c0c1a5abb2c93c4e4d26