Detections
Analytics

O121-P2-008100 - Oracle Database must off-load audit data to a separate log management facility; this must be continuous and in near-real-time for systems with a network connection to the storage facility, and weekly or more often for stand-alone systems.

Information

Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Off-loading is a common process in information systems with limited audit storage capacity.

The DBMS may write audit records to database tables, files in the file system, other kinds of local repositories, or a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Configure the DBMS or deploy and configure software tools to transfer audit records to a centralized log management system, continuously and in near-real-time where a continuous network connection to the log management system exists, or at least weekly in the absence of such a connection.

For more information on auditing, refer to the following documents:

https://docs.oracle.com/database/121/DBSEG/auditing.htm#DBSEG1024

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_12c_V3R5_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4(1), CAT|II, CCI|CCI-001851, Rule-ID|SV-237747r961860_rule, STIG-ID|O121-P2-008100, STIG-Legacy|SV-76361, STIG-Legacy|V-61871, Vuln-ID|V-237747

Plugin: OracleDB

Control ID: 4d24cc4de40107b615252dddcdb80b9d5d445221780defcda136f9ef9c875d9b