Enterasys Security Information and Event Manager, Configuration Manual

Page: 290 / 426

Configuring DSMs
274 O
RACLE
To create an index and a new view:
Step 1
From the Enterasys Extranet, download the appropriate file for your version of
Oracle:
a
If you are using Oracle 9i or 10g Release 1, download the following file:
oracle_9i_dba_audit_view.sql
b
If you are using Oracle v10g Release 2 and v11g, download the following file:
oracle_alt_dba_audit_view.sql
Step 2
Copy the downloaded file to a local directory.
Step 3
Change the directory to the location where you copied the file in Step 2 .
Step 4
Log in to SQLplus and log in as sysdba:
sqlplus / as sysdba
Step 5
At the SQL prompt, type one of the following commands, depending on your
version of Oracle Audit:
To create an index, the file may already be in use and must have exclusive access.
a
If you are using Oracle 9i or 10g Release 1, type the following command:
@oracle_9i_dba_audit_view.sql
b
If you are using Oracle v10g Release 2 and v11g, type the following command:
@oracle_alt_dba_audit_view.sql
Step 6
Make sure the database user configured in SIEM has SELECT permissions on the
view.
For example if the user is USER1:
grant select on sys.alt_dba_audit_view to USER1;
Step 7
Log out of SQLplus.
Step 8
Log in to SIEM.
Step 9
Update the JDBC protocol configuration for this entry to include the following:
• Table Name - Update the table name from DBA_AUDIT_TRAIL to
sys.alt_dba_audit_view .
• Compare Field - Update the field from entended_timestamp to ntimestamp .
For more information, see the Log Sources User Guide .
Step 10
Click Save .
Oracle DB Listener
The Oracle Database Listener application stores logs on the database server. To
integrate SIEM with Oracle DB Listener, select one of the following methods for
event collection:
•
Collecting Events Using the Oracle Database Listener Protocol
• Collecting Oracle Database Events Using Perl and Syslog