The DBMS must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.
An XCCDF Rule
Description
Information system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control includes: timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked. Database software is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly who performed a given action. If user identification information is not recorded and stored with the audit record, the record itself is of very limited use.
- ID
- SV-219759r879568_rule
- Version
- O112-C2-007900
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure the DBMS's auditing to audit standard and organization-defined auditable events, the audit record to include the identity of any user/subject or process associated with the event. If preferred, use a third-party or custom tool.
If using a third-party product, proceed in accordance with the product documentation. If using Oracle's capabilities, proceed as follows.
Use this query to ensure auditable events are captured: