Oracle Fusion Middleware Audit Framework in 11g

Introduction to Oracle Fusion Middleware Audit Framework 11-7 7. Reports can also be generated from the audit data using Oracle BI Publisher. A set of pre-defined reports are available. See Chapter 13, Using Audit Analysis and Reporting . Application Behavior in Case of Audit Failure It is important to note that an application does not stop execution if it is unable to record an audit event for any reason.

11.3.2 Key Technical Concepts

This section introduces key concepts in the Oracle Fusion Middleware Audit Framework. Audit-Aware Components The term audit-aware refers to components that are integrated with the Oracle Fusion Middleware Audit Framework so that audit policies can be configured and events can be audited for those components. Oracle Internet Directory is an example of an audit-aware component. Stand-alone applications can be integrate d with the Oracle Fusion Middleware Audit Framework through configuration with the jps-config.xml file. Audit Policy An audit policy is a declaration of the type of events to be captured by the audit framework for a particular component. For Java components, the audit policy is defined at the domain level. For system components, the audit policy is managed at the component instance level. Oracle Fusion Middleware Audit Framework provides several pre-defined policy types: ■ None ■ Low audits fewer events, definition is component-dependent ■ Medium audits many events, definition is component-dependent ■ Custom implements filters to narrow the scope of audited events Audit Policy Component Type This refers to the component type to be audited; for example, Oracle Internet Directory is a source of auditable events during authentication. For lists of the events that can be audited for each component, see Section C.1, Audit Events . Event Filters Certain audit events implement filters to control when the event is logged. For example, a successful login event for the Oracle Internet Directory component may be filtered for specific users. For details, see Section 12.3, Managing Audit Policies . Oracle Platform Security Services Oracle Platform Security Services, a key component of the Oracle Fusion Middleware 11g, is the Oracle Fusion Middleware security implementation for Java features such as Java Authentication and Authorization Service JAAS and Java EE security. 11-8 Oracle Fusion Middleware Application Security Guide For more information about OPSS, see Section 1.1, What is Oracle Platform Security Services? .

11.3.3 Audit Record Storage

As shown in Figure 11–1 , audit data can reside in two types of storage: ■ bus-stop files for intermediate storage of audit data. Each component instance writes to its own bus-stop. Bus-stop files are the default out-of-the-box storage mechanism for audit records: – For Java components, there is one bus-stop for each Oracle WebLogic Server instance. Audit records generated for all Java EE components running in a given Oracle WebLogic Server instance are stored in the same bus-stop. – For system components, there is a separate bus-stop for each component; thus, for example, each instance of Oracle Internet Directory has its own bus-stop. Bus-stop files are text-based and easy to query. For further details, see Section 11.3.1, Audit Architecture ■ permanent storage in a database; this is known as the audit store. If using a database, audit records generated by all components in all Oracle Fusion Middleware 11g instances in the domain are stored in the same store. You must use an audit store to utilize Oracle Business Intelligence Publisher reports. You can move from file-based storage to an audit store. This requires a specific configuration procedure. See Section 12.2.3, Configure a Database Audit Store for Java Components for details. Advantages of Using a Database Store Having the audit records in the bus-stop files has some practical limitations: ■ you cannot view domain-level audit data ■ reports cannot be run on Oracle BI Publisher Thus, there are certain advantages to using a database audit store: ■ You can use Oracle Business Intelligence Publisher for reporting. ■ The database store centralizes records from all components in the domain, whereas the bus-stop stores audit records on a per-instance basis. ■ performance may be improved compared to file-based storage For these reasons, Oracle recommends that customers switch to a database store for enhanced auditing capabilities.

11.3.4 Analytics

With Oracle Fusion Middleware 11g, you can utilize Oracle Business Intelligence as a full-featured tool for structured reporting. A large number of pre-defined reports are available, such as: ■ Users createddeleted ■ User transactions ■ Authentication and authorization failures ■ Policy violations