Example of Oracle Business Intelligence Publisher Reports

Using Audit Analysis and Reporting 13-13

13.5.2 Attributes of Audit Reports in Oracle Business Intelligence Publisher

Table 13–2 lists the attributes that appear in the various audit reports. When viewing a report, you can use this table to learn more about the attributes that appear in the report. Note the following: ■ Not all attributes appear in each report. ■ The user or users attribute, which appears in each report, can mean different things in different reports; see Table 13–1 for an explanation of this attribute. ■ Not all the attributes are displayed in Oracle Business Intelligence Publisher audit reports. If you wish to include some additional attributes in your custom reports, see Appendix C, Oracle Fusion Middleware Audit Framework Reference . Credential Management displays credential management operations performed in Oracle Platform Security Services. Component Specific, then Oracle Platform Security Services. Federation User Activity lists federation user activities in Oracle Identity Federation Component Specific, then Oracle Identity Federation. Message Integrity Enforcements shows enforcements related to message integrity in Oracle Web Services Manager Component Specific, then Oracle Web Services Manager, then Policy Enforcements Multiple Logins from Same IP lists machines from where successful logins are made into different user accounts. Common Reports, then User Activities. Password Changes shows password changes done in various accounts. Common Reports, then Account Management. Also in Component Specific folders. Policy Attachments shows Policy to web service endpoint attachments Component Specific, then Oracle Web Services Manager Policy Enforcements general policy enforcements for Oracle Web Services Manager Component Specific, then Oracle Web Services Manager, then Policy Enforcements Profile Management Events shows changes to Directory Integration Platforms profiles. Component Specific, then Directory Integration Platform. Request Response shows requests sent and responses received from web services Component Specific, then Oracle Web Services Manager System Policy Management displays system level policy management operations Component Specific, then Oracle Platform Security Services. Violations Enforcement violations. Component Specific, then Oracle Web Services Manager, then Policy Enforcements Web Services Policy Management shows policy management operations. Component Specific, then Oracle Web Services Manager, then Policy Management Table 13–1 Cont. List of Audit Reports Report Description Located in Folder 13-14 Oracle Fusion Middleware Application Security Guide

13.6 Customizing Audit Reports

This section discusses advanced report generation and creation options: ■ Using Advanced Filters on Pre-built Reports ■ Creating Custom Reports

13.6.1 Using Advanced Filters on Pre-built Reports

Clicking on the report’s Edit button brings up a page at which you can specify more detailed report filters and properties. This page consists of two panels. The left panel lets you select what element of the report is to be modified through these options. For each element you select, the right panel displays the corresponding information. ■ Data Model - This contains the SQL query that fetches the raw data for the report. The query can be modified according to your needs. ■ List of Values - Shows all the report columns. Selecting on a column displays the underlying SQL query that filters data for the attribute. You can modify the query as needed; for example you can specify more restrictive filter values. ■ Parameters - Shows all the report columns, and lets you select any column to modify display settings for that column. For example, you can specify a date display format for timestamp fields. ■ Layouts and output formats - This feature is described in the following section. Table 13–2 Attributes of Audit Reports Attribute Description Activity The type of action, either user- or system-initiated. Application Name The complete application path and name. Application Server Instance The instance of the application server in use. Attempted The action that was attempted, for example, a single sign-on attempted by the user. Component Name The name of the component instance. Component Type The type of component, for example Oracle Identity Federation. Domain Name Oracle WebLogic Server domain name. ECID The execution context ID. Event Type The type of event that occurred, for example, account creation. Initiator The user who initiated the event. Internet Protocol Address, IP Address The IP address of the user’s machine from which the action was initiated. Message Text The text of the message; a description of the event. Policy Name The name of the policy involved in the action. Time Range The time range which allows you to limit your data set to a specific time interval, for example, the last 24 hours. Timestamp The date and time of the event. Transaction ID The transaction identifier. Using Audit Analysis and Reporting 13-15

13.6.2 Creating Custom Reports

Oracle Business Intelligence Publisher provides a complete set of capabilities for designing and creating custom reports. Here is a simple example illustrating the basic steps to customize an existing audit report with Oracle Business Intelligence Publisher.

1. Log in to Oracle Business Intelligence Publisher as administrator.

2. Navigate to the Oracle Fusion Middleware Audit folder.

3. Create a folder to maintain your custom reports. Under Folder and Event Tasks,

click New Folder. Enter a folder name. See Also: ■ Oracle Business Intelligence Publisher Users Guide. ■ Section C.3, The Audit Schema