Oracle

This pack includes XSIAM content.

Collect Events from Vendor

In order to use the collector, you will need to perform the following steps:

• Configure the Broker VM
• Activate the Database Collector

Broker VM

You will need to use the information described here.\
You can configure the specific vendor and product for this instance.

1. Navigate to Settings -> Configuration -> Data Broker -> Broker VMs.
2. Right-click the broker VM and select Database Collector -> Activate.
3. When configuring the Database Collector, set:
   • vendor as oracle
   • product as db

Database Collector

You will need to use the information described here.\
When configuring the Database Connection the SQL Query should look as follows:

SELECT to_char(EVENT_TIMESTAMP,'YYYY/MM/DD HH:MM:SS.mi') as DB_TIMESTAMP, UNIFIED_AUDIT_TRAIL.*
FROM UNIFIED_AUDIT_TRAIL
WHERE to_char(EVENT_TIMESTAMP,'YYYY/MM/DD HH:MM:SS.mi') > ?
ORDER BY  DB_TIMESTAMP DESC;

Make sure to use the correct value for "Retrieval Value", to match the Rising Column value type.