This pack includes XSIAM content.
Collect Events from Vendor
In order to use the collector, you will need to perform the following steps:
Broker VM
You will need to use the information described here.\
You can configure the specific vendor and product for this instance.
- Navigate to Settings -> Configuration -> Data Broker -> Broker VMs.
- Right-click the broker VM and select Database Collector -> Activate.
- When configuring the Database Collector, set:
- vendor as oracle
- product as db
Database Collector
You will need to use the information described here.\
When configuring the Database Connection
the SQL Query
should look as follows:
SELECT to_char(EVENT_TIMESTAMP,'YYYY/MM/DD HH:MM:SS.mi') as DB_TIMESTAMP, UNIFIED_AUDIT_TRAIL.*
FROM UNIFIED_AUDIT_TRAIL
WHERE to_char(EVENT_TIMESTAMP,'YYYY/MM/DD HH:MM:SS.mi') > ?
ORDER BY DB_TIMESTAMP DESC;
Make sure to use the correct value for "Retrieval Value", to match the Rising Column value type.