Getting Data In

How to enable audit logs in these databases and then send logs to Splunk

dani9
Explorer

I got to integrate an Oracle database and a SQL server 2008 to my Splunk environment as a forwarder.

How can I enable audit logs in these databases and then send logs to Splunk?
How do they have to be configured Splunk side and database side?

0 Karma

altink
Builder

In Oracle you have the unified audit trail, and there are some pre-deployed policies which you can activate and start immediately.
https://docs.oracle.com/en/database/oracle/oracle-database/19/sqlrf/CREATE-AUDIT-POLICY-Unified-Audi... 

to retrieve and visualize the trail, you can use the following

Oracle Unified Audit App for Splunk

https://splunkbase.splunk.com/app/6172/ 

best regards
Altin

0 Karma

BainM
Communicator

Hi dani9-
I highly recommend DBConnect to gather any types of information from your SQL box. And for best practice, use a standalone Splunk app server to perform the collecting, then forward it to your indexers.
Same situation with Oracle.

Using DBConnect, you will do most configuration here. But, you will also need to have a local SQL and Oracle account in which to grant the DBConnect app to use. You will then configure the connection, connection type, and what tables to "grab" through the app in Splunk.

Hope this helps,
Mike

0 Karma

dani9
Explorer

Okay the problem now is database side.
How can I configure data ('to grab') like connection type, tables, name database etc.. So all this data that after I will be put in dB connect
Do you have any guide of that?

Thanks

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...