Security

Splunk & Security with Oracle, SQL, Teradata WITHOUT using Enterprise Security

mmensch
Path Finder

Good morning,

I am currently conducting research on using Splunk to monitor 3 types of databases in terms of security events. As the title states, the databases are Oracle, SQL, and Teradata.

The end goal is to write rules using Splunk's SPL to catch and/or prevent fraud, breaches, or anything else in terms of security. Due to the cost of Enterprise Security, I am not considering this at this point in time.

I was wondering if there are any native apps that contain pre-built searches, functions, inputs relating to security? If not, I was wondering what the next best practice would be, such as enabling auditing and sending the audit logs to Splunk, etc... If this is the case, what specific files and/or tables would be useful?

Thanks,
Matt

0 Karma

altink
Builder

Hi @mmensch

If you would accept a partial solution - Oracle only - you can watch for:

Omega Core Audit App for Splunk (at Splunkbase)

Which requires:

Omega Core Audit (at DATAPLUS)

best regards,
Altin Karaulli
DATAPLUS

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is the Splunk Add-on for Oracle (https://splunkbase.splunk.com/app/1910) that may help. There's also an app for Teradata. You don't say what kind of SQL database you have, but there's probably an app for that, too. Check splunkbase.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...