How should we handle DB audit trails?

[danielbb]

We would like to ingest the Oracle's UNIFIED_AUDIT_TRAIL table and the SQL server's MSSQL\SQLAudit\*.sqlaudit files.

How should we do it? Should we index the Oracle's UNIFIED_AUDIT_TRAIL table? Is there maybe an add-on? And what should we do on the SQL Server side? Should we read the files themselves?

[altink]

For Oracle Unified Audit (starting with Oracle 12c R1), you can use the following

Oracle Unified Audit App for Splunk

https://splunkbase.splunk.com/app/6172/ 

best regards
Altin

[danielbb]

We also wonder whether the Windows event logs have information about the SQL Server audit information.

A good conversation about the Oracle audit trails at - https://community.splunk.com/t5/Splunk-Search/How-to-index-Oracle-audit-trails-stored-in-aud-files/m...