Good morning,
I am currently conducting research on using Splunk to monitor 3 types of databases in terms of security events. As the title states, the databases are Oracle, SQL, and Teradata.
The end goal is to write rules using Splunk's SPL to catch and/or prevent fraud, breaches, or anything else in terms of security. Due to the cost of Enterprise Security, I am not considering this at this point in time.
I was wondering if there are any native apps that contain pre-built searches, functions, inputs relating to security? If not, I was wondering what the next best practice would be, such as enabling auditing and sending the audit logs to Splunk, etc... If this is the case, what specific files and/or tables would be useful?
Thanks,
Matt
... View more