Hello Oracle Community,
I recently validated a limitation in Oracle Data Safe while implementing a custom alert policy for CREATE USER operations on an Autonomous Database target.
The requirement was to generate an alert only when a local database/schema user is created:
CREATE USER LOCAL_USER IDENTIFIED BY ...
while excluding IAM/global users created with:
CREATE USER GLOBAL_USER IDENTIFIED GLOBALLY AS
'IAM_GROUP_NAME=/';
Both operations are correctly collected in the database unified audit trail and in Oracle Data Safe.
For both cases, the relevant structured audit attributes are effectively the same:
- operation: CREATE
- eventName: CREATE USER
- objectType: USER
- dbUserName: the database user executing the statement
- objectName: the user object being created
- operationStatus: Success
The only attribute that reliably distinguishes the two cases is the SQL command text:
- local database user: IDENTIFIED BY
- IAM/global user: IDENTIFIED GLOBALLY AS
Audit Reports
In Oracle Data Safe Audit Reports, the SQL Text filter works correctly and can distinguish the two CREATE USER statements.
Alert Rules
The same filtering cannot currently be implemented in a custom Data Safe Alert Rule.
Alert Rules use SCIM expressions and accept only the documented alert-condition fields. SQL_TEXT / commandText is not currently a supported Alert Rule field. A condition using commandText is rejected as an invalid expression.
A broader rule can detect CREATE USER operations, for example by using operation, eventName and objectType, but it matches both local and IAM/global user creation. It cannot implement the required exclusion.
Therefore, filtering an Audit Report and generating a native Data Safe alert are not functionally equivalent:
- Audit Report filtering can inspect SQL Text.
- Alert Rule filtering cannot currently use SQL_TEXT / commandText.
- The local-versus-global CREATE USER distinction cannot currently be expressed natively in an Alert Rule SCIM condition.
Oracle has acknowledged the current limitation and raised an internal enhancement request to evaluate extending Data Safe Alert Rules, either by supporting SQL_TEXT / commandText in Alert Rule conditions or by exposing an equivalent structured field that identifies the authentication type of the user being created.
No implementation timeline has been communicated.
Official references:
https://docs.oracle.com/en-us/iaas/data-safe/doc/view-and-manage-audit-reports.html
https://docs.oracle.com/en-us/iaas/data-safe/doc/view-and-manage-alert-policies.html
https://docs.oracle.com/en/cloud/paas/autonomous-database/serverless/adbsb/iam-create-users.html
Has anyone implemented another native Data Safe approach for this distinction without external post-processing?