Audit trail data must be reviewed daily or more frequently.

From Oracle Database 11.2g Security Technical Implementation Guide

Associated with: CCI-000366

SV-68247r1_rule Audit trail data must be reviewed daily or more frequently.

Vulnerability discussion

Review of audit trail data provides a means for detection of unauthorized access or attempted access. Frequent and regularly scheduled reviews ensure that such access is discovered in a timely manner.

Check content

If the database being reviewed is not a production database, this check is Not a Finding. Review policy and procedures documented or noted in the System Security plan as well as evidence of implementation for daily audit trail monitoring. If policy and procedures are not documented or evidence of implementation is not available, this is a Finding.

Fix text

Develop, document and implement policy and procedures to monitor audit trail data daily.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.