Oracle Audit Vault Configuration Changed Indicating Log Tampering
Detects configuration changes to Oracle Audit Vault. The Vault is the integrity control for database auditing, so altering its configuration can stop collection, narrow what is recorded, or redirect the audit trail — removing the evidence of whatever follows. Treat any change here as affecting the reliability of all database audit data for the period concerned. Onboarding: ORACLE-AUDIT-VAULT is ingested via Syslog (KV) (Bloo extractor 310). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=configuration where sourcename='ORACLE-AUDIT-VAULT' and action='CONFIGURATION_CHANGED' | groupby user, config, srcip
Sigma
