Object Types and Attributes Monitored on Oracle Database

Review a full list of object types Netwrix Auditor can collect on Oracle Database. If you deployed your Oracle Database in a cluster mode (Oracle Real Application Cluster), a host name also will be reported.

NOTE: Details marked with asterisk (*) are reported for Oracle Database 11g only.

Details marked with asterisk (**) are reported for Oracle Database 12c only.

Oracle Object modification under Privileges and object rename under Rename are reported without Object type (“Not available” is displayed).

Oracle Database startup under System Settings is reported without Workstation (“Not available” is displayed).

Object type Actions Details
Directories
  • Directory
  • Added / Add (Failed attempt)
  • Removed / Remove (Failed attempt)
  • Cause (for failed attempts)
  • Container name**
  • Database User
  • Program name / Database session requester**

  • Privilege for action

  • Session ID
  • Object schema
Executable objects
  • Procedure
  • Function
  • Package
  • Package body
  • Java
  • Added / Add (Failed attempt)
  • Modified / Modify (Failed attempt)
  • Removed / Remove (Failed attempt)
  • Cause (for failed attempts)
  • Container name**
  • Database User

  • Privilege for action

  • Program name / Database session requester**
  • Session ID
  • Unified policy name**

NOTE: For Oracle 11g database Modified / Modify (Failed attempt) events will not be monitored for the following objects: Procedure, Function, Package, Package body since native audit of these events is not supported. See this reference article for details.
Logons
  • Logon
  • Successful logon / Failed logon
  • Logoff
  • Cause (for failed attempts)
  • Client IP (only for logon events)
  • Container name**
  • Database User

  • Privilege for action

  • Program name / Database session requester**
  • Session ID
  • Object schema
  • Unified policy name**
Materialized views
  • Materialized view
  • Added / Failed Add
  • Removed / Failed Remove
  • Cause (for failed attempts)
  • Container name**
  • Database user
  • With option

  • Program name / Database session requester**

  • Session ID
  • Object schema
  • Unified policy name**
Privileges

  • Object
  • Modified / Modify (Failed attempt)
  • Cause (for failed attempts)
  • Container name**
  • Database user
  • With option
  • Privilege user
  • Program name / Database session requester**
  • Session ID
  • Unified policy name**
  • Role
  • Added / Add (Failed attempt)
  • Modified / Modify (Failed attempt)
  • Removed / Remove (Failed attempt)
  • Captured SQL statement
  • Cause (for failed attempts)
  • Container name**
  • Database user
  • With option
  • Program name / Database session requester**
  • Role name
  • Session ID
  • Unified policy name**
  • Database
  • Modified / Modify (Failed attempt)
  • Captured SQL statement
  • Cause (for failed attempts)
  • Container name**
  • Database user
  • With option
  • Program name / Database session requester**
  • Session ID
  • Unified policy name**
Profiles
  • Profile
  • Added / Add (Failed attempt)
  • Modified / Modify (Failed attempt)
  • Removed / Remove (Failed attempt)
  • Captured SQL statement
  • Cause (for failed attempts)
  • Container name**
  • Database user
  • Privilege for action
  • Program name / Database session requester**
  • Session ID
  • Unified policy name**
Rename
  • Object
  • Renamed / Rename (Failed attempt)
  • Cause (for failed attempts)
  • Container name**
  • Database user
  • New object name
  • With option

  • Privilege user

  • Session ID
  • Unified policy name**
Roles
  • Role
  • Added / Add (Failed attempt)
  • Modified / Modify (Failed attempt)
  • Removed / Remove (Failed attempt)
  • Captured SQL statement
  • Cause (for failed attempts)
  • Container name**
  • Database user
  • Privilege for action
  • Program name / Database session requester**
  • Session ID
  • Unified policy name**
Data
  • Data
  • Added / Add (Failed attempt)
  • Modified / Modify (Failed attempt)
  • Read / Read (Failed attempt)
  • Removed / Remove (Failed attempt)
  • Cause (for failed attempts)
  • Container name**
  • Database user
  • FGA policy name
  • Session ID
System Settings
  • Audit Policy
  • Added / Add (Failed attempt)
  • Modified / Modify (Failed attempt)
  • Captured SQL statement
  • Cause (for failed attempts)
  • Container name**
  • Database user
  • With option
  • Program name / Database session requester**
  • Session ID
  • Unified policy name**
  • Database
  • Modified / Modify (Failed attempt)
Tables
  • Table
  • Added / Add (Failed attempt)
  • Modified / Modify (Failed attempt)
  • Removed / Remove (Failed attempt)
  • Captured SQL statement
  • Cause (for failed attempts)
  • Container name**
  • Database user
  • Program name / Database session requester**
  • Session ID
  • Object schema
  • Unified policy name
Triggers
  • Trigger
  • Added / Add (Failed attempt)
  • Modified / Modify (Failed attempt)
  • Removed / Remove (Failed attempt)
  • Captured SQL statement
  • Cause (for failed attempts)
  • Container name**
  • Database user
  • With option
  • Program name / Database session requester**
  • Referenced table
  • Referenced table schema
  • Session ID
  • Object schema
  • Triggered by*
  • Unified policy name**
Users
  • User
  • Added / Add (Failed attempt)
  • Modified / Modify (Failed attempt)
  • Removed / Remove (Failed attempt)
  • Captured SQL statement
  • Cause (for failed attempts)
  • Container name**
  • Database user
  • Privilege for action
  • Program name / Database session requester**
  • Session ID
  • Unified policy name**
Views
  • View
  • Added / Add (Failed attempt)
  • Removed / Remove (Failed attempt)
  • Cause (for failed attempts)
  • Container name**
  • Database user
  • With option
  • Program name / Database session requester**
  • Session ID
  • Object schema
  • Unified policy name**
Oracle Datapump
  • Datapump
  • Read / Read (Failed attempt)
  • Modified / Modify (Failed attempt)

  • Cause (for failed attempts)

  • Container name**

  • Database user

  • Datapump boolean parameters
  • Datapump text parameters
  • Program name / Database session requester**
  • Session ID
Oracle Recovery Manager (RMAN)
  • RMAN
  • Added / Add (Failed attempt)
  • Modified / Modify (Failed attempt)
  • Read / Read (Failed attempt)
  • Removed / Remove (Failed attempt)
  • Cause (for failed attempts)
  • Container name**
  • Database user
  • Program name / Database session requester**
  • RMAN operation
Oracle SQL*Loader Direct Path Load
  • Direct Path Load API
  • Modified / Modify (Failed attempt)

  • Cause (for failed attempts)

    Container name**

  • Database user
  • Program name / Database session requester**
  • Session ID