oracle_database.md

oracle database

Expression

product = "oracle database"

Fields

Field	Core	Detection	Informational
src_ip			✓
db_id			✓
db_name			✓
domain		✓
dest_host			✓
fallback_user_name
domain_user_name
src_host			✓
user	✓	✓
operation			✓
dest_port			✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
database-activity	process_name	Default			✓
	service_name	Default			✓
	dest_ip	Default		✓
database-delete	db_schema				✓
	db_object				✓
database-login	dest_user	Default		✓
database-modify	db_schema				✓
	db_object				✓
database-query	dest_user			✓
	db_schema				✓
	db_object				✓