app:db
Database logs
- Host type
- Other / unclassified
- Techniques
- 1
- Rules listed
- 11
- Events
- 0
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| ASD ACSC / CISA et al.: Priority enterprise log sources | priority_source | quoted: data repositories |
Techniques
Rules
Sigma 1
- Suspicious SQL Query by @juju4
Microsoft Sentinel 10
- OracleDBAudit - Connection to database from external IP
- OracleDBAudit - Connection to database from unknown IP
- OracleDBAudit - Multiple tables dropped in short time
- OracleDBAudit - New user account
- OracleDBAudit - Query on Sensitive Table
- OracleDBAudit - SQL injection patterns
- OracleDBAudit - Shutdown Server
- OracleDBAudit - Unusual user activity on multiple tables
- OracleDBAudit - User activity after long inactivity time
- OracleDBAudit - User connected to database from new IP
Events
No event-level rows: this source is tiered as a whole.