Oracle Database Audit Event data naming mismatch

[TheCat1989]

Hi Team

Since the update of the Oracle database audit parser change, the data types in the logs seems to be changed. The change of the parser will make the old analytic rule and hunting query unusable.

for example in the parser, the SrcUserName is renamed as CURUSE

however, in the analytic rules the attribute remained unchanged.

[github-actions[bot]]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[github-actions[bot]]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[github-actions[bot]]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[github-actions[bot]]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[v-mchatla]

Hi @TheCat1989, My team is working on fixing this issue. @NikTripathi - Can you please provide update once the Parser changes are live. Thanks

[TheCat1989]

Sure, please let us know if when the changes are live. thanks again for the help !

[v-mchatla]

Hi @TheCat1989, The parser is optimized and currently pending with certification process. We will share you the update once it's pushed to live. Meanwhile you can review the parser from this link. Thanks

[v-mchatla]

Hi @TheCat1989, Closing this incident as fixed. Please feel free to reopen the issue if you still need any further assistance on this. Thanks

[github-actions[bot]]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.