Skip to content

Instantly share code, notes, and snippets.

View iaksit's full-sized avatar

İbrahim AKŞİT iaksit

View GitHub Profile
-- On the database, enable auditing:
ALTER SYSTEM ALTER CONFIGURATION ('nameserver.ini', 'SYSTEM')
set (
'auditing configuration',
'global_auditing_state'
) = 'true' with reconfigure;
-- All audit logs should be directed to a database table called audit log in our scenario:
ALTER SYSTEM ALTER CONFIGURATION ('nameserver.ini', 'SYSTEM')
set (
'auditing configuration',
-- Please enable the auditing on database as documented in https://gist.github.com/shaheerxt/2ceda6c2d49e1fd33187428ff9da5a0b
-- Setup Policy as SYSTEM user (On the database - SYSTEMDB or TENANT DB):
CREATE AUDIT POLICY "AUDIT-USER_CONNECT_FAILURES" AUDITING UNSUCCESSFUL CONNECT LEVEL INFO;
-- Query to check if there are failures:
select *
from audit_log
where audit_policy_name = 'AUDIT-USER_CONNECT_FAILURES'
order by timestamp desc
limit 100;
-- You may want to check minutes aggregation if you have an application that often makes unsuccessful connections the database.
@iaksit
iaksit / 20211210-TLP-WHITE_LOG4J.md
Created December 13, 2021 21:22 — forked from SwitHak/20211210-TLP-WHITE_LOG4J.md
BlueTeam CheatSheet * Log4Shell* | Last updated: 2021-12-12 2204 UTC

Security Advisories / Bulletins linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

  • If you want to add a link, comment or send it to me
  • Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great ressources