STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Oracle Database must include organization-defined additional, more detailed information in the audit records for audit events identified by type, location, or subject.

DISA Rule

SV-270505r1167742_rule

Vulnerability Number

V-270505

Group Title

SRG-APP-000101-DB-000044

Rule Version

O19C-00-005600

Severity

CAT II

CCI(s)

• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.

Weight

10

Fix Recommendation

If the site-specific audit requirements are not covered by the default audit options, deploy and configure FGA. For details, refer to Oracle documentation, at the location below.

For more information on the configuration of fine-grained auditing, refer to the following documents:
https://docs.oracle.com/en/database/oracle/oracle-database/19/dbseg/configuring-audit-policies.html#GUID-88DA3AF8-5F6A-4C6E-80EE-F65071E5BF46.

Check Contents

Review the system documentation to identify additional site-specific information not covered by the default audit options, the organization has determined to be necessary. If there are none, this is not a finding.

If any additional information is defined, compare those auditable events that are not covered by unified auditing with the existing Fine-Grained Auditing (FGA) specifications returned by the following query:

SELECT COUNT(*)
FROM audsys.unified_audit_trail
WHERE audit_type = 'FineGrainedAudit';

If any such auditable event is not covered by the existing FGA specifications, this is a finding.

Vulnerability Number

V-270505

Documentable

False

Rule Version

O19C-00-005600

Severity Override Guidance

Review the system documentation to identify additional site-specific information not covered by the default audit options, the organization has determined to be necessary. If there are none, this is not a finding.

If any additional information is defined, compare those auditable events that are not covered by unified auditing with the existing Fine-Grained Auditing (FGA) specifications returned by the following query:

SELECT COUNT(*)
FROM audsys.unified_audit_trail
WHERE audit_type = 'FineGrainedAudit';

If any such auditable event is not covered by the existing FGA specifications, this is a finding.

Check Content Reference

M

Target Key

5672