Introduction

Application monitoring is critical for business continuity: it provides deeper insights on application performance, status, and security events. It also helps in user adoption of deployed SaaS Applications – as it provides insight how frequently applications are used.

Few examples of application monitoring include –

1. List of users who are logging in and from where?
2. Who created reports?
3. How are reports performing?
4. Long running ESS jobs, executed & scheduled jobs details.
5. How many active/inactive users?
6. Track any transactional change – who did & what was changes done?
7. Security changes – user lost access or gained unexpected access & who did that?

Below diagrams depicts Fusion cloud applications audit & monitoring capabilities.

Earlier we have covered how fusion cloud application provides monitoring data –  Five key Fusion Cloud Applications monitoring features for better user adoption & further provided information over audit aspects with Integrating a SIEM solution – Integrating a SIEM solution with Oracle Cloud Applications using audits

In this blog we will provide a matrix detailing various extraction methods that you can use to extract audit & monitoring data from Fusion cloud applications into a security information and event management (SIEM) tool.

Details:

We will go in details for below audit areas along with retention information so that you can plan your integrations schedule to get data from Fusion cloud applications on timely basis. Transactions, security related & performance data can be extracted on daily basis, wherein configurations data can be extracted weekly, however it depends upon requirement & use case.

Audit Matrix –

Below matrix provides details of audit Area – what kind of information can be extracted using possible extraction methods, MOS Notes and reference documents are provided for individual audit information.

Extraction Methods –

BIP Report

• Using BIP Report as ESS Job – Asynchronous mode – Recommended

This mode enables you to schedule a job to be executed at specific intervals not subject to timeout restrictions

Creating an Oracle Enterprise Scheduler (ESS) Job –

You register the Oracle Business Intelligence Publisher report as an Oracle Enterprise Scheduler (ESS) Job to run an integration in asynchronous mode. This mode enables you to schedule a job to be executed at specific intervals not subject to timeout restrictions –

There are two delivery options –

a. Deliver to UCM – Using the Oracle ERP Cloud Adapter and SOAP Adapter

1. Create a BIP report to schedule/execute and configure the report so that the report response is deposited to UCM.
2. Create a custom ESS job, then execute the BIP report
3. Create an Oracle ERP Cloud Adapter invoke connection using the Erp Integration Service and choose the exportBulkData operation. Ensure that the jobName is set to the custom ESS job created in step 2. jobOptions are set with EnableEvent=Y. This enables an event when the job is completed.
4. Create an Oracle ERP Cloud Adapter trigger connection to subscribe to the ExportBulkDataEvent. This provides a documentId in the event payload that is deposited in UCM.
   
5. Create a SOAP Adapter invoke using the UCM web service (GenericSoapService) and GET_FILE command in the operation to get the BIP report response as an attachment.
   

b. Deliver to FTP: (Using BI Report Delivery Option)

1. Configure the BI report to place the report response in FTP.
2. Create a custom ESS job in Oracle Fusion Applications to execute the BIP report.
3. Submit the ESS job using the ESS web service. See Implement Oracle Enterprise Scheduler Web Service Calls.
4. Get the response from FTP as an attachment once the job completes and the callback is received.

• Using BIP Report Services – Synchronous Mode

Calling BI report services synchronously with the SOAP Adapter is used only for short-running and/or small size reports, which are not frequently executed.

ExternalReportWSSService: runReport method

 Audit Report/API

Since fusion release 7, Oracle introduced an auditing function, which allow customer to use task Manage Audit Policies to turn on audit logging for changes made in fusion application and provided an interface (Navigator -> Tools: Audit Report) to view the audit log entries.

For a complete list of Business Objects available by product, go to the application using the path Setup and Maintenance> Search > Manage Audit Policies> and selecting the product.

Audit data can be extracted by below methods –

1. Using Standard ESS Job ‘Generate Audit Report’ to run the Audit Report. (Asynchronous mode)

1. Create an Oracle ERP Cloud Adapter invoke connection using the Erp Integration Service and choose the exportBulkData operation. Ensure that the jobName is set to the standard ESS job – ‘Generate Audit Report’. jobOptions are set with EnableEvent=Y. This enables an event when the job is completed.
2. Create an Oracle ERP Cloud Adapter trigger connection to subscribe to the ExportBulkDataEvent. This provides a documentId in the event payload that is deposited in UCM.
   
3. Create a SOAP Adapter invoke using the UCM web service (GenericSoapService) and GET_FILE command in the operation to get the BIP report response as an attachment.
   

2. Using Audit REST API’s – (Synchronous Mode)

• Audit Report REST Endpoints
• Audit Setup REST Endpoints
• Documentation And Samples For Audit REST API ? (Doc ID 2867069.1)
• What Roles Are Needed For A User To Call Audit Webservices? (Doc ID 2425053.1)

Conclusion

We hope with this blog you have better understanding of how various Audit data can be extracted from Fusion Applications after which Integration needs to be built to extract data using mechanisms detailed above and feed into SIEM tools as per use case requirements.

Note: Always refer to the latest documentation
 

References:

1. Five key Fusion Cloud Applications monitoring features for better user adoption
2. Integrating a SIEM solution with Oracle Cloud Applications using audits
3. Monitoring scheduled processes in Fusion Cloud Applications
4. MOS Note – Audit Frequently Asked Questions (FAQ) (Doc ID 2723316.1)
5. MOS Note – ESS Frequently Asked Questions (FAQ) (Doc ID 2723272.1)
6. Cloud Console Monitoring