[Filebeat][New Module] Adding support for Oracle Audit logs

[P1llus]

What does this PR do?

This PR is the initial release of a Oracle module, with a audit log fileset.

Why is it important?

Adding support for more OOTB integrations

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: [Pull request #21991 updated]

• Start Time: 2020-10-29T19:26:18.939+0000

• Duration: 51 min 37 sec

Test stats 🧪

Test	Results
Failed	0
Passed	4493
Skipped	561
Total	5054

[elasticmachine]

Pinging @elastic/integrations-services (Team:Services)

[andresrc]

ping @sorantis @sayden

[leehinman]

Looking good.

Do you think we can add ECS categorization fields?

[P1llus]

@leehinman
For timezones I removed the default filebeat ones (removing add_locale processor), and I added a grok parser to grab the correct timezone since the date processor does not add timezone for some reason. If I don't set a timezone then event.timezone will stay empty, but it will be translated to UTC correctly.

For ECS Categorization I added event.type, event.cateogry, event.outcome and event.action. At this moment they really need to be static as there is no good way to differentiate the intent (is it a change, access, deletion etc).

The rest of the comments should also have been resolved with minor tweaks of the pipeline :)

[elasticmachine]

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	4493
Skipped	561
Total	5054

[leehinman]

Changes LGTM

might want to set event.kind = event

[sayden]

I'd change all database_audit mentions to audit_logs for example or simply audit. Maybe it's just me but the word database there feels redundant Maybe I'm missing that there are more type of audit logs and we are specifying which ones are those? Like the database_audit but you also have the server_audit and the user_audit? I don't know

[P1llus]

I'd change all database_audit mentions to audit_logs for example or simply audit. Maybe it's just me but the word database there feels redundant Maybe I'm missing that there are more type of audit logs and we are specifying which ones are those? Like the database_audit but you also have the server_audit and the user_audit? I don't know

Much appreciated feedback, thanks @sayden ! 👍

I think I agree with most of the field name changes, I was unsure if we wanted to keep the original names or not, because once we start renaming fields we have to ensure that any new fields that comes up at a later date does not conflict with the current ones.

On the topic of database_audit, we unfortunately have to keep some sort of reference to database here, as there is sooo many Oracle products, and a large amount of their portfolio has audit functionality, so we need to differentiate somewhat between products here I would say?

[sayden]

The convention on Beats is to prettify everything with some exceptions in some specific fields (none that comes to my memory right now). It's not that I agree a lot, I think I'd prefer to maintain original names but this "prettifycation" is what you'll find in most Beats modules, so it's good for Beats users to maintain that familiarity between modules.

About the database_audit topic: sure! if you feel it's makes things more clear with the rest of oracle products that's great and thank you very much for the clarification and explanation :)

[P1llus]

Should hopefully be good now @sayden . Always open for more changes if needed 👍

[sayden]

Good work with the module!

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)