SQL Script to create AuditLog report of User Actions in Enforce

Products

• Data Loss Prevention Enforce

Issue/Introduction

You would like to see the recorded USER actions from the console in the Audit Log.

Environment

Data Loss Prevention

Resolution

Relevant versions:  10.x+

To use, log into SQLPLUS as the protect user.  Run the following script:

-- -----
-- SymantecDLP_audit_USER.sql
-- -----
-- Purpose: Generates Audit report based on User Actions
--
-- -=-=-=-=-=-=-=-=-=-

SET HEADING ON
SET TRIMOUT ON
SET TRIMSPOOL ON
SET PAGESIZE 100
SET LINESIZE 132
set echo off

column entity format a15
column action format a15
column detail format a40 wrap
column the_date noprint
column username format a20
column time format a20

-- prompt Audit Log - User

select entity,
 action,
 to_char(time, 'DD-MON-YYYY HH24:MI:SS') time,
 username,
 detail,
 time the_date
from auditlog
where entity = 'User'
Order by action, the_date

/