Event Types for Oracle Data Safe

Target Database Event Types

The following table describes event types for target databases in Oracle Data Safe.

Friendly Name	Event Type and Description
Create Target Database - Begin	`com.oraclecloud.datasafe.createtargetdatabase.begin` The event type emits when a user creates a target database with Oracle Data Safe.
Create Target Database - End	`com.oraclecloud.datasafe.createtargetdatabase.end` The event type emits when target database creation is completed.
Delete Target Database - Begin	`com.oraclecloud.datasafe.deletetargetdatabase.begin` The event type emits when a user deletes a target database.
Delete Target Database - End	`com.oraclecloud.datasafe.deletetargetdatabase.end` The event type emits when a target database is deleted.
Register Target Database - Begin	`com.oraclecloud.datasafe.registerdatasafetarget.begin` The event type emits when a user registers a target database with Oracle Data Safe.
Register Target Database - End	`com.oraclecloud.datasafe.registerdatasafetarget.end` The event type emits when target database registration is completed.
Deregister Target Database - Begin	`com.oraclecloud.datasafe.deregisterdatasafetarget.begin` The event type emits when a user deregisters a target database with Oracle Data Safe.
Deregister Target Database - End	`com.oraclecloud.datasafe.deregisterdatasafetarget.end` The event type emits when a target deregistration is completed.
Target Database State Change	`com.oraclecloud.datasafe.statechangetargetdatabase` The event type emits when there is a change in a target database's state.
Alert Policy Target Association Patch Begin	`com.oraclecloud.datasafe.patchtargetalertpolicyassociation.begin` The event type emits when a user triggers an alert policy target association patch with Oracle Data Safe.
Alert Policy Target Association Patch End	`com.oraclecloud.datasafe.patchtargetalertpolicyassociation.end` The event type emits when an alert policy target association patch is completed.
Disabled Target Alert Policy Association	`com.oraclecloud.datasafe.disabledtargetalertpolicyassociation` The event type emits when a target alert policy association is generating more alerts than the threshold permits.

Example 4-1 Notification Text for a Create Target Database - End Event Type

{
  "eventType": "com.oraclecloud.datasafe.createtargetdatabase.end",
  "cloudEventsVersion": "0.1",
  "eventTypeVersion": "2.0",
  "source": "DataSafe",
  "eventTime": "2021-02-23T19:15:20.264Z",
  "contentType": "application/json",
  "data": {
    "compartmentId": "ocid1.tenancy.oc1..unique_ID",
    "compartmentName": "example-compartment",
    "resourceName": "targetDatabase",
    "resourceId": "ocid1.coreservicesworkrequest.oc1..unique_ID",
    "availabilityDomain": "<availability-domain>"
  },
  "eventID": "unique_ID",
  "extensions": {
    "compartmentId": "ocid1.tenancy.oc1..unique_ID"
  },
  "serviceName": "Data Safe", 
  "displayName": "Create Target Database - End",
  "additionalDetails": [
    {"name": "targetId", "type": "string"},
    {"name": "targetType", "type": "string"}
    ],
  "timeCreated": "2021-02-23T19:15:20.264Z",
  "activationTime": "2021-03-15T00:00:00.000Z"
}

Oracle Data Safe On-Premises Connector Event Types

The following table describes event types for Oracle Data Safe on-premises connectors.

Friendly Name	Event Type and Description
Create On-Prem Connector - Begin	`com.oraclecloud.datasafe.createonpremconnector.begin` The event type emits when an Oracle Data Safe on-premises connector creation request is triggered by a user.
Create On-Prem Connector - End	`com.oraclecloud.datasafe.createonpremconnector.end` The event type emits when an on-premises connector creation request is completed.
Delete On-Prem Connector - Begin	`com.oraclecloud.datasafe.deleteonpremconnector.begin` The event type emits when an Oracle Data Safe on-premises connector deletion request is triggered by a user.
Delete On-Prem Connector - End	`com.oraclecloud.datasafe.deleteonpremconnector.end` The event type emits when the on-premises connector deletion request is completed.
On-Prem Connector State Change	`com.oraclecloud.datasafe.statechangeonpremconnector` The event type emits when the state of an Oracle Data Safe on-premises connector changes.
Rotate On-Prem Connector - Begin	`com.oraclecloud.datasafe.updateonpremconnectorwallet.begin` The event type emits when a wallet rotation request for an Oracle Data Safe on-premises connector is triggered by a user.
Rotate On-Prem Connector - End	`com.oraclecloud.datasafe.updateonpremconnectorwallet.end` The event type emits when a wallet rotation request for an Oracle Data Safe on-premises connector is completed.

Example 4-2 Notification Text for the Create On-Prem Connector - Begin Event Type

{
  "eventType": "com.oraclecloud.datasafe.createonpremconnector.begin",
  "cloudEventsVersion": "0.1",
  "eventTypeVersion": "2.0",
  "source": "DataSafe",
  "eventTime": "2020-09-10T22:06:46.588Z",
  "contentType": "application/json",
  "data": {
    "compartmentId": "ocid1.tenancy.oc1..unique_ID",
    "compartmentName": "example-compartment",
    "resourceName": "onPremConnectors",
    "resourceId": "ocid1.coreservicesworkrequest.oc1..unique_ID",
    "availabilityDomain": "ad1"
  },
  "eventID": "unique_ID",
  "extensions": {
    "compartmentId": "ocid1.tenancy.oc1..unique_ID"
  } 
  "serviceName": "Data Safe",
  "displayName": "Create On-Prem Connector - Begin",
  "additionalDetails": [],
  "timeCreated": "2020-09-10T22:06:48.011Z"
}

Oracle Data Safe Private Endpoint Event Types

The following table describes event types for Oracle Data Safe private endpoints.

Friendly Name	Event Type and Description
Create Private Endpoint - Begin	`com.oraclecloud.datasafe.createdatasafeprivateendpoint.begin` The event type emits when an Oracle Data Safe private endpoint creation request is triggered by a user.
Create Private Endpoint - End	`com.oraclecloud.datasafe.createdatasafeprivateendpoint.end` The event type emits when an Oracle Data Safe private endpoint creation request is completed.
Delete Private Endpoint - Begin	`com.oraclecloud.datasafe.deletedatasafeprivateendpoint.begin` The event type emits when an Oracle Data Safe private endpoint deletion request is triggered by a user.
Delete Private Endpoint - End	`com.oraclecloud.datasafe.deletedatasafeprivateendpoint.end` The event type emits when an Oracle Data Safe private endpoint deletion request is completed.

Example 4-3 Notification Text for the Create Private Endpoint - End Event Type

{
  "eventType": "com.oraclecloud.datasafe.createdatasafeprivateendpoint.end",
  "cloudEventsVersion": "0.1",
  "eventTypeVersion": "2.0",
  "source": "DataSafe",
  "eventTime": "2020-09-10T22:07:10.809Z",
  "contentType": "application/json",
  "data": {
    "compartmentId": "ocid1.tenancy.oc1..unique_ID",
    "compartmentName": "example-compartment",
    "resourceName": "privateEndpoints",
    "resourceId": "ocid1.coreservicesworkrequest.oc1..unique_ID",
    "availabilityDomain": "ad1"
  },
  "eventID": "unique_ID",
  "extensions": {
    "compartmentId": "ocid1.tenancy.oc1..unique_ID"
  },
  "serviceName": "Data Safe",
  "displayName": "Create Private Endpoint - End",
  "additionalDetails": [],
  "timeCreated": "2020-09-10T22:06:48.011Z"
}

Security Assessment Event Types

The following table describes event types for Security Assessment in Oracle Data Safe.

Friendly Name	Event Type and Description
Security Assessment Create Begin	`com.oraclecloud.datasafe.createsecurityassessment.begin` The event type is emitted when a user triggers a security assessment.
Security Assessment Create End	`com.oraclecloud.datasafe.createsecurityassessment.end` The event type is emitted when a security assessment is finished.
Security Assessment Refresh Begin	`com.oraclecloud.datasafe.refreshsecurityassessment.begin` The event type is emitted when a user refreshes a security assessment.
Security Assessment Refresh End	`com.oraclecloud.datasafe.refreshsecurityassessment.end` The event type is emitted when a security assessment is finished refreshing.
Security Assessment Baseline Set Begin	`com.oraclecloud.datasafe.setsecurityassessmentbaseline.begin` The event type is emitted when a user sets a security assessment as a baseline.
Security Assessment Baseline Set End	`com.oraclecloud.datasafe.setsecurityassessmentbaseline.end` The event type is emitted when a set baseline operation on a security assessment is finished.
Security Assessment Baseline Unset Begin	`com.oraclecloud.datasafe.unsetsecurityassessmentbaseline.begin` The event type is emitted when a user unsets a security assessment as a baseline.
Security Assessment Baseline Unset End	`com.oraclecloud.datasafe.unsetsecurityassessmentbaseline.end` The event type is emitted when an unset baseline operation on a security assessment is finished.
Security Assessment Compare Begin	`com.oraclecloud.datasafe.comparesecurityassessment.begin` The event type is emitted when a user compares two security assessments.
Security Assessment Compare End	`com.oraclecloud.datasafe.comparesecurityassessment.end` The event type is emitted when a compare operation for two security assessments is finished.
Security Assessment Drift From Baseline	`com.oraclecloud.datasafe.securityassessmentdriftfrombaseline` The event type is emitted when a security assessment is compared with a baseline assessment and a difference is found.
Security Assessment Report Generate Begin	`com.oraclecloud.datasafe.generatesecurityassessmentreport.begin` The event type is emitted when a user requests to generate a security assessment report.
Security Assessment Report Generate End	`com.oraclecloud.datasafe.generatesecurityassessmentreport.end` The event type is emitted when an operation to generate a security assessment report is finished.
Security Assessment Report Download	`com.oraclecloud.datasafe.downloadsecurityassessmentreport` The event type is emitted when a user requests to download a security assessment report.
Security Assessment Finding Risk Update Begin	`com.oraclecloud.datasafe.updatefinding.begin` The event type is emitted when a user begins changing the risk for a finding.
Security Assessment Finding Risk Update End	`com.oraclecloud.datasafe.updatefinding.end` The event type is emitted when changing the risk for a finding is finished.

Note:

Any Oracle Data Safe event for User Assessment or Security Assessment that you created in the past that uses an old event type name, for example, com.oraclecloud.datasafe.securityassessmentrefresh.begin, needs to be dropped and recreated so that it uses the new friendly name, for example, Security Assessment Refresh Begin; otherwise, the event will not work.

Example 4-4 Notification Text for a Security Assessment Drift From Baseline Event Type

{
  "eventType": "com.oraclecloud.datasafe.securityassessmentdriftfrombaseline",
  "cloudEventsVersion": "0.1",
  "eventTypeVersion": "2.0",
  "source": "DataSafe",
  "eventTime": "2020-09-10T22:06:46.588Z",
  "contentType": "application/json",
  "data": {
    "compartmentId": "ocid1.tenancy.oc1..unique_ID",
    "compartmentName": "example-compartment",
    "resourceName": "securityAssessment",
    "resourceId": "ocid1.coreservicesworkrequest.oc1..unique_ID",
    "availabilityDomain": "ad1"
  },
  "eventID": "unique_ID",
  "extensions": {
    "compartmentId": "ocid1.tenancy.oc1..unique_ID"
  },
  "serviceName": "Data Safe",
  "displayName": "Security Assessment Drift From Baseline", 
  "additionalDetails": [{"name":"targetNames","value":["target1", "target2"]},{"name":"comparisonId","value": "<baseline_assessment_ID>"} ], 
  "timeCreated": "2020-09-10T22:06:48.011Z"
}

User Assessment Event Types

The following table describes event types for User Assessment in Oracle Data Safe.

Friendly Name	Event Type and Description
User Assessment Create Begin	`com.oraclecloud.datasafe.createuserassessment.begin` The event type is emitted when a user triggers a user assessment.
User Assessment Create End	`com.oraclecloud.datasafe.createuserassessment.end` The event type is emitted when a user assessment is finished creating.
User Assessment Refresh Begin	`com.oraclecloud.datasafe.refreshuserassessment.begin` The event type is emitted when a user refreshes a user assessment.
User Assessment Refresh End	`com.oraclecloud.datasafe.refreshuserassessment.end` The event type is emitted when a user assessment is finished refreshing.
User Assessment Baseline Set Begin	`com.oraclecloud.datasafe.setuserassessmentbaseline.begin` The event type is emitted when a user sets a user assessment as a baseline assessment.
User Assessment Baseline Set End	`com.oraclecloud.datasafe.setuserassessmentbaseline.end` The event type is emitted when a set baseline operation on a user assessment is finished.
User Assessment Baseline Unset Begin	`com.oraclecloud.datasafe.unsetuserassessmentbaseline.begin` The event type is emitted when a user unsets a user assessment as a baseline assessment.
User Assessment Baseline Unset End	`com.oraclecloud.datasafe.unsetuserassessmentbaseline.end` The event type is emitted when an unset baseline operation on a user assessment is finished.
User Assessment Compare Begin	`com.oraclecloud.datasafe.compareuserassessment.begin` The event type is emitted when a user compares two user assessments.
User Assessment Compare End	`com.oraclecloud.datasafe.compareuserassessment.end` The event type is emitted when a compare operation for two user assessments is finished.
User Assessment Drift From Baseline	`com.oraclecloud.datasafe.userassessmentdriftfrombaseline` The event type is emitted when a user assessment is compared with a baseline and a difference is found.
User Assessment Report Generate Begin	`com.oraclecloud.datasafe.generateuserassessmentreport.begin` The event type is emitted when a user requests to generate a user assessment report.
User Assessment Report Generate End	`com.oraclecloud.datasafe.generateuserassessmentreport.end` The event type is emitted when a user assessment report is generated.
User Assessment Report Download	`com.oraclecloud.datasafe.downloaduserassessmentreport` The event type is emitted when a user requests to download a user assessment report.
Security Policy Report Create Begin	`com.oraclecloud.datasafe.createsecuritypolicyreport.begin` The event type is emitted when a security policy report is being created.
Security Policy Report Create Complete	`com.oraclecloud.datasafe.createsecuritypolicyreport.end` The event type is emitted when security policy report creation is completed.
Security Policy Report Delete Begin	`com.oraclecloud.datasafe.deletesecuritypolicyreport.begin` The event type is emitted when a security policy report is being deleted by the system.
Security Policy Report Delete Complete	`com.oraclecloud.datasafe.deletesecuritypolicyreport.end` The event type is emitted when a security policy report deletion is completed.
Security Policy Report Refresh Begin	`com.oraclecloud.datasafe.refreshsecuritypolicyreport.begin` The event type is emitted when a security policy report is being refreshed.
Security Policy Report Refresh Complete	`com.oraclecloud.datasafe.refreshsecuritypolicyreport.end` The event type is emitted when a security policy report is refreshed.
User Assessment Password Expiry Date	`com.oraclecloud.datasafe.userassessmentpasswordexpirydate` This event is triggered twice: first when the user has fewer than 90 days remaining until password expiration, and again when fewer than 30 days remain.

Note:

Any Oracle Data Safe event for User Assessment or Security Assessment that you created in the past that uses an old event type name, for example, com.oraclecloud.datasafe.securityassessmentrefresh.begin, needs to be dropped and recreated so that it uses the new friendly name, for example, Security Assessment Refresh Begin; otherwise, the event will not work.

Example 4-5 Notification Text for a User Assessment Drift From Baseline Event Type

{
  "eventType": "com.oraclecloud.datasafe.userassessmentdriftfrombaseline",
  "cloudEventsVersion": "0.1",
  "eventTypeVersion": "2.0",
  "source": "DataSafe",
  "eventTime": "2020-09-10T22:06:46.588Z",
  "contentType": "application/json",
  "data": {
    "compartmentId": "ocid1.tenancy.oc1..unique_ID",
    "compartmentName": "example-compartment",
    "resourceName": "userAssessment",
    "resourceId": "ocid1.coreservicesworkrequest.oc1..unique_ID",
    "availabilityDomain": "ad1"
  },
  "eventID": "unique_ID",
  "extensions": {
    "compartmentId": "ocid1.tenancy.oc1..unique_ID"
  },
  "serviceName": "Data Safe",
  "displayName": "User Assessment Drift From Baseline", 
  "additionalDetails": [{"name":"targetNames","value":["target1", "target2"]},{"name":"comparisonId","value": "<baseline_assessment_ID>"} ], 
  "timeCreated": "2020-09-10T22:06:48.011Z"
}

Activity Auditing Event Types

The following table describes event types for Activity Auditing in Oracle Data Safe.

Friendly Name	Event Type and Description
Audit Archive Retrieval Create Begin	`com.oraclecloud.datasafe.createarchiveretrieval.begin` An event is emitted when an archive retrieval is started.
Audit Archive Retrieval Create End	`com.oraclecloud.datasafe.createarchiveretrieval.end` An event is emitted when an archive retrieval is finished.
Audit Archive Retrieval Delete Begin	`com.oraclecloud.datasafe.deletearchiveretrieval.begin` An event is emitted when an archive retrieval delete is started.
Audit Archive Retrieval Delete End	`com.oraclecloud.datasafe.deletearchiveretrieval.end` An event is emitted when an archive retrieval delete is finished.
Audit Events Post Retention Purge	`com.oraclecloud.datasafe.purgeretention` An event is emitted when the retention period for audit records is reached and the audit events are being deleted from Data Safe.
Audit Policy Provision Begin	`com.oraclecloud.datasafe.provisionauditpolicy.begin` An event is emitted when an audit policy provisioning is started.
Audit Policy Provision End	`com.oraclecloud.datasafe.provisionauditpolicy.end` An event is emitted when an audit policy provisioning ends.
Audit Profile Retention Update Begin	`com.oraclecloud.datasafe.changeretention.begin` An event is emitted when an audit retention update is started. Example, when online/offline audit data retention settings are being updated.
Audit Profile Retention Update End	`com.oraclecloud.datasafe.changeretention.end` An event is emitted when an audit retention update is completed. Example, when online/offline audit data retention settings are successfully updated.
Audit Policy Retrieve Begin	`com.oraclecloud.datasafe.retrieveauditpolicies.begin` An event is emitted when an audit policy retrieval is started.
Audit Policy Retrieve End	`com.oraclecloud.datasafe.retrieveauditpolicies.end` An event is emitted when an audit policy retrieval is finished.
Audit Profile Update Begin	`com.oraclecloud.datasafe.updateauditprofile.begin` An event is emitted when an audit profile update is started.
Audit Profile Update End	`com.oraclecloud.datasafe.updateauditprofile.end` An event is emitted when an audit profile update is completed.
Audit Trail Collection Free Limit Warning	`com.oraclecloud.datasafe.auditcollectionwarning` An event is emitted when an audit collection reaches 80% of the free limit.
Audit Trail Resume Begin	`com.oraclecloud.datasafe.resumeaudittrail.begin` An event is emitted when an audit trail resume begins.
Audit Trail Resume End	`com.oraclecloud.datasafe.resumeaudittrail.end` An event is emitted when an audit trail resume ends.
Audit Trail Start Begin	`com.oraclecloud.datasafe.startaudittrail.begin` An event is emitted when an audit trail start begins.
Audit Trail Start End	`com.oraclecloud.datasafe.startaudittrail.end` An event is emitted when an audit trail start ends.
Audit Trail Stop Begin	`com.oraclecloud.datasafe.stopaudittrail.begin` An event is emitted when an audit trail stop begins.
Audit Trail Stop End	`com.oraclecloud.datasafe.stopaudittrail.end` An event is emitted when an audit trail is stopped automatically or manually.
Audit Trail Update Begin	`com.oraclecloud.datasafe.updateaudittrail.begin` An event is emitted when audit trail update is started.
Audit Trail Update End	`com.oraclecloud.datasafe.updateaudittrail.end` An event is emitted when audit trail update is finished.
Report Generate Begin	`com.oraclecloud.datasafe.generatereport.begin` An event is emitted when a report generation is started.
Report Generate End	`com.oraclecloud.datasafe.generatereport.end` An event is emitted when a report generation is completed.
Report Schedule Begin	`com.oraclecloud.datasafe.schedulereport.begin` An event is emitted when a new report schedule is being created.
Report Schedule End	`com.oraclecloud.datasafe.schedulereport.end` An event is emitted when a new report schedule is created successfully.
Report Schedule Delete Begin	`com.oraclecloud.datasafe.removeschedulereport.begin` An event is emitted when report schedule delete is started.
Report Schedule Delete End	`com.oraclecloud.datasafe.removeschedulereport.end` An event is emitted when report schedule delete is completed.
Scheduled Report Generated	`com.oraclecloud.datasafe.scheduledreportcomplete` An event is emitted when a scheduled report is generated successfully.

Example 4-6 Notification text for the event type Audit Policy Provision Begin

{
  "eventType": "com.oraclecloud.datasafe.provisionauditpolicy.begin",
  "cloudEventsVersion": "0.1",
  "eventTypeVersion": "2.0",
  "source": "DataSafe",
  "eventTime": "2021-11-18T11:06:46.588Z",
  "contentType": "application/json",
  "data": {
    "compartmentId": "ocid1.tenancy.oc1..unique_ID",
    "compartmentName": "example-compartment",
    "resourceName": "auditPolicies",
    "resourceId": "ocid1.coreservicesworkrequest.oc1..unique_ID",
    "availabilityDomain": "ad1",
    "additionalDetails": {
      "targetId": "ocid1.datasafetargetdatabase.oc1..unique_ID"
    }
  },
  "eventID": "unique_ID",
  "extensions": {
    "compartmentId": "ocid1.tenancy.oc1..unique_ID"
  }
}

Alert Event Types

The following table describes event types for alerts in Oracle Data Safe.

Friendly Name	Event Type and Description
Alert Generated	`com.oraclecloud.datasafe.generateauditalert` An event is emitted when an audit alert is generated.
Alert Generation Throttled	`com.oraclecloud.datasafe.throttlealertgeneration` An event is emitted when alert generation has been temporarily disabled for the alert policy because it generated more alerts than the threshold of 1,000 per ten minutes.
Alert Policy Target Association Patch Begin	`com.oraclecloud.datasafe.patchtargetalertpolicyassociation.begin` An event is emitted when target alert policy associations are created or updated.
Alert Policy Target Association Patch End	`com.oraclecloud.datasafe.patchtargetalertpolicyassociation.end` An event is emitted when target alert policy associations updates have completed.
Alert UpdateAll Begin	`com.oraclecloud.datasafe.alertsupdate.begin` An event is emitted when Alert updateAll is started.
Alert UpdateAll End	`com.oraclecloud.datasafe.alertsupdate.end` An event is emitted when Alert updateAll is completed.
Create Alert Policy Begin	`com.oraclecloud.datasafe.createalertpolicy.begin` An event is emitted when creation of a custom alert policy is started.
Create Alert Policy End	`com.oraclecloud.datasafe.createalertpolicy.end` An event is emitted when creation of a custom alert policy is finished.
Create Alert Policy Rule Begin	`com.oraclecloud.datasafe.createalertpolicyrule.begin` An event is emitted when creation of a custom alert policy rule is started.
Create Alert Policy Rule End	`com.oraclecloud.datasafe.createalertpolicyrule.end` An event is emitted when creation of a custom alert policy rule is finished.
Delete Alert Policy Begin	`com.oraclecloud.datasafe.deletealertpolicy.begin` An event is emitted when deletion of a custom alert policy is started.
Delete Alert Policy End	`com.oraclecloud.datasafe.deletealertpolicy.end` An event is emitted when deletion of a custom alert policy is finished.
Delete Alert Policy Rule Begin	`com.oraclecloud.datasafe.deletealertpolicyrule.begin` An event is emitted when deletion of a custom alert policy rule is started.
Delete Alert Policy Rule End	`com.oraclecloud.datasafe.deletealertpolicyrule.end` An event is emitted when deletion of a custom alert policy rule is finished.
Update Alert Policy Begin	`com.oraclecloud.datasafe.updatealertpolicy.begin` An event is emitted when a custom alert policy update is started.
Update Alert Policy End	`com.oraclecloud.datasafe.updatealertpolicy.end` An event is emitted when a custom alert policy update is finished.
Update Alert Policy Rule Begin	`com.oraclecloud.datasafe.updatealertpolicyrule.begin` An event is emitted when a custom alert policy rule update is started.
Update Alert Policy Rule End	`com.oraclecloud.datasafe.updatealertpolicyrule.end` An event is emitted when a custom alert policy rule update is finished.

Example 4-7 Notification Text for an Audit Alert Generated Event Type

{
  "eventType": "com.oraclecloud.datasafe.generateauditalert",
  "cloudEventsVersion": "0.1",
  "eventTypeVersion": "2.0",
  "source": "DataSafe",
  "eventTime": "2020-09-29T16:03:41.293Z",
  "contentType": "application/json",
  "data": {
    "compartmentId": "ocid1.compartment.oc1..unique_ID",
    "compartmentName": "example_compartment",
    "resourceName": "alerts",
    "resourceId": "ocid1.datasafealert.oc1.phx.unique_ID",
    "availabilityDomain": "availability_domain",
    "additionalDetails": {
      "status": "OPEN",
      "displayName": "Failed logon by Admin user",
      "description": "Failed logon by Admin user was detected",
      "severity": "HIGH",
      "targetId": "ocid1.datasafetarget.oc1.phx.unique_ID",
      "targetName": "target_sa",
      "policyId": "ocid1.datasafealertpolicy.oc1.iad.unique_ID",
      "timeCreated": "2020-09-29T16:03:31.293Z",
      "timeUpdated": "2020-09-29T16:03:42.736Z",
      "osUserName": "dscs",
      "operationTime": "2020-09-29T15:29:51.404Z",
      "operation": "Login on target database",
      "operationStatus": "Success",
      "clientHostname": "jobsvm3002.jobsvm.stestvcn.oraclevcn.com",
      "clientIPs": "10.0.4.15,10.0.4.16,10.0.4.14",
      "clientId": "ORACLE$_DATA_SAFE#",
      "clientProgram": "JDBC Thin Client",
      "userName": "user1",
      "objectType": "UNIFIED_AUDIT_TRAIL",
      "commandText": "SELECT * FROM AUDSYS.UNIFIED_AUDIT_TRAIL WHERE \"EVENT_TIMESTAMP\"<=:1 AND \"EVENT_TIMESTAMP\">:2 \u0000",
      "commandParam": " #1(31):02-JUL-21 12.42.15.044000000 PM #2(31):02-JUL-21 12.34.22.509000000 PM"
    }
  },
  "eventID": "unique_ID",
  "extensions": {
    "compartmentId": "ocid1.compartment.oc1..unique_ID"
  }
}

Data Discovery Event Types

The following table describes event types for Data Discovery in Oracle Data Safe.

Friendly Name	Event Type and Description
Create Sensitive Type Group Begin	`com.oraclecloud.datasafe.createsensitivetypegroup.begin` The event type emits when a sensitive type group creation request is triggered.
Create Sensitive Type Group End	`com.oraclecloud.datasafe.createsensitivetypegroup.end` The event type emits when a sensitive type group creation request is completed
Delete Sensitive Type Group Begin	`com.oraclecloud.datasafe.deletesensitivetypegroup.begin` The event type emits when a sensitive type group delete request is triggered.
Delete Sensitive Type Group End	`com.oraclecloud.datasafe.deletesensitivetypegroup.end` The event type emits when a sensitive type group delete request is completed.
Patch Grouped Sensitive Types Begin	`com.oraclecloud.datasafe.patchgroupedsensitivetypes.begin` The event type emits when the request for a sensitive type to be added to or to be removed from a sensitive type group is triggered.
Patch Grouped Sensitive Types End	`com.oraclecloud.datasafe.patchgroupedsensitivetypes.end` The event type emits when the request for a sensitive type to be added to or to be removed from a sensitive type group is completed.
Referential Relations Create Begin	`com.oraclecloud.datasafe.CreateReferentialRelation.begin` The event type emits when a referential relation creation request in a sensitive data model is triggered.
Referential Relations Create End	`com.oraclecloud.datasafe.CreateReferentialRelation.end` The event type emits when a referential relation creation request in a sensitive data model is completed.
Referential Relations Delete Begin	`com.oraclecloud.datasafe.DeleteReferentialRelation.begin` The event type emits when a referential relation deletion request in a sensitive data model is triggered.
Referential Relations Delete End	`com.oraclecloud.datasafe.DeleteReferentialRelation.end` The event type emits when a referential relation deletion request in a sensitive data model is completed.
Sensitive Column Create Begin	`com.oraclecloud.datasafe.createsensitivecolumn.begin` The event type emits when a sensitive column creation request is triggered.
Sensitive Column Create End	`com.oraclecloud.datasafe.createsensitivecolumn.end` The event type emits when a sensitive column creation request is completed.
Sensitive Column Delete Begin	`com.oraclecloud.datasafe.deletesensitivecolumn.begin` The event type emits when a sensitive column delete request is triggered.
Sensitive Column Delete End	`com.oraclecloud.datasafe.deletesensitivecolumn.end` The event type emits when a sensitive column delete request is completed.
Sensitive Data Model Create Begin	`com.oraclecloud.datasafe.createsensitivedatamodel.begin` The event type emits when a sensitive data model creation request is triggered.
Sensitive Data Model Create End	`com.oraclecloud.datasafe.createsensitivedatamodel.end` The event type emits when a sensitive data model creation request is completed.
Sensitive Data Model Delete Begin	`com.oraclecloud.datasafe.deletesensitivedatamodel.begin` The event type emits when a sensitive data model deletion request is triggered.
Sensitive Data Model Delete End	`com.oraclecloud.datasafe.deletesensitivedatamodel.end` The event type emits when a sensitive data model deletion request is triggered.
Sensitive Data Model Update Begin	`com.oraclecloud.datasafe.updatesensitivedatamodel.begin` The event type emits when a sensitive data model update request is triggered.
Sensitive Data Model Update End	`com.oraclecloud.datasafe.updatesensitivedatamodel.end` The event type emits when a sensitive data model update request is completed.
Sensitive Discovery Job Create Begin	`com.oraclecloud.datasafe.creatediscoveryjob.begin` The event type emits when an incremental discovery job creation request is triggered.
Sensitive Discovery Job Create End	`com.oraclecloud.datasafe.creatediscoveryjob.end` The event type emits when an incremental discovery job creation request is completed.
Sensitive Type Create Begin	`com.oraclecloud.datasafe.createsensitivetype.begin` The event type emits when a sensitive type request is triggered.
Sensitive Type Create End	`com.oraclecloud.datasafe.createsensitivetype.end` The event type emits when a sensitive type creation request is completed.
Sensitive Type Delete	`com.oraclecloud.datasafe.deletesensitivetype` The event type emits when a sensitive type delete request is completed.
Sensitive Types Export Create Begin	`com.oraclecloud.datasafe.createsensitivetypesexport.begin` The event type is emitted when a sensitive types export resource creation request is triggered.
Sensitive Types Export Create End	`com.oraclecloud.datasafe.createsensitivetypesexport.end` The event type emits when a sensitive types export resource creation request is completed.
Sensitive Types Export Update Begin	`com.oraclecloud.datasafe.updatesensitivetypesexport.begin` The event type is emitted when a sensitive types export resource update request is triggered.
Sensitive Types Export Update End	`com.oraclecloud.datasafe.updatesensitivetypesexport.end` The event type is emitted when a sensitive types export resource update request is completed.
Sensitive Type Update Begin	`com.oraclecloud.datasafe.updatesensitivetype.begin` The event type emits when a sensitive type update request is triggered.
Sensitive Type Update End	`com.oraclecloud.datasafe.updatesensitivetype.end` The event type emits when a sensitive type update request is completed.
Update Sensitive Type Group Begin	`com.oraclecloud.datasafe.updatesensitivetypegroup.begin` The event type emits when a sensitive type group update request is triggered.
Update Sensitive Type Group End	`com.oraclecloud.datasafe.updatesensitivetypegroup.end` The event type emits when a sensitive type group update request is completed.

Example 4-8 Notification text for the event type Sensitive Type Create Begin

{
  "eventType": "com.oraclecloud.datasafe.createsensitivetype.begin",
  "cloudEventsVersion": "0.1",
  "eventTypeVersion": "2.0",
  "source": "DataSafe",
  "eventTime": "2021-11-18T11:06:46.588Z",
  "contentType": "application/json",
  "data": {
    "compartmentId": "ocid1.tenancy.oc1..unique_ID",
    "compartmentName": "example-compartment",
    "resourceName": "sensitiveTypes",
    "resourceId": "ocid1.coreservicesworkrequest.oc1..unique_ID",
    "availabilityDomain": "ad1",
  },
  "eventID": "unique_ID",
  "extensions": {
    "compartmentId": "ocid1.tenancy.oc1..unique_ID"
  }
}

Data Masking Event Types

The following table describes event types for Data Masking in Oracle Data Safe.

Friendly Name	Event Type and Description
Masking Column Delete	`com.oraclecloud.datasafe.deletemaskingcolumn` The event type emits when a masking column delete request is completed.
Masking Columns Patch Begin	`com.oraclecloud.datasafe.patchmaskingcolumns.begin` The event type emits when a masking columns patch request is triggered by a user.
Masking Columns Patch End	`com.oraclecloud.datasafe.patchmaskingcolumns.end` The event type emits when a masking columns patch request is completed.
Masking Health Check Begin	`com.oraclecloud.datasafe.generatehealthreport.begin` The event type emits when a masking policy health report creation request is triggered by a user.
Masking Health Check Delete Begin	`com.oraclecloud.datasafe.deletemaskingpolicyhealthreport.begin` The event type emits when a masking policy health report deletion request is triggered by a user.
Masking Health Check Delete End	`com.oraclecloud.datasafe.deletemaskingpolicyhealthreport.end` The event type emits when a masking policy health report deletion request is completed.
Masking Health Check End	`com.oraclecloud.datasafe.generatehealthreport.end` The event type emits when a masking policy health report creation request is completed.
Masking Job Begin	`com.oraclecloud.datasafe.mask.begin` The event type emits when a masking job creation request is triggered by a user.
Masking Job End	`com.oraclecloud.datasafe.mask.end` The event type emits when a masking job creation request is completed.
Masking Library Format Create Begin	`com.oraclecloud.datasafe.createlibrarymaskingformat.begin` The event type emits when a library masking format creation request is triggered by a user.
Masking Library Format Create End	`com.oraclecloud.datasafe.createlibrarymaskingformat.end` The event type emits when a library masking format creation request is completed.
Masking Library Format Delete	`com.oraclecloud.datasafe.deletelibrarymaskingformat` The event type emits when a library masking format delete request is completed.
Masking Library Format Update Begin	`com.oraclecloud.datasafe.updatelibrarymaskingformat.begin` The event type emits when a library masking format update request is triggered by a user.
Masking Library Format Update End	`com.oraclecloud.datasafe.updatelibrarymaskingformat.end` The event type emits when a library masking format update request is completed.
Masking Policy Create Begin	`com.oraclecloud.datasafe.createmaskingpolicy.begin` The event type emits when a masking policy creation request is triggered by a user.
Masking Policy Create End	`com.oraclecloud.datasafe.createmaskingpolicy.end` The event type emits when a masking policy creation request is completed.
Masking Policy Delete Begin	`com.oraclecloud.datasafe.deletemaskingpolicy.begin` The event type emits when a masking policy deletion request is triggered by a user.
Masking Policy Delete End	`com.oraclecloud.datasafe.deletemaskingpolicy.end` The event type emits when a masking policy deletion request is completed.
Masking Policy Update Begin	`com.oraclecloud.datasafe.updatemaskingpolicy.begin` The event type emits when a masking policy update request is triggered by a user.
Masking Policy Update End	`com.oraclecloud.datasafe.updatemaskingpolicy.end` The event type emits when a masking policy update request is completed.
Masking Report Delete Begin	`com.oraclecloud.datasafe.deletemaskingreport.begin` The event type emits when a masking report delete request is triggered by a user.
Masking Report Delete End	`com.oraclecloud.datasafe.deletemaskingreport.end` The event type emits when a masking report delete request is completed.

Example 4-9 Notification text for the event type Masking Library Format Create Begin

{
  "eventType": "com.oraclecloud.datasafe.createlibrarymaskingformat.begin",
  "cloudEventsVersion": "0.1",
  "eventTypeVersion": "2.0",
  "source": "DataSafe",
  "eventTime": "2021-11-18T11:06:46.588Z",
  "contentType": "application/json",
  "data": {
    "compartmentId": "ocid1.tenancy.oc1..unique_ID",
    "compartmentName": "example-compartment",
    "resourceName": "libraryMaskingFormats",
    "resourceId": "ocid1.coreservicesworkrequest.oc1..unique_ID",
    "availabilityDomain": "ad1",
  },
  "eventID": "unique_ID",
  "extensions": {
    "compartmentId": "ocid1.tenancy.oc1..unique_ID"
  }
}

SQL Firewall Event Types

The following table describes event types for SQL Firewall in Oracle Data Safe.

Friendly Name	Event Type and Description
Database Security Config Cleanup	`com.oraclecloud.datasafe.cleanupdatabasesecurityconfig` The event is emitted when a database security configuration is deleted.
Database Security Config Create Begin	`com.oraclecloud.datasafe.createdatabasesecurityconfig.begin` The event is emitted when a database security configuration is started.
Database Security Config Create End	`com.oraclecloud.datasafe.createdatabasesecurityconfig.end` The event is emitted when a database security configuration is finished.
Database Security Config Refresh Begin	`com.oraclecloud.datasafe.refreshdatabasesecurityconfig.begin` The event is emitted when a database security configuration refresh is started.
Database Security Config Refresh End	`com.oraclecloud.datasafe.refreshdatabasesecurityconfig.end` The event is emitted when a database security configuration refresh is finished.
Database Security Config Update Begin	`com.oraclecloud.datasafe.updatedatabasesecurityconfig.begin` The event is emitted when a database security configuration update is started.
Database Security Config Update End	`com.oraclecloud.datasafe.updatedatabasesecurityconfig.end` The event is emitted when a database security configuration update is finished.
Security Policy Auto Create	`com.oraclecloud.datasafe.autocreatesecuritypolicy` The event is emitted when a security policy is created by the system.
Security Policy Cleanup	`com.oraclecloud.datasafe.cleanupsecuritypolicy` The event is emitted when a security policy is deleted by the system.
Security Policy Deployment Auto Create	`com.oraclecloud.datasafe.autocreatesecuritydeploymentpolicy` The event is emitted when a security policy deployment is created by the system.
Security Policy Deployment Cleanup	`com.oraclecloud.datasafe.cleanupsecuritydeploymentpolicy` The event is emitted when a security policy deployment is deleted.
Security Policy Deployment Update Begin	`com.oraclecloud.datasafe.updatesecuritydeploymentpolicy.begin` This event is emitted when a security policy deployment update is started.
Security Policy Deployment Update End	`com.oraclecloud.datasafe.updatesecuritydeploymentpolicy.end` This event is emitted when a security policy deployment update is finished.
Security Policy Update Begin	`com.oraclecloud.datasafe.updatesecuritypolicy.begin` The event is emitted when a security policy update is started.
Security Policy Update End	`com.oraclecloud.datasafe.updatesecuritypolicy.end` This event is emitted when a security policy update is finished.
SQL Firewall Collection Auto Create	`com.oraclecloud.datasafe.autocreatesqlcollection` The event is emitted when a SQL Firewall collection is created by the system.
SQL Firewall Collection Cleanup	`com.oraclecloud.datasafe.cleanupsqlcollection` The event is emitted when a SQL Firewall collection is deleted by the system.
SQL Firewall Collection Create Begin	`com.oraclecloud.datasafe.createsqlcollection.begin` The event is emitted when creation of a SQL Firewall collection is started.
SQL Firewall Collection Create End	`com.oraclecloud.datasafe.createsqlcollection.end` The event is emitted when creation of a SQL Firewall collection is finished.
SQL Firewall Collection Delete Begin	`com.oraclecloud.datasafe.deletesqlcollection.begin` The event is emitted when deletion of a SQL Firewall collection is started.
SQL Firewall Collection Delete End	`com.oraclecloud.datasafe.deletesqlcollection.end` The event is emitted when deletion of a SQL Firewall collection is finished.
SQL Firewall Collection Insights Refresh Begin	`com.oraclecloud.datasafe.refreshsqlcollectionloginsights.begin` The event is emitted when a SQL Firewall collection insights refresh is started.
SQL Firewall Collection Insights Refresh End	`com.oraclecloud.datasafe.refreshsqlcollectionloginsights.end` The event is emitted when a SQL Firewall collection insights refresh is finished.
SQL Firewall Collection Logs Purge Begin	`com.oraclecloud.datasafe.purgesqlcollectionlogs.begin` The event is emitted when a SQL Firewall collection logs purge is started.
SQL Firewall Collection Logs Purge End	`com.oraclecloud.datasafe.purgesqlcollectionlogs.end` The event is emitted when a SQL Firewall collection logs purge is finished.
SQL Firewall Collection Start Begin	`com.oraclecloud.datasafe.startsqlcollection.begin` The event is emitted when a SQL Firewall collection is started.
SQL Firewall Collection Start End	`com.oraclecloud.datasafe.startsqlcollection.end` The event is emitted when a SQL Firewall collection is finished.
SQL Firewall Collection Stop Begin	`com.oraclecloud.datasafe.stopsqlcollection.begin` The event is emitted when a SQL Firewall collection stop is started.
SQL Firewall Collection Stop End	`com.oraclecloud.datasafe.stopsqlcollection.end` The event is emitted when a SQL Firewall collection stop is finished.
SQL Firewall Collection Update Begin	`com.oraclecloud.datasafe.updatesqlcollection.begin` This event is emitted when a SQL firewall collection update is started.
SQL Firewall Collection Update End	`com.oraclecloud.datasafe.updatesqlcollection.end` This event is emitted when a SQL Firewall collection update is finished.
SQL Firewall Policy Auto Create	`com.oraclecloud.datasafe.autocreatesqlfirewallpolicy` The event is emitted when a SQL Firewall policy is created by a system.
SQL Firewall Policy Cleanup	`com.oraclecloud.datasafe.cleanupsqlfirewallpolicy` The event is emitted when a SQL Firewall policy is deleted.
SQL Firewall Policy Delete Begin	`com.oraclecloud.datasafe.deletesqlfirewallpolicy.begin` The event is emitted when deletion for a SQL Firewall policy is started.
SQL Firewall Policy Delete End	`com.oraclecloud.datasafe.deletesqlfirewallpolicy.end` The event is emitted when deletion for a SQL Firewall policy is finished.
SQL Firewall Policy Generate Begin	`com.oraclecloud.datasafe.generatesqlfirewallpolicy.begin` The event is emitted when generation of a SQL Firewall policy is started.
SQL Firewall Policy Generate End	`com.oraclecloud.datasafe.generatesqlfirewallpolicy.end` The event is emitted when generation of a SQL Firewall policy is finished.
SQL Firewall Policy Update Begin	`com.oraclecloud.datasafe.updatesqlfirewallpolicy.begin` This event is emitted when a SQL Firewall policy update is started.
SQL Firewall Policy Update End	`com.oraclecloud.datasafe.updatesqlfirewallpolicy.end` This event is emitted when a SQL Firewall policy update is finished.