Documentation

1. Purpose

This guide describes how to configure Oracle Database so the CBOM Database TDE sensor (Discover_DB) can discover Transparent Data Encryption (TDE) assets in a read-only, non-intrusive manner.

The CBOM Discover_DB sensor queries Oracle data dictionary views to enumerate the following cryptographic material:

TDE wallet keys — master encryption key metadata exposed through V$ENCRYPTION_KEYS and V$ENCRYPTION_WALLET
Encrypted tablespaces — tablespace-level encryption status and algorithm via V$ENCRYPTED_TABLESPACES
Encrypted columns — column-level encryption metadata via DBA_ENCRYPTED_COLUMNS

The sensor reads key metadata only. It never extracts raw key material, wallet passwords, or plaintext data. All access is performed through a dedicated, least-privilege database account created specifically for CBOM.

2. Prerequisites

Before starting, ensure the following are in place:

Oracle Database 12c Release 2 (12.2) or later is running and accessible from the CBOM sensor host.
TDE is enabled on the target Oracle instance. The wallet must be open (V$ENCRYPTION_WALLET.STATUS = 'OPEN' or 'OPEN_NO_MASTER_KEY').
You have access to a DBA-privileged account (e.g., SYS AS SYSDBA or a user granted DBA) to create the reader account and assign grants.
The CBOM sensor host can reach the Oracle listener port (default: 1521) over the network. Verify connectivity:
```
telnet <oracle-host> 1521
```
The Oracle JDBC thin driver JAR (ojdbc8.jar or ojdbc11.jar) is available on the CBOM sensor host if the sensor uses a JDBC connection. Confirm the driver version matches the Oracle Database version.
The Oracle service name or SID for the target database is known. Retrieve it if needed:
```
SELECT VALUE FROM V$PARAMETER WHERE NAME = 'service_names';
```

3. Create the CBOM Reader Database User

The CBOM sensor requires a dedicated Oracle database user with read-only access to TDE-related data dictionary views. Follow the steps below while connected as a DBA-privileged user.

3.1 Connect to the Database as a Privileged User

Connect to the target Oracle instance using SQL*Plus or another SQL client:

sqlplus sys/<sys_password>@//<oracle-host>:1521/<service_name> AS SYSDBA

For a pluggable database (PDB) in a container database (CDB) environment, connect to the specific PDB:

sqlplus sys/<sys_password>@//<oracle-host>:1521/<pdb_service_name> AS SYSDBA

3.2 Create the Reader Account

Run the following statement to create the CBOM reader user. Replace <strong_password> with a password that meets your organization's complexity policy:

CREATE USER cbom_reader IDENTIFIED BY "<strong_password>"
    DEFAULT TABLESPACE USERS
    TEMPORARY TABLESPACE TEMP
    ACCOUNT UNLOCK;

Grant the minimum session privilege required to log in:

GRANT CREATE SESSION TO cbom_reader;

4. Grant Required Privileges

The CBOM sensor requires SELECT access on specific dynamic performance views and data dictionary objects related to TDE. Grant each privilege individually to maintain least-privilege access.

4.1 Grant SELECT on TDE Dynamic Performance Views

GRANT SELECT ON V_$ENCRYPTION_WALLET      TO cbom_reader;
GRANT SELECT ON V_$ENCRYPTED_TABLESPACES  TO cbom_reader;
GRANT SELECT ON V_$ENCRYPTION_KEYS        TO cbom_reader;

Note: Dynamic performance views (V$) must be granted using the underlying synonym V_$<view_name>. Granting directly on V$<view_name> will return ORA-02030.

4.2 Grant SELECT on Data Dictionary Views

GRANT SELECT ON DBA_ENCRYPTED_COLUMNS TO cbom_reader;

4.3 Grant SELECT_CATALOG_ROLE

Grant the SELECT_CATALOG_ROLE role to allow the sensor to query additional data dictionary metadata as needed:

GRANT SELECT_CATALOG_ROLE TO cbom_reader;

4.4 Verify Granted Privileges

Confirm all privileges are assigned correctly:

SELECT PRIVILEGE, TABLE_NAME
FROM   DBA_TAB_PRIVS
WHERE  GRANTEE = 'CBOM_READER'
ORDER  BY TABLE_NAME;

SELECT GRANTED_ROLE
FROM   DBA_ROLE_PRIVS
WHERE  GRANTEE = 'CBOM_READER';

5. Verify Reader Account Access

Log in as cbom_reader and run a test query against each required view to confirm that access is working before configuring the sensor.

5.1 Test Wallet Status

sqlplus cbom_reader/<strong_password>@//<oracle-host>:1521/<service_name>

SELECT * FROM V$ENCRYPTION_WALLET;

Expected output includes columns WRL_TYPE, WRL_PARAMETER, STATUS, WALLET_TYPE, and KEYSTORE_MODE. A STATUS of OPEN or OPEN_NO_MASTER_KEY confirms the wallet is accessible.

5.2 Test Encrypted Tablespaces View

SELECT TABLESPACE_NAME, ENCRYPTEDTS, ENCRYPTIONALG, STATUS
FROM   V$ENCRYPTED_TABLESPACES;

5.3 Test Encryption Keys View

SELECT KEY_ID, CREATION_TIME, CREATOR, CREATOR_DBNAME, ACTIVATING_DBNAME
FROM   V$ENCRYPTION_KEYS;

5.4 Test Encrypted Columns View

SELECT OWNER, TABLE_NAME, COLUMN_NAME, ENCRYPTION_ALG, SALT
FROM   DBA_ENCRYPTED_COLUMNS
FETCH  FIRST 10 ROWS ONLY;

All four queries must return results without ORA- errors before proceeding to sensor configuration.

6. Configure CBOM Sensor

Add the Oracle TDE sensor configuration to the CBOM sensor configuration file. Replace all placeholder values with those matching your environment.

sensors:
  - name: Discover_DB
    type: oracle_tde
    enabled: true
    schedule: "0 2 * * *"          # Run daily at 02:00 UTC
    connection:
      host: "oracle-db.internal.example.com"
      port: 1521
      service_name: "ORCLPDB1"     # Use service_name OR sid, not both
      # sid: "ORCL"                # Uncomment if using SID instead of service_name
      username: "cbom_reader"
      password: "${CBOM_ORACLE_PASSWORD}"   # Inject via environment variable or secrets manager
      connection_timeout_seconds: 30
      query_timeout_seconds: 120
      ssl:
        enabled: true
        wallet_path: "/opt/cbom/oracle/wallet"   # Path to Oracle wallet for SSL (if required)
        server_dn: "CN=oracle-db.internal.example.com,OU=DB,O=Example,C=US"
    discovery:
      include_encrypted_tablespaces: true
      include_encrypted_columns: true
      include_wallet_keys: true
      column_sample_limit: 1000    # Max number of encrypted columns to enumerate per run
    output:
      cbom_tag: "oracle-tde"
      asset_labels:
        environment: "production"
        team: "database-ops"
        region: "us-east-1"
    logging:
      level: "INFO"
      log_file: "/var/log/cbom/oracle_tde_sensor.log"

Security note: Never hard-code the database password in the configuration file. Use the ${CBOM_ORACLE_PASSWORD} environment variable or integrate with your secrets manager (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault).

7. Validation

After saving the sensor configuration, run the sensor in dry-run mode to confirm connectivity and discovery without writing results to the CBOM inventory:

cbom-sensor run --sensor Discover_DB --dry-run --log-level DEBUG

A successful run produces output similar to:

[INFO]  Connecting to oracle-db.internal.example.com:1521/ORCLPDB1 as cbom_reader
[INFO]  Connection established. Oracle version: Oracle Database 19c Enterprise Edition
[INFO]  Querying V$ENCRYPTION_WALLET ... 1 row(s) returned
[INFO]  Querying V$ENCRYPTED_TABLESPACES ... 4 row(s) returned
[INFO]  Querying V$ENCRYPTION_KEYS ... 2 row(s) returned
[INFO]  Querying DBA_ENCRYPTED_COLUMNS ... 38 row(s) returned
[INFO]  Discovery complete. 45 cryptographic asset(s) identified (dry-run, not persisted).

To run the sensor in production mode and persist results to the CBOM inventory:

cbom-sensor run --sensor Discover_DB

Verify assets appear in the CBOM dashboard under Inventory > Database > Oracle TDE.

8. Common Errors and Resolution

Error 1: ORA-01031 — Insufficient Privileges

ORA-01031: insufficient privileges

Cause: The cbom_reader account lacks SELECT access on one or more required views. This commonly occurs when the grant was issued on V$ENCRYPTION_WALLET instead of V_$ENCRYPTION_WALLET.

Resolution: Re-issue the grant using the correct underlying object name:

GRANT SELECT ON V_$ENCRYPTION_WALLET     TO cbom_reader;
GRANT SELECT ON V_$ENCRYPTED_TABLESPACES TO cbom_reader;
GRANT SELECT ON V_$ENCRYPTION_KEYS       TO cbom_reader;

Confirm with:

SELECT * FROM SESSION_PRIVS;   -- run as cbom_reader

Error 2: ORA-28365 — Wallet Is Not Open

ORA-28365: wallet is not open

Cause: The TDE wallet on the Oracle instance is closed. Queries against V$ENCRYPTION_KEYS and related views require the wallet to be in an OPEN state.

Resolution: Ask a DBA to open the wallet. For a software keystore:

ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN
    IDENTIFIED BY "<wallet_password>"
    CONTAINER = CURRENT;

For auto-login wallets, verify that the cwallet.sso file is present in the wallet directory and that the Oracle instance restarted correctly. After opening, re-run the sensor validation query:

SELECT STATUS FROM V$ENCRYPTION_WALLET;

Error 3: IO Error — The Network Adapter Could Not Establish the Connection

IO Error: The Network Adapter could not establish the connection

Cause: The CBOM sensor host cannot reach the Oracle listener on the configured host and port. This can be caused by an incorrect hostname, a firewall rule blocking port 1521, or the Oracle listener not running.

Resolution:

Verify the listener is running on the Oracle host:
```
lsnrctl status
```
Confirm the CBOM sensor host can reach the Oracle listener port:
```
telnet oracle-db.internal.example.com 1521
```
Check firewall and security group rules to ensure TCP port 1521 (or the custom listener port) is open between the sensor host and the Oracle host.
Confirm the host, port, and service_name values in the sensor configuration match the output of lsnrctl status.

9. Security Recommendations

Use a dedicated, least-privilege account. The cbom_reader account should be used exclusively for CBOM sensor access. Do not reuse application accounts or DBA accounts.
Rotate the reader account password regularly. Enforce password rotation every 90 days in line with your organization's policy. Update the corresponding secret in your secrets manager and redeploy the sensor configuration without downtime.
Restrict network access to the Oracle listener. Use Oracle Net firewall rules or infrastructure-level security groups to allow connections on port 1521 only from the CBOM sensor host IP address.
Enable Oracle Unified Auditing for the reader account. Audit all SELECT activity performed by cbom_reader to maintain a complete activity trail:
```
AUDIT SELECT ON V_$ENCRYPTION_WALLET BY cbom_reader BY ACCESS;
```
Do not grant DBA or any write privileges. The cbom_reader account must never be granted DBA, INSERT, UPDATE, DELETE, DROP, or ALTER privileges. Regularly review grants using DBA_TAB_PRIVS and DBA_ROLE_PRIVS to detect privilege creep.

10. Conclusion

This guide has walked through the complete setup required to integrate Oracle Database Transparent Data Encryption with the CBOM Discover_DB sensor, including reader account creation, privilege grants, connectivity verification, sensor configuration, and validation. The sensor operates in a fully read-only mode, querying Oracle data dictionary views to build a continuous inventory of TDE keys, encrypted tablespaces, and encrypted columns without ever accessing raw key material. Once configured, the sensor runs on a schedule and feeds discovered cryptographic assets into the CBOM inventory, giving your security team ongoing visibility into Oracle TDE posture across your database fleet.

CBOM Secure

Oracle Database Setup Guide for CBOM Database TDE Sensor