Ensure the 'LOGON' AND 'LOGOFF' Actions Audit Is Enabled

out=$(sqlplus -S -L / as sysdba 2>/dev/null <<'EOF'
whenever sqlerror exit failure
set heading off feedback off pagesize 0 verify off echo off trimspool on define off
with cis_audit(con_id, audit_option) as (
  select c.con_id, ll.column_value from v$containers c, table(dbmsoutput_linesarray('LOGON','LOGOFF')) ll where c.open_mode = 'READ WRITE'),
audit_enabled as (
  select distinct aud.con_id, aud.audit_option from containers(audit_unified_policies) aud
  where aud.audit_option in ('LOGON','LOGOFF') and aud.audit_option_type = 'STANDARD ACTION'
  and exists (select 1 from containers(audit_unified_enabled_policies) e
    where e.success = 'YES' and e.failure = 'YES' and e.enabled_option = 'BY USER' and e.entity_name = 'ALL USERS'
    and e.policy_name = aud.policy_name and e.con_id = aud.con_id)
)
select count(*) from cis_audit c
where not exists (select 1 from audit_enabled e where e.audit_option = c.audit_option and e.con_id = c.con_id);
exit
EOF
) || exit 1
printf '%s\n' "$out"

tmaegis scan --target oracle-db