Ensure All Auditable System Actions Commands Are Audited

out=$(sqlplus -S -L / as sysdba 2>/dev/null <<'EOF'
whenever sqlerror exit failure
set heading off feedback off pagesize 0 verify off echo off trimspool on define off
with privs(privilege) as (
  select distinct a.privilege from dba_sys_privs a
  where a.privilege not in (select name from auditable_system_actions where component = 'Standard')
  and a.privilege not in ('INHERIT ANY PRIVILEGES')
  union
  select a.name from auditable_system_actions a where a.component = 'Standard'
  and a.name not in ('ALL','SELECT','DELETE','INSERT','UPDATE','EXECUTE','LOGON','LOGOFF')
),
cis_audit(con_id, audit_option) as (select c.con_id, ll.privilege from v$containers c, privs ll where c.open_mode = 'READ WRITE'),
audit_enabled as (
  select distinct aud.con_id, aud.audit_option from containers(audit_unified_policies) aud
  where aud.audit_option in (select privilege from privs)
  and aud.audit_option_type in ('SYSTEM PRIVILEGE','STANDARD ACTION')
  and exists (select 1 from containers(audit_unified_enabled_policies) e
    where e.success = 'YES' and e.failure = 'YES' and e.enabled_option = 'BY USER' and e.entity_name = 'ALL USERS'
    and e.policy_name = aud.policy_name and e.con_id = aud.con_id)
)
select count(*) from cis_audit c
where not exists (select 1 from audit_enabled e where e.audit_option = c.audit_option and e.con_id = c.con_id);
exit
EOF
) || exit 1
printf '%s\n' "$out"

tmaegis scan --target oracle-db