Ensure The Use Of SYS* Privileges Is Audited

out=$(sqlplus -S -L / as sysdba 2>/dev/null <<'EOF'
whenever sqlerror exit failure
set heading off feedback off pagesize 0 verify off echo off trimspool on define off
with cis_audit(con_id, audit_option, entity_name_expected) as (
  select c.con_id, 'ALL', ll.column_value from v$containers c,
  table(dbmsoutput_linesarray('SYS','SYSBACKUP','SYSDG','SYSKM','SYSRAC','PUBLIC')) ll where c.open_mode = 'READ WRITE'),
audit_enabled as (
  select distinct aud.con_id, aud.audit_option, e.entity_name
  from containers(audit_unified_policies) aud, containers(audit_unified_enabled_policies) e
  where e.con_id = aud.con_id and e.policy_name = aud.policy_name
  and aud.audit_option in ('ALL') and aud.audit_option_type = 'STANDARD ACTION'
  and e.success = 'YES' and e.failure = 'YES' and e.enabled_option = 'BY USER'
  and e.entity_name in ('SYS','SYSBACKUP','SYSDG','SYSKM','SYSRAC','PUBLIC')
)
select count(*) from cis_audit c
where not exists (select 1 from audit_enabled e where e.audit_option = c.audit_option
  and e.entity_name = c.entity_name_expected and e.con_id = c.con_id);
exit
EOF
) || exit 1
printf '%s\n' "$out"

tmaegis scan --target oracle-db