OracleDBAudit - Query on Sensitive Table

let sensitive_tbls = dynamic(['table_name1', 'table_name2']);
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where isnotempty(Action)
| extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
| where isnotempty(TableName)
| where TableName in (sensitive_tbls)
| project TableName, DstUserName, DbAction
| extend AccountCustomEntity = DstUserName

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditQueryOnSensitiveTable.yaml
query: |
  let sensitive_tbls = dynamic(['table_name1', 'table_name2']);
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
  | where isnotempty(TableName)
  | where TableName in (sensitive_tbls)
  | project TableName, DstUserName, DbAction
  | extend AccountCustomEntity = DstUserName  
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
kind: Scheduled
triggerOperator: gt
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
tactics:
- Collection
triggerThreshold: 0
description: |
    'Detects when user queries sensitive tables.'
queryPeriod: 30m
version: 1.0.3
queryFrequency: 30m
severity: Medium
name: OracleDBAudit - Query on Sensitive Table
id: d7fdcad5-ce96-4db6-9a5e-4a86a5166e5e
status: Available
relevantTechniques:
- T1005