Create and define a custom vulnerability assessment test

On the VA Tests page, click Create New VA Test.

In the Test Name field, enter a name for the test.

The name entered clearly reflects the nature of the test.

From the Result Type drop-down list, select the type of test results to return.

In the Test field, enter the test parameters in SQL command format.

For example, this DBMS Result Set test would return a list of users granted the DBA role when run on an Oracle database:

select * from dba_role_privs where granted_role = 'DBA'

This Yes/No command would return a Yes result if dynamic SQL is detected in Oracle outside of SYS:

select 'yes' from dual where exists (select 1 from dba_source where upper(text) like '%EXECUTE IMMEDIATE%' and owner <> 'SYS');

From the Level drop-down list, select the level of severity to assign to test results.

From the Test Category drop-down list, select Custom or Data Discovery.

Data Discovery is used when the rule is designed to discover particular tables or columns in the database. Choosing this category is essential so that you can later turn the results into rule objects.

In the Test Groups field, enter the test groups name or enter a space in the field to select test groups from the drop-down list.

In the System Test Groups, under All System Groups list, select one or more test groups to include in the operating system test, then click to move them to the Selected System Groups list.

Note

To remove a test group from the Selected System Groups list, select it, then click to move it to the All System Groups list.

(Optional) To exclude the test from running on one or more DBMSs, click Remove test from DBMS, then select the DBMSs to exclude. Click Select.

(Optional) Select the Report test failures to VA scan error log.

(Optional) In the Description field, enter a free text/description or test.

(Optional) In the Memo field, add a advisory memo or an action note.

Click Save.