FREEDOM251

Freedom251 › Database Vulnerability Scanners

Oracle E-Business Suite Security Audit

Free plan Self-hosted

Visit Oracle E-Business Suite Security Audit Alternatives

Oracle E-Business Suite Security Audit's own site

What Oracle E-Business Suite Security Audit is

Oracle E-Business Suite Security Audit is an open-source scanner for reviewing Oracle E-Business Suite R12.x security. It runs against a live database or analyzes CSV exports, with coverage across user access, passwords, responsibilities, segregation of duties, concurrent programs, audit trails, database hardening, patching, workflow, privacy, and custom PL/SQL. The product page gives two different coverage totals: one section says 68 checks across 10 categories, while other sections describe 140 checks across 13 domains. It also describes 20 segregation-of-duties conflict pairs across financial and administrative responsibilities.

For live scans, it connects through the oracledb driver and uses read-only SELECT queries; access can be through APPS or a custom audit schema. Offline scans use Python’s standard library. Results can be produced in console, JSON, or self-contained HTML, with search and filtering in the HTML report. A SQL script exports about 45 CSV files for offline analysis, and JSON output is described as suitable for SIEM/GRC ingestion. Severity-based exit codes support CI/CD gating. Findings map to SOX, CIS Oracle Database Benchmark, NIST 800-53, PCI-DSS v4.0, HIPAA, ISO 27001, and DISA STIG. The project license is MIT.

Who it suits

The tool is intended for SOX auditors, IT risk teams, and Oracle E-Business Suite administrators reviewing R12.x security. It also suits teams that want offline CSV analysis or severity-based CI/CD gating.

What it does well

  • Runs live with read-only SELECT access or offline from CSV exports.
  • Covers access, passwords, database hardening, patching, privacy, and custom code.
  • Checks 20 segregation-of-duties conflict pairs.
  • Outputs console, JSON, and searchable, filterable HTML reports.
  • Supports CI/CD gating with severity-based exit codes.
  • Maps findings to several named compliance frameworks.

What to know first

  • Coverage totals conflict: 68 checks in one section and 140 in others.
  • Live scans require database connectivity through the oracledb driver.

Limits

The listed coverage count varies by section: the header and summary say 68 checks across 10 categories, while the overview and capabilities sections say 140 checks across 13 domains.

Getting started

  1. Visit the PhalanxCyber product page.
  2. Choose a live database scan or prepare CSV exports for offline analysis.
  3. For live scans, connect through oracledb using APPS or a custom audit schema with SELECT access.
  4. For offline analysis, use the SQL export script to produce CSV files.
  5. Review the console, JSON, or HTML report; use severity-based exit codes for CI/CD gating.

Verdict

Choose Oracle E-Business Suite Security Audit if you need an open-source scanner for Oracle E-Business Suite R12.x and want live or CSV-based assessment. Look elsewhere if a single, consistent published check count is essential before choosing a tool.

Questions

Is Oracle E-Business Suite Security Audit free?

Yes. Its pricing model is free, and the project is listed under the MIT license.

Can it scan without connecting to a live database?

Yes. It can analyze CSV exports using Python’s standard library.

What does a live scan require?

It connects through the oracledb driver and uses read-only SELECT queries. The page says it can connect as APPS or a custom audit schema.

What reports does it produce?

It produces console, JSON, and self-contained HTML reports. The HTML report includes search and filtering.

How many checks does it include?

The page gives conflicting totals: 68 checks across 10 categories in the header and summary, and 140 checks across 13 domains in other sections.

Who makes the tool?

PhalanxCyber describes itself as an open-source, not-for-profit cybersecurity community initiative.

Facts from Oracle E-Business Suite Security Audit's own pages

Check coverage
The product page gives conflicting counts: its summary says 68 checks across 10 categories, while the detailed overview says 140 checks across 13 domains. · phalanxcyber.ai, 7 Oct 2026
Compliance mapping
The page says findings map to SOX, CIS Oracle Database Benchmark, NIST 800-53, PCI-DSS v4.0, HIPAA, ISO 27001, and DISA STIG. · phalanxcyber.ai, 7 Oct 2026
Database permissions
The product page says the live scanner requires only SELECT access and can connect as APPS or a custom audit schema. · phalanxcyber.ai, 7 Oct 2026
Data export
A SQL export script produces about 45 CSV files for offline analysis; JSON output is described as suitable for SIEM/GRC ingestion. · phalanxcyber.ai, 7 Oct 2026
Data export integration
A SQL export script produces about 45 CSV files for offline analysis, and JSON reports are described as suitable for SIEM/GRC ingestion. · phalanxcyber.ai, 7 Oct 2026
Headquarters
Kolkata, India · phalanxcyber.ai, 28 Sept 2026
Intended users
The product page says the tool is built for SOX auditors, IT risk teams, and EBS administrators. · phalanxcyber.ai, 7 Oct 2026
License
The listed project license is MIT. · phalanxcyber.ai, 7 Oct 2026
Live mode
The live scanner connects to an Oracle database through the oracledb driver and uses read-only SELECT queries. · phalanxcyber.ai, 7 Oct 2026
Maker
PhalanxCyber describes itself as an open-source, not-for-profit cybersecurity community initiative; its founder bio identifies Krishnendu De and lists Kolkata, India. · phalanxcyber.ai, 7 Oct 2026
Offline mode
The offline scanner analyzes CSV exports using Python’s standard library with no additional dependencies. · phalanxcyber.ai, 7 Oct 2026
Pipeline integration
The scanner returns exit code 1 for CRITICAL or HIGH findings and supports severity thresholds for CI/CD gating. · phalanxcyber.ai, 7 Oct 2026
Purpose
The scanner audits Oracle E-Business Suite R12.x security using live database access or offline CSV exports. · phalanxcyber.ai, 7 Oct 2026
Reports
It produces console, JSON, and self-contained HTML reports, with filtering and search in the HTML report. · phalanxcyber.ai, 7 Oct 2026
Reports and integrations
It produces console, JSON, and self-contained HTML reports, and supports CI/CD gating through severity-based exit codes. · phalanxcyber.ai, 7 Oct 2026
Run modes
The live scanner connects to an EBS database using the oracledb driver; the offline scanner analyzes CSV exports using only the Python standard library. · phalanxcyber.ai, 7 Oct 2026
Scan coverage
The page describes 140 checks across 13 domains, including user access, passwords, segregation of duties, database hardening, patching, privacy, and custom code. · phalanxcyber.ai, 7 Oct 2026
Security coverage
Checks cover user access, passwords, responsibilities, segregation of duties, concurrent programs, audit trail, database hardening, patching, workflow, privacy, and custom PL/SQL. · phalanxcyber.ai, 7 Oct 2026
Segregation of duties
The scanner detects 20 segregation-of-duties conflict pairs across financial and administrative responsibilities. · phalanxcyber.ai, 7 Oct 2026
SoD checks
It checks 20 segregation-of-duties conflict pairs across financial and other business modules. · phalanxcyber.ai, 7 Oct 2026
Support
The founder page invites visitors to email Krishnendu De and says he will try to respond. · phalanxcyber.ai, 7 Oct 2026
Version and count discrepancy
The page header lists 68 checks across 10 domains, while its overview and capabilities sections list 140 checks across 13 domains. · phalanxcyber.ai, 7 Oct 2026

Where Oracle E-Business Suite Security Audit stands on Freedom251

Look at these too