EBS User Activity Monitoring: Tracking Data Export and Geolocation with Blitz Report

Customer September 18, 2025 at 6:29 pm

In light of modern compliance requirements and increasing data security concerns, our auditors require enhanced User Activity Monitoring focused specifically on data export volumes to assess potential data exfiltration risks. Since many users rely on faster tools like Blitz Report for mass data extraction, we need a method to accurately track *who* is performing high-volume exports, *when* they are doing it, and *from where*. Can Oracle EBS native capabilities or an integrated tool provide granular monitoring of these export activities, including user geolocation and IP address information, for effective auditing?

Viewing 6 reply threads

Author
Replies
- Support September 18, 2025 at 11:57 pm
  Effective data exfiltration risk management requires logging session and activity metadata. For EBS versions 12.2.10 and higher, the `fnd_logins` table includes a ‘clientip’ column, making IP address tracking straightforward. Blitz Report leverages this, offering the ‘FND User Login History with Geolocation’ report to track and visualize login activity.
- Customer September 19, 2025 at 4:48 am
  The ability to track IP and login location is useful, but how can we correlate that information with the volume of data extracted, for example, identifying users running mass export reports?
- Support September 19, 2025 at 8:01 am
  Since all Blitz Reports execute via the concurrent manager, monitoring tools focused on concurrent request volume or output file size can provide the necessary correlation. The Blitz Report FND Concurrent Requests report can be tailored to analyze execution history and potential high-volume outputs.
- Customer September 19, 2025 at 10:14 am
  We need to visualize this global user activity for our security dashboard. Does the Blitz Report tool assist in presenting geolocation data visually, perhaps on a map format?
- Support September 19, 2025 at 3:01 pm
  Yes, the geolocation reports, such as the FND User Login History with Geolocation, can utilize Blitz Report’s pivot functionality to aggregate data by city and country. The output can be exported to Excel and linked directly to tools like Excel Bing Maps for immediate geolocation tracking and visualization of user access spread.
- Customer September 19, 2025 at 5:54 pm
  If we implement a custom PL/SQL function to perform external lookups based on the user’s IP address (e.g., using a free geolocation API), does the Blitz framework easily integrate and cache the results?
- Support September 19, 2025 at 9:51 pm
  Yes, custom PL/SQL functions, like `xxen_geolocation`, can be created to query external APIs using IP addresses from the `fnd_logins` table. The PL/SQL function can leverage Oracle’s result cache feature, ensuring that repeat lookups for the same IP/geolocation data are retrieved rapidly for efficient report execution.
Author
Replies

Viewing 6 reply threads

You must be logged in to reply to this post.