Oracle E-Business Suite Security Audit
Oracle E-Business Suite Security Audit is a free, open-source scanner for reviewing Oracle E-Business Suite R12.x security.
What Oracle E-Business Suite Security Audit is
Oracle E-Business Suite Security Audit is a free, open-source scanner for reviewing Oracle E-Business Suite R12.x security. It works against a live database or from offline CSV exports. Listed coverage includes users, passwords, responsibilities, segregation of duties, concurrent programs, audit trails, database hardening, patching, workflow, privacy, and custom PL/SQL. The project describes 20 segregation-of-duties conflict pairs across financial and administrative responsibilities. Its page gives conflicting totals: the header and summary state 68 checks across 10 categories, while detailed sections state 140 checks across 13 domains. Live mode uses the oracledb driver and read-only SELECT queries, with APPS or a custom audit schema permitted. Offline mode uses Python’s standard library. Reports are available in console, JSON, and self-contained HTML formats, with HTML filtering and search. A SQL script creates about 45 CSV files for offline work. Severity-based exit codes support CI/CD gating, and JSON can feed SIEM or GRC systems. Findings map to several compliance frameworks, and the MIT license is listed.
Good
- Free MIT-licensed open-source project
- Live and offline scanning modes
- Read-only database access
- Console, JSON, and HTML reports
- CI/CD severity gating
Watch out
- Coverage totals conflict across the product page
- Offline mode requires CSV exports
- On-premises deployment only
- Live scanning requires database access
Who it suits
It is aimed at SOX auditors, IT risk teams, and Oracle E-Business Suite administrators. Teams needing agentless, on-premises assessment with compliance mapping and pipeline gating may find its listed approach suitable.
Verdict
Oracle E-Business Suite Security Audit offers broad review modes and report outputs without a listed charge. The inconsistent check counts should be clarified before using its coverage claims for audit planning.
The facts
Each one read from Oracle E-Business Suite Security Audit's own pages, with the date it was checked.
What it does
- Check coverage
- The product page gives conflicting counts: its summary says 68 checks across 10 categories, while the detailed overview says 140 checks across 13 domains.checked 7 Oct 2026
- Database permissions
- The product page says the live scanner requires only SELECT access and can connect as APPS or a custom audit schema.checked 7 Oct 2026
- Data export
- A SQL export script produces about 45 CSV files for offline analysis; JSON output is described as suitable for SIEM/GRC ingestion.checked 7 Oct 2026
- Data export integration
- A SQL export script produces about 45 CSV files for offline analysis, and JSON reports are described as suitable for SIEM/GRC ingestion.checked 7 Oct 2026
- Intended users
- The product page says the tool is built for SOX auditors, IT risk teams, and EBS administrators.checked 7 Oct 2026
- License
- The listed project license is MIT.checked 7 Oct 2026
- Live mode
- The live scanner connects to an Oracle database through the oracledb driver and uses read-only SELECT queries.checked 7 Oct 2026
- Offline mode
- The offline scanner analyzes CSV exports using Python’s standard library with no additional dependencies.checked 7 Oct 2026
- Pipeline integration
- The scanner returns exit code 1 for CRITICAL or HIGH findings and supports severity thresholds for CI/CD gating.checked 7 Oct 2026
- Purpose
- The scanner audits Oracle E-Business Suite R12.x security using live database access or offline CSV exports.checked 7 Oct 2026
- Reports
- It produces console, JSON, and self-contained HTML reports, with filtering and search in the HTML report.checked 7 Oct 2026
- Reports and integrations
- It produces console, JSON, and self-contained HTML reports, and supports CI/CD gating through severity-based exit codes.checked 7 Oct 2026
- Run modes
- The live scanner connects to an EBS database using the oracledb driver; the offline scanner analyzes CSV exports using only the Python standard library.checked 7 Oct 2026
- Scan coverage
- The page describes 140 checks across 13 domains, including user access, passwords, segregation of duties, database hardening, patching, privacy, and custom code.checked 7 Oct 2026
- Security coverage
- Checks cover user access, passwords, responsibilities, segregation of duties, concurrent programs, audit trail, database hardening, patching, workflow, privacy, and custom PL/SQL.checked 7 Oct 2026
- Segregation of duties
- The scanner detects 20 segregation-of-duties conflict pairs across financial and administrative responsibilities.checked 7 Oct 2026
- SoD checks
- It checks 20 segregation-of-duties conflict pairs across financial and other business modules.checked 7 Oct 2026
- Support
- The founder page invites visitors to email Krishnendu De and says he will try to respond.checked 7 Oct 2026
- Version and count discrepancy
- The page header lists 68 checks across 10 domains, while its overview and capabilities sections list 140 checks across 13 domains.checked 7 Oct 2026
Where it runs
- Compliance mapping
- The page says findings map to SOX, CIS Oracle Database Benchmark, NIST 800-53, PCI-DSS v4.0, HIPAA, ISO 27001, and DISA STIG.checked 7 Oct 2026
The company
- Headquarters
- Kolkata, Indiachecked 28 Sep 2026
- Maker
- PhalanxCyber describes itself as an open-source, not-for-profit cybersecurity community initiative; its founder bio identifies Krishnendu De and lists Kolkata, India.checked 7 Oct 2026
Alternatives to Oracle E-Business Suite Security Audit
- 1
CIS-CAT Pro Assessor
Free planAPILinuxmacOSSelf-hosted7.7From $2,400 a year - 2
Microsoft Defender for Business
AndroidiOSAPImacOS7.5 - 3
DBX
Free planWeb7.2$19 one-time - 4
LevelBlue AppDetectivePRO
WebSelf-hostedWindows6.9 - 5
Defensia Database Security
Free planWebLinuxSelf-hosted6.7From €9 a month - 6
Onam Database Security
Free planWebAPISelf-hosted6.5From $22 a month