Oracle Audit Vault and Database Firewall: Features and Alternatives

Vendor

Oracle

Price

Paid

Platforms

Self-managed appliance (on premises), Oracle Cloud Infrastructure (marketplace image), Hybrid cloud

Licence

Commercial Oracle licence

Product type

Commercial software appliance (Oracle licence)

Official site

docs.oracle.com/en/database/oracle/audit-vault-database-firewall/20

Works with

Oracle DatabaseSQL ServerSybase ASEDb2 for LUWMySQLMongoDB (Quick JSON collection)Oracle Key VaultOperating system audit filesCustom sources via the AVDF SDK

At a glance

Supported databases	Oracle Database, SQL Server, Sybase ASE, Db2 for LUW, MySQL; MongoDB via Quick JSON
Auditing and activity monitoring	Yes: audit trail consolidation plus network SQL monitoring
Masking	Not part of AVDF
Encryption or tokenization	Not part of AVDF (collects Oracle Key Vault events)
Privileged access	Audits privileged activity and entitlements; not a password vault
Policy enforcement	Database Firewall monitoring-and-blocking mode
Compliance reporting	Built-in and scheduled reports; STIG-compliant configuration
Deployment	Self-managed appliance on premises, OCI marketplace image, hybrid cloud
Licensing	Commercial Oracle licence; price and metric not verified (oracle.com not readable)
Release cadence	Quarterly release updates; 20.19 current

Short answer

AVDF fits Oracle-heavy organisations that need a central, tamper-resistant audit repository and an optional network SQL firewall, with separation of duties between administrators and auditors. It is an appliance you install and patch quarterly, and pricing comes from Oracle, so it suits regulated estates more than small teams.

How we know: This profile is research-based: components, collection methods, supported targets and release status were checked on 7 November 2026 against the Oracle AVDF 20 documentation on docs.oracle.com (documentation home, Administrator's Guide introduction and contents, Release Notes and Licensing Information). oracle.com product and price pages block automated fetches, so pricing and licence metric are not stated. We have not installed AVDF.

Overview

Oracle Audit Vault and Database Firewall has two main parts. The Audit Vault Server collects and stores audit data, and provides the web console and the AVCLI command line. Audit Vault Agents on target hosts read database audit tables and operating system audit files; since 20.9 a limited agentless mode can collect up to 20 Oracle Database table trails (and from 20.10 SQL Server .sqlaudit and .xel directory trails). The Database Firewall inspects SQL traffic on the network and runs in monitoring-only or monitoring-and-blocking mode.

Built-in plug-ins cover Oracle Database, Microsoft SQL Server, Sybase ASE, IBM Db2 for LUW and MySQL, with MongoDB audit collection through the Quick JSON target type and custom plug-ins through an SDK. The administrator's guide also covers high availability, Oracle RAC, deployment on Oracle Cloud Infrastructure, hybrid cloud deployment and integration with third-party SIEM tools. Release 20.17 added transaction log collection from SQL Server 2022.

Key features

Central Audit Vault Server repository with console, reports, alerts and email notifications
Audit Vault Agents for database audit tables and OS audit files, plus limited agentless collection (20.9 and later)
Database Firewall for network SQL monitoring, with a monitoring-and-blocking mode
Audit policy management for Oracle Database, entitlement auditing and stored procedure auditing
Security assessment and drift management, with sensitive data discovery through DBSAT (updated to 4.3 in 20.19)
Separation of duties between administrators and auditors, STIG-compliant configuration
High availability, Oracle RAC support, OCI and hybrid cloud deployment, SIEM integration

Integrations and ecosystem

Oracle Enterprise Manager (plug-in)Oracle Key VaultOracle Cloud InfrastructureMicrosoft Active Directory and OpenLDAPThird-party SIEM via syslogOracle GoldenGate (transaction log collection)

Pros and cons

Pros

Oracle-supported auditing and firewall for Oracle Database, with built-in plug-ins for four other engines
Firewall can block SQL, not only alert
Clear separation of duties between administrators and auditors
Regular quarterly release updates with security fixes

Cons

Appliance to install, size, patch and back up yourself
Narrower non-Oracle coverage than multi-engine DAM vendors
Agentless collection is limited to 20 trails in total
Pricing is not available from public pages that could be read automatically

Pricing

Oracle AVDF is a separately licensed Oracle product. Its list price and licence metric are published on oracle.com price lists, which could not be read with automated tools for this review, so no price or metric is given here; ask Oracle or your reseller for a quote. The AVDF Licensing Information guide on docs.oracle.com (October 2026 edition) covers third-party component licences only.

Pricing checked on the vendor's official page on 7 November 2026. Prices change; confirm before buying.

Who it is best for

Oracle-centred, regulated organisations that need a central audit repository and network SQL firewall under Oracle support.

Typical use cases

Consolidating Oracle and SQL Server audit trails into one tamper-resistant store for auditors
Blocking unauthorised SQL from reaching production Oracle databases
Producing scheduled compliance reports with separation of duties
Forwarding database audit events to a SIEM

Who should look elsewhere

Teams running only Oracle Cloud databases that want a managed service: see Oracle Data Safe.
Estates dominated by non-Oracle engines: see DataSunrise or IBM Guardium Data Protection.

Verdict

Our take

AVDF is Oracle's answer for on-premises and hybrid database auditing and SQL firewalling, strongest on Oracle Database and solid on a few other engines. It brings separation of duties and blocking, at the cost of running and patching an appliance and negotiating Oracle pricing.

Frequently asked questions

What is the latest version of Oracle AVDF?

Release 20 is current. On 7 November 2026 the release notes list 20.19 as the latest release update, referencing the October 2026 Critical Patch Update; 20.17 was released in March 2026.

Can AVDF audit non-Oracle databases?

Yes. Built-in plug-ins cover Microsoft SQL Server, Sybase ASE, IBM Db2 for LUW and MySQL, MongoDB audit data can be collected through the Quick JSON target type, and custom plug-ins can be written with the SDK.

Does the Database Firewall block queries?

It can. Each firewall is configured in monitoring-only or monitoring-and-blocking mode, and auditors assign firewall policies to targets.

How is AVDF different from Oracle Data Safe?

AVDF is an appliance you install and run, with a network SQL firewall. Data Safe is an Oracle Cloud managed service for assessment, auditing, discovery and masking of Oracle databases, with SQL Firewall management for Oracle AI Database 26ai.

Sources

Checked November 2026.

Listed in: Database Security & Auditing.

How we research reviews and what star ratings mean: our editorial method.