Automated Database Security: DBSAT 3.1 meets Oracle EM

What DBSAT is: the Database Security Assessment Tool is a free Oracle utility that interrogates a running database's configuration, users, privileges, and audit settings — producing a scored risk report without requiring DBA-level access or taking the system offline.

The OEM integration adds four key capabilities:

The plug-in agent deploys DBSAT as a managed OEM target, so assessments can be scheduled (daily, weekly, on-demand) from the central console rather than run manually on each host.

The analyzer engine classifies every finding into a severity tier — critical, high, medium, or low — and groups them by domain: basic security controls, privilege analysis, fine-grained auditing, encryption, and database vault.

The compliance framework mapping automatically aligns findings to regulatory and hardening standards: CIS Oracle Benchmarks, DISA STIGs, GDPR, PCI-DSS, and HIPAA. This eliminates the manual cross-referencing that normally consumes audit preparation time.

The output layer surfaces results in three directions: detailed HTML/JSON reports for security teams, the OEM compliance dashboard for executive visibility and trend lines over time, and automated remediation jobs that can trigger corrective SQL scripts or escalation workflows directly from OEM.

Practical benefit: instead of point-in-time assessments run before audits, organizations get a continuous risk baseline across their entire Oracle fleet — with drift detection that alerts when a previously-passing control regresses. Click any component above to ask more about it.

Architecture: how the OEM plug-in works

Before touching a keyboard, internalize this data flow. It determines where credentials need to live and what firewall ports must be open.

Key data-flow facts every DBA should memorize:

• The OEM agent on each host runs dbsat collect locally — no separate DBSAT binary to maintain.
• The collector output ZIP is uploaded back to the OMS over the standard HTTPS agent channel (port 4900). No new firewall rules needed in most environments.
• The analyzer step runs inside the OMS, not on the DB host, so CPU impact on production is negligible.
• Credentials for dbsat collect are stored in the OEM Named Credential store — not in clear-text config files.

---

Prerequisites and installation

Required privileges — the minimum viable user

The biggest DBA mistake I see is running DBSAT with a SYS or DBA account. DBSAT 3.1 ships with a dedicated privilege script. Use it.

SQL — run as SYSDBA on each target DBdbsat_user_setup.sql

-- Create a dedicated, locked-down collector account
CREATE USER c##dbsat_coll IDENTIFIED BY "<VaultSecret_01>"
  DEFAULT TABLESPACE users
  TEMPORARY TABLESPACE temp
  ACCOUNT LOCK;   -- unlock only during assessment windows

-- Minimum grants for collector (CDB-wide)
GRANT CREATE SESSION               TO c##dbsat_coll CONTAINER=ALL;
GRANT SELECT_CATALOG_ROLE           TO c##dbsat_coll CONTAINER=ALL;
GRANT SELECT ON sys.registry$        TO c##dbsat_coll CONTAINER=ALL;
GRANT SELECT ON sys.dba_users_with_defpwd
                                     TO c##dbsat_coll CONTAINER=ALL;

-- DBSAT 3.1 new: SQL Firewall and Data Redaction views
GRANT SELECT ON sys.dbms_sql_firewall$   TO c##dbsat_coll CONTAINER=ALL;
GRANT SELECT ON dvsys.dba_dv_status        TO c##dbsat_coll CONTAINER=ALL;

-- Optional: privilege analysis (adds ~15% more findings)
EXEC dbms_privilege_capture.create_capture(
  name        => 'DBSAT_PA_CAP',
  type        => dbms_privilege_capture.g_database,
  roles       => role_name_list()
);

Warning

Never grant DBA to the collector account. DBSAT only needs read access to data dictionary views. The privilege script above covers all 3.1 checks. If you see "ORA-01031 insufficient privileges" in the log, see the extended grants section in MOS Note 2710440.1.

Deploying the OEM plug-in

BASH — OEM admin on OMS hostplug-in deployment

# 1. Download plug-in archive from MOS (Patch 36500021)
cd /u01/app/oracle/product/13.5.0/em_home/bin

# 2. Import plug-in into OMS software library
./emcli import_update \
  -omslocal \
  -file="/tmp/oracle.dbsat_3.1.0.0.0_2000_0.opar"

# 3. Deploy to OMS
./emcli deploy_plugin_on_server \
  -plugin="oracle.dbsat:3.1.0.0.0" \
  -sys_password="<oms_sys_pw>"

# 4. Deploy to all managed agents (parallel, 10 at a time)
./emcli deploy_plugin_on_agent \
  -plugin="oracle.dbsat:3.1.0.0.0" \
  -agent_names="*:3872" \
  -async_operation

# 5. Verify deployment status
./emcli get_plugin_deployment_status \
  -plugin_id="oracle.dbsat" | grep -E "AGENT|STATUS"

BASH — verify plug-in on agentagent verification

# On the target agent host
$AGENT_HOME/bin/emctl listplugins agent \
  -type all | grep dbsat

# Expected output:
# oracle.dbsat    3.1.0.0.0    DEPLOYED

# Confirm dbsat binary is accessible
ls -lh $AGENT_HOME/plugins/oracle.dbsat_3.1.0.0.0/bin/dbsat

---

Running your first assessment

Option A — from the OEM console (recommended)

Navigate to the target database in OEM → Security → DBSAT Assessment

EM 13.5 adds a "DBSAT Assessment" menu item under the Database Security menu for any target that has the plug-in deployed. Click Run Assessment.

Select a Named Credential for the collector

Choose the credential that resolves to c##dbsat_coll. If it's not listed, create it first under Setup → Security → Named Credentials.

Choose assessment scope

Select Full Assessment for the first run. For CDB targets, enable Include all open PDBs. The Privilege Analysis option adds ~4 minutes per database.

Submit and monitor

The job appears in the EM Jobs page with real-time step progress. A typical 19c database completes in 6–9 minutes.

Option B — command-line (scripted / headless)

BASH — on DB host via EM agentmanual collect + report

DBSAT=$AGENT_HOME/plugins/oracle.dbsat_3.1.0.0.0/bin/dbsat
OUTPUT_DIR=/u01/dbsat_output/$(date +%Y%m%d)
mkdir -p $OUTPUT_DIR

# ── Step 1: Collect ──────────────────────────────────────────
$DBSAT collect \
  c##dbsat_coll/"<password>"@"(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=dbhost01.example.com)(PORT=2484))(CONNECT_DATA=(SERVICE_NAME=PROD19C)))" \
  -n                       # suppress interactive password prompt
  -o $OUTPUT_DIR/prod19c   # output prefix

# Output: prod19c.zip (encrypted, requires reporter password)

# ── Step 2: Report ───────────────────────────────────────────
$DBSAT report \
  -n                       # no password on report zip
  -a                       # all checks
  -f html,json             # DBSAT 3.1: dual format output
  -o $OUTPUT_DIR/prod19c_report \
  $OUTPUT_DIR/prod19c.zip

# Output files:
#   prod19c_report.html  — human-readable
#   prod19c_report.json  — machine-readable (SIEM/ticketing)

CDB / multi-PDB sweep

BASH — CDB with all PDBsmulti-tenant assessment

# Connect to CDB$ROOT with the common user
$DBSAT collect \
  c##dbsat_coll@"(DESCRIPTION=...CDB_SERVICE...)" \
  -n \
  --pdb-scope ALL \        # DBSAT 3.1 flag: enumerate all open PDBs
  -o $OUTPUT_DIR/cdb01

# Report will include a top-level CDB summary + per-PDB sections
$DBSAT report \
  -n -a \
  -f html,json \
  --pdb-rollup \           # DBSAT 3.1: consolidated risk matrix
  -o $OUTPUT_DIR/cdb01_report \
  $OUTPUT_DIR/cdb01.zip

pro tip

Use --pdb-scope OPEN instead of ALL to skip PDBs in MOUNT or RESTRICTED state during scheduled jobs — avoids false-negative errors in the log.

---

Decoding the findings report

DBSAT categorizes every finding into one of five domains. Here's what a real output header looks like for a typical 19c production database, followed by what the score means:

═══════════════════════════════════════════════════════════════════ Oracle Database Security Assessment Report Database: PROD19C · Version: 19.21.0.0 · OS: Linux x86-64 Assessed: 2025-04-22 14:03:11 UTC | DBSAT 3.1.0.0.0 ═══════════════════════════════════════════════════════════════════ SUMMARY ─────────────────────────────────────────────────── Domain Critical High Medium Low Advisory ─────────────────────────────────────────────────── Basic Security Configuration 2 4 8 3 6 User Accounts 1 2 3 5 2 Privilege and Role Analysis 0 6 4 2 8 Auditing and Logging 1 1 2 0 3 Encryption and Data Protection 0 3 5 4 1 ─────────────────────────────────────────────────── TOTAL 4 16 22 14 20 Overall Risk Score: MEDIUM-HIGH (68/100)

The risk score algorithm in DBSAT 3.1 weights findings as: Critical × 20, High × 6, Medium × 2, Low × 1 — normalized to 100. A score above 70 triggers an automatic OEM compliance alert.

Critical

4

Immediate action required

High

16

Address within sprint

Medium

22

Schedule remediation

Low

14

Harden in next cycle

Top findings to always check first

DBV.0001 — Database Vault not enabled

Basic Security Configuration · Critical

AUDIT.0003 — Unified Auditing not enforced (Mixed mode)

Auditing and Logging · Critical

PRIV.0012 — 23 users with excessive system privileges never logged in for > 90 days

Privilege and Role Analysis · High

ENC.0007 — Transparent Data Encryption not active on USERS and SYSAUX tablespaces

Encryption and Data Protection · High

USER.0004 — 4 accounts using default Oracle passwords (SCOTT, OUTLN, DBSNMP…)

User Accounts · High

CONF.0019 — SEC_CASE_SENSITIVE_LOGON = FALSE (allows case-insensitive passwords)

Basic Security Configuration · Medium

---

Compliance framework mapping

DBSAT 3.1 ships with five built-in compliance mappings. OEM's compliance framework picks these up automatically and folds them into enterprise-level compliance dashboards.

DBSAT Check ID	Description	Frameworks	Severity
AUDIT.0001	Audit trail secure	CIS 4.1 STIG V-236 PCI 10.2	Critical
ENC.0001	TDE on sensitive tablespaces	PCI 3.4 GDPR Art.32 HIPAA §164	High
USER.0002	Default passwords changed	CIS 5.1 STIG V-219 PCI 2.1 GDPR Art.25	High
PRIV.0001	PUBLIC has no dangerous grants	CIS 6.2 STIG V-225	Medium
NET.0003	sqlnet.ora encryption enforced	PCI 4.1 GDPR Art.32 STIG V-241	High
CONF.0011	Remote_OS_Authent = FALSE	CIS 2.2 STIG V-220	Critical

OEM tip

In OEM, navigate to Compliance → Library → Oracle Database Security Baseline to see all 147 DBSAT checks mapped to standards. You can customize the baseline — suppress checks that don't apply to your environment and it persists across future assessments.

---

Scheduling and automation in OEM

Set up a weekly fleet-wide assessment job

BASH — emcli job schedulingautomated weekly sweep

# Create a multi-target DBSAT job via emcli
./emcli create_job \
  -name="WEEKLY_DBSAT_FLEET" \
  -type="DBSATAssessment" \
  -target_type="oracle_database" \
  -target_list="PROD19C:oracle_database,PROD21C:oracle_database,DEVPDB:oracle_database" \
  -credential_set_name="DBCredsDBSAT" \
  -start_time="2025-04-27 02:00:00" \
  -repeat_units="Weeks" \
  -repeat_value="1" \
  -input_file="dbsat_job_params.properties"

# dbsat_job_params.properties:
#   assessment_scope=FULL
#   include_privilege_analysis=true
#   pdb_scope=OPEN
#   report_formats=html,json
#   upload_to_compliance=true
#   alert_on_score_delta=10   # alert if score worsens by ≥10 pts

Drift detection alert rule

SQL — OEM repository (run as SYSMAN)custom drift alert

-- Query the DBSAT results table to find databases where score
-- worsened by more than 5 points since last assessment
SELECT
    t.target_name,
    r.assessment_date,
    r.overall_score,
    r.overall_score - LAG(r.overall_score)
        OVER (PARTITION BY t.target_name ORDER BY r.assessment_date) AS score_delta,
    r.critical_count,
    r.high_count
FROM
    mgmt$dbsat_assessments r
    JOIN mgmt$target t ON t.target_guid = r.target_guid
WHERE
    r.assessment_date >= SYSDATE - 14
    AND (r.overall_score - LAG(r.overall_score)
        OVER (PARTITION BY t.target_name ORDER BY r.assessment_date)) > 5
ORDER BY score_delta DESC;

---

Remediation playbook

Here are the exact fixes for the most common Critical and High findings DBSAT surfaces.

Switch to Pure Unified Auditing

SQL + BASH — Oracle 19c/21c/23aiAUDIT.0003 fix

-- 1. Check current audit mode
SELECT value FROM v$option WHERE parameter = 'Unified Auditing';
-- If FALSE → mixed mode. If TRUE → pure unified (already good).

-- 2. Stop the instance and relink (mixed → pure unified)
-- On the OS, as oracle user:

BASHrelink for pure unified auditing

cd $ORACLE_HOME/rdbms/lib
make -f ins_rdbms.mk uniaud_on ioracle ORACLE_HOME=$ORACLE_HOME

# Restart the instance
sqlplus / as sysdba <<EOF
SHUTDOWN IMMEDIATE;
STARTUP;
SELECT value FROM v\$option WHERE parameter = 'Unified Auditing';
EOF
# Verify output: TRUE

Enable TDE on user tablespaces

SQL — as SYSDBAENC.0007 fix

-- 1. Create or open the wallet
ADMINISTER KEY MANAGEMENT
  SET KEYSTORE OPEN
  IDENTIFIED BY "<wallet_pw>"
  CONTAINER = ALL;

-- 2. Set master encryption key (first time only)
ADMINISTER KEY MANAGEMENT
  SET KEY
  USING TAG 'PROD19C_MEK_2025'
  IDENTIFIED BY "<wallet_pw>"
  WITH BACKUP
  CONTAINER = ALL;

-- 3. Encrypt existing tablespaces (online, no downtime on 12.2+)
ALTER TABLESPACE users     ENCRYPTION ONLINE USING 'AES256' ENCRYPT;
ALTER TABLESPACE app_data  ENCRYPTION ONLINE USING 'AES256' ENCRYPT;
ALTER TABLESPACE sysaux    ENCRYPTION ONLINE USING 'AES256' ENCRYPT;

-- 4. Verify
SELECT tablespace_name, encrypted
FROM   dba_tablespaces
WHERE  encrypted = 'YES';

Revoke dangerous PUBLIC grants

SQL — PRIV.0001 fixtighten PUBLIC

-- Find and revoke dangerous grants on PUBLIC
BEGIN
  FOR r IN (
    SELECT 'REVOKE ' || privilege || ' ON '
           || owner || '.' || table_name
           || ' FROM PUBLIC' AS stmt
    FROM   dba_tab_privs
    WHERE  grantee  = 'PUBLIC'
    AND    owner    = 'SYS'
    AND    privilege IN ('EXECUTE','SELECT')
    AND    table_name IN (
             'UTL_FILE', 'UTL_TCP', 'UTL_HTTP', 'UTL_SMTP',
             'DBMS_ADVISOR', 'DBMS_BACKUP_RESTORE',
             'DBMS_JAVA', 'DBMS_SYS_ERROR')
  ) LOOP
    EXECUTE IMMEDIATE r.stmt;
    DBMS_OUTPUT.PUT_LINE('Revoked: ' || r.stmt);
  END LOOP;
END;
/

 caution

Always test PUBLIC revokes in a lower environment first. Applications that relied on these implicit grants will throw ORA-01031 errors. Build a regression test for each UTL_* package before touching production.

---

Performance and operational impact

The most common DBA pushback: "Will this affect my production database?" Short answer — minimal if you follow the guidelines.

── DBSAT 3.1 Performance Profile (19c, 500GB, 200 active sessions) ── Phase Duration CPU% Active Sessions Impact ────────────────────────────────────────────────────────────── Collect (no PA) 4m 12s 0.3% None (reads dict only) Collect (with PA) 9m 55s 1.8% Minor (PA session sampling) Report 1m 06s 0.1% None (runs off-DB) ────────────────────────────────────────────────────────────── Recommended window: 02:00–04:00 local | Off-peak batch window

The collector only reads data dictionary views — no DML, no DDL. The most I/O-intensive check is Privilege Analysis, which joins DBA_SYS_PRIVS and SESSION_PRIVS across all grantees. On a busy database, schedule this outside peak hours.

Oracle's Zettascale OCI SuperCluster: What Every Oracle DBA Needs to Know

This Isn't Just an Infrastructure Story:

When Oracle announced the OCI Zettascale SuperCluster, most of the headlines went to AI researchers and hyperscale architects. But if you're an Oracle DBA — managing production databases, tuning queries, babysitting backups at 2 AM — this platform has enormous implications for your world too. 

The infrastructure powering the next generation of AI is the same infrastructure your Oracle workloads are increasingly running on. And understanding it helps you make smarter decisions about where your databases live, how they scale, and what's coming next.

The Numbers: What "Zettascale" Actually Means

The OCI SuperCluster isn't a minor upgrade. It's a generational leap. Here's a grounding overview:

The Engineering: Three-Tier Clos Network Architecture

The networking architecture is what sets OCI SuperCluster apart, and DBAs should appreciate this because network latency kills database performance. Here's how it works:

The cluster network uses a three-tier Clos topology — a proven non-blocking switching design:

• Tier 1 (Leaf): Serves up to 256 NVIDIA GPUs — latency ≤ 2 µs
• Tier 2 (Spine): Serves up to 2,048 NVIDIA GPUs — latency ≤ 5 µs
• Tier 3 (Super-spine): Serves up to 131,072 NVIDIA GPUs — latency ≤ 8 µs

Oracle's OCI Supercluster scaling diagram:

At every tier, the network is nonblocking — meaning no GPU (or database node) ever has to wait for bandwidth. Oracle uses RDMA over Converged Ethernet v2 (RoCE v2) with NVIDIA ConnectX-7 NICs, augmented by congestion control (not the legacy PFC mechanism that risks network blocking).

For the DBA, the key takeaway: this is the same RDMA technology that Oracle Exadata uses internally — now scaled to an almost incomprehensible level across the entire cloud.

Why Ultra-Low Latency Matters for DBAs

Oracle Exadata's RDMA Storage Fabric operates at sub-100µs latency. The OCI SuperCluster cluster network hits 2 µs at the leaf tier. When your RAC nodes, Exadata nodes, or Oracle AI Database in-database agents are communicating across this fabric, they're doing so at speeds that effectively make network hops disappear. For workloads like:

• RAC cache fusion (inter-node block transfers)
• In-memory columnar queries across distributed nodes
• Oracle AI Database 26ai in-database agent coordination

---

The Storage Layer: Keeping Up With 52 Pbps

A network this fast needs storage to match. Oracle has made significant investments here:

• OCI File Storage now supports terabits per second of throughput with the new High-Performance Mount Target (HPMT)
• A fully managed Lustre file service is coming that supports dozens of terabits per second
• Frontend network capacity has been upgraded: 100 Gbps (H100) → 200 Gbps (H200) → 400 Gbps per instance (B200/GB200)

For DBAs managing data pipelines feeding AI workloads, this changes the calculus entirely. ETL jobs, data exports from Oracle DB to object storage, or vector data ingestion pipelines are no longer bottlenecked by network throughput.

---

Use Cases From a DBA Perspective

1. Training AI Models That Power Autonomous Database Features

The Oracle Autonomous Database's self-tuning, self-patching, and self-healing capabilities are underpinned by machine learning models. Those models need to be trained — and retrained — on vast amounts of database telemetry. The OCI SuperCluster is the engine that accelerates that. As a DBA, when you see Autonomous Database correctly predicting your workload patterns or recommending the right index automatically, that intelligence was trained on infrastructure like this.

DBA relevance: You benefit from AI model accuracy that improves over time because training at zettascale produces better, faster-converging models.

---

2. Oracle AI Database 26ai — In-Database Agents at Scale

Oracle AI Database 26ai introduced in-database AI agents that run PL/SQL and Python workflows natively inside the database engine. These agents coordinate, communicate, and act on data — and they need serious compute behind them. The OCI SuperCluster provides the GPU capacity to run thousands of concurrent agent workloads without resource contention.

DBA relevance: If you're deploying in-database agents for automated anomaly detection, intelligent query rewriting, or agentic ETL pipelines, they run on infrastructure capable of supporting them at enterprise scale — not a GPU-starved shared pool.

---

3. Large Language Model Inference for DBA Tooling

AI-powered DBA assistants — tools that can analyze AWR reports, explain execution plans in plain English, suggest SQL rewrites, or predict capacity needs — require low-latency inference from large language models. The 2µs network latency of OCI SuperCluster makes real-time inference viable even for interactive DBA tooling.

Think: asking your database assistant "why is this query taking 30 seconds?" and getting a fully analyzed, plan-aware response in under a second — because the LLM serving that response lives on infrastructure with nanosecond-scale GPU-to-GPU communication.

DBA relevance: Faster inference = more responsive AI tooling integrated into your workflows.

---

4. Vector Database Workloads and RAG for Enterprise Oracle Apps

Oracle Database 23ai introduced native vector data types and AI-powered vector search — allowing Oracle databases to store embeddings and serve retrieval-augmented generation (RAG) pipelines. Running RAG at enterprise scale means:

• Ingesting billions of vectors from documents, logs, and telemetry
• Serving sub-second similarity searches across them
• Combining vector search with traditional SQL in a single query

The GPU capacity of the OCI SuperCluster handles the embedding generation (running transformer models) and the retrieval computation at scale. The 52 Pbps network ensures that data moves between storage, vector indexes, and GPU compute without bottlenecks.

DBA relevance: As your organization deploys AI-powered Oracle applications (chatbots over ERP data, intelligent search over document archives), the underlying OCI infrastructure supports the compute tier — and you own the data tier.

---

5. AI-Powered Performance Tuning at Unprecedented Scale

Oracle's AI-driven performance management — detecting drifting execution plans, identifying resource contention, predicting I/O anomalies — requires correlating signals across massive telemetry datasets in real time. At organizations running hundreds of Oracle instances across a cloud region, this is a big-data problem as much as a database problem.

The OCI SuperCluster enables Oracle to run cross-instance, cross-workload ML models that identify performance patterns no single DBA could detect manually. Companies implementing these autonomous capabilities have reported reducing database downtime by up to 60%.

DBA relevance: The AI keeping your databases healthy is being trained and run on the most capable GPU infrastructure in the cloud.

---

6. Real Customer: Zoom, WideLabs, and Reka on OCI SuperCluster

The platform isn't theoretical:

• Zoom uses OCI SuperCluster to power inference for Zoom AI Companion — its AI personal assistant — serving millions of users in real time.
• WideLabs (healthcare AI, Brazil) trains large language models on OCI GPU infrastructure within Oracle Cloud's São Paulo Region, satisfying AI sovereignty requirements while running at scale.
• Reka (enterprise AI) builds multimodal AI models on OCI/NVIDIA infrastructure to develop enterprise agents that "can read, see, hear and speak."

Each of these companies has Oracle data somewhere in their stack — and they're choosing the same cloud platform.

---

The Zettascale10 Evolution: What's Next

Oracle took zettascale further with OCI Zettascale10 — the architecture powering the Stargate supercluster in Abilene, Texas (co-built with OpenAI). Key upgrades:

• Connects GPUs across multiple data centers (not just a single campus)
• Multi-gigawatt clusters delivering up to 16 ZettaFLOPS
• Built on Oracle Acceleron RoCE — a custom next-generation network architecture
• Optimized for gigawatt-scale AI training with GPU-GPU latency maintained even across the multi-data center fabric
• Housed in data center campuses within a 2-kilometer radius to preserve latency at scale

As OCI Zettascale10 rolls out globally, it becomes the backbone for the largest AI training runs in history — and the substrate for whatever Oracle Autonomous Database features come next.

---

What Should Oracle DBAs Do With This Information?

You don't need to become a GPU architect. But here's what's actionable:

1. Understand your workloads on OCI. If you're running Oracle Database on OCI (or planning to), your database is co-located on infrastructure that supports zettascale AI. That means the networking, storage, and compute underneath your instance is enterprise-grade and tuned for demanding workloads.

2. Learn Oracle AI Database 26ai. In-database agents, vector search, ML-based query execution — these features are designed for the OCI compute environment. Getting familiar now positions you ahead of the curve.

3. Embrace the shift in your role. The OCI SuperCluster represents the infrastructure that will train the AI tools that augment your DBA work — query advisors, anomaly detectors, autonomous patching systems. Your job is increasingly about governing and directing these systems, not replacing them.

4. Think about data sovereignty. OCI's distributed cloud means you can run SuperCluster-level AI workloads in specific regions (as WideLabs did in Brazil). For regulated industries — healthcare, finance, government — this is a competitive advantage Oracle is investing in heavily.

5. Watch the Oracle AI Database roadmap. With 26ai embedding agents, vector types, and GPU-accelerated ML directly in the database engine, and the OCI SuperCluster as the compute tier, the gap between "Oracle DBA" and "AI infrastructure manager" is closing fast.

Ask EM - Chatbot interface: The Next Evolution of Intelligence in Oracle Enterprise Manager (OEM) 24ai

Ask EM is available now in Oracle Enterprise Manager 24ai, starting with Release Update 4. Whether you're a seasoned DBA or new to the platform, it's designed to make your day-to-day operations faster, more intuitive, and measurably smarter.

Example prompts: "How is the performance of my database?" or "How do I troubleshoot buffer busy wait?" — Ask EM handles both with the same natural-language interface.

Managing mission-critical databases and applications across hybrid environments has always demanded deep expertise and fast reflexes. Oracle Enterprise Manager (EM) has long been the backbone for those operations. Now, with the introduction of "Ask EM" in EM 24ai, that backbone just got a whole lot smarter.

Ask EM is a conversational chatbot powered by the Cohere Large Language Model (LLM) on Oracle Cloud Infrastructure. It lets you interact with your operational environment—and its documentation—using natural language, no SQL or navigation required.

What can Ask EM do?

Ask EM operates across two core domains, available as tabs in the chatbot interface:

Telemetry

Query the live health of your monitored targets, diagnose performance issues, and run root cause analyses—all in plain English. Results are rendered as interactive widgets you can pin to build dashboards.

Documentation

Ask any EM documentation question and receive a contextually rich answer using Retrieval Augmented Generation (RAG), complete with clickable links back to the source docs.

How it works under the hood:

When Ask EM launches from your on-premises EM 24ai console, it initializes a chatbot session and opens a secure WebSocket connection directly from the browser to Oracle's Ops Insights service in OCI. Critically, only the text of your question is transmitted—no EM data ever leaves your environment.

Architecture flow

Browser (EM 24ai)

→

Secure WebSocket

→

OCI Ops Insights

→

Oracle DB 23ai

→

Cohere LLM / GenAI

→

Widgets / Answer

The GenAI “Ask EM” feature is included in EM 24ai Release Update 4 (RU4). After applying EM 24.1 RU04 or a later patch, the “Ask EM” chatbot icon becomes available in the EM 24ai console, as shown below.

$OMS_HOME/OPatch/opatch lsinventory | grep -i "24.1"

/u01/app/oracle/oemp/middleware/oms_home/OPatch/opatch lsinventory|grep -i "24.1"

For telemetry questions, a similarity search runs against Oracle Database 23ai to surface the most relevant operational data. That data is passed to the Cohere LLM, which augments it into a tailored response and returns interactive widgets to the EM console.

For documentation questions, all public EM docs are pre-ingested into Oracle Database 23ai. RAG retrieval finds the most relevant passages and the GenAI Agent composes a natural-language answer with source links for deeper reading.

No firewall changes are needed on-premises. If your browser can reach the internet, Ask EM can connect to Oracle Cloud.

What you need to get started

OCI AccountSign up or use an existing account subscribed to the us-ashburn-1 region.

Ops InsightsAn active subscription with at least one host or database enabled.

IAM PoliciesTwo policies granting the user group access to manage OPSI GenAI sessions.

EM PatchEM 24.1 Release Update 4 (RU4) or newer applied to your EM environment.

Getting Started with Ask EM

Before you start exploring the power of Ask EM, a few prerequisites need to be in place to ensure a smooth setup and experience.

First, you’ll need an Oracle Cloud Infrastructure (OCI) account. You can either sign up for a new account or use an existing one. Make sure your OCI tenancy is subscribed to the Generative AI service in the US Ashburn region (us-chicago-1), as Ask EM currently relies on this region. Support for additional regions will be introduced in future updates.

Next, ensure you have an active subscription to OCI Ops Insights. At least one resource—such as a host or database—must be enabled within Ops Insights. This service, part of Oracle’s Observability and Management suite, plays a key role in powering Ask EM’s intelligent chatbot interactions.

You’ll also need to configure the appropriate Identity and Access Management (IAM) policies within your OCI tenancy. Add the following policies to grant the necessary permissions:

allow group <em-genai-user> to manage opsi-genai-em-session in tenancy

allow group <em-genai-user> to manage opsi-genai-em-docs-session in tenancy

Once these prerequisites are met, Ask EM requires a one-time initial setup. The first time you access the feature, the Super Administrator will be prompted to provide OCI credential details to establish the connection.

Powered by Generative AI

Ask EM brings the power of Generative AI directly into Oracle Enterprise Manager by leveraging the Cohere Large Language Model (LLM) running on OCI. This enables intelligent, context-aware interactions to help you manage and monitor your enterprise environment more efficiently.

To use Ask EM, ensure that the browser accessing EM 24ai has internet connectivity to communicate with OCI services. Importantly, the OMS host itself does not require internet access—simplifying deployment in more restricted environments.

Setting it up: three steps:

Once the patch is applied, clicking the Ask EM icon in the EM console launches a guided configuration wizard:

1. Review requirements

Confirm your OCI account, Ops Insights subscription, and IAM policies are all in place.

2. Configure credentials and region

Create or select an OCI named credential, choose your GenAI-supported region, and run a test connection. Optionally enable audit logging to track all Ask EM activity.

3. Set access controls (optional)

Super administrators have access by default. Extend access to additional admins by assigning them the EM_ASKEM_ADMIN role.

The architecture of Ask EM is designed to deliver powerful Generative AI capabilities while maintaining the security and integrity of your enterprise environment. The following diagram illustrates how Ask EM integrates Oracle Enterprise Manager with Oracle Cloud Infrastructure (OCI) services in a seamless and secure manner.

Breaking Down the Architecture

Let’s walk through what’s happening behind the scenes:

1. User Interaction (Enterprise Manager Console):

The journey begins in the EM 24ai console, where the user interacts with the Ask EM chatbot. Queries such as system health checks or performance insights are entered directly into the interface.

2. Secure Communication over the Internet:

The request is transmitted securely over HTTPS via the public internet. Importantly:

The communication originates from the user’s browser, not the OMS host

This design eliminates the need for outbound internet access from the Enterprise Manager infrastructure

3. OCI Ops Insights as the Gateway:

Once the request reaches OCI, it is handled by the Ops Insights Cloud Service, which acts as the orchestration layer. It:

Manages GenAI session requests

Connects enterprise telemetry data with AI processing

Ensures secure and policy-controlled access

4. Generative AI Processing (LLM + Agent)

The request is then processed within OCI’s Generative AI stack:

The GenAI Agent interprets the user’s query

The Cohere LLM generates intelligent, context-aware responses

Relevant enterprise context is fetched when needed

5. Data Sources and Context Enrichment

To provide meaningful insights, the system may leverage:

Oracle 23ai Database for structured data

Documentation and widget metadata for contextual assistance

This ensures responses are not just generic—but tailored to the Enterprise Manager environment.

6. Response Returned to User

Finally, the generated response flows back through the same secure channel and is displayed in the Ask EM chatbot interface—typically within seconds.

How “Ask EM” Works: Behind the Scenes

When Ask EM is launched from the on-premises EM 24ai console, a chatbot session is immediately initialized. At this point, a secure WebSocket connection is established directly from the user’s browser to Oracle’s Ops Insights service running on Oracle Cloud Infrastructure (OCI).

This session is assigned a unique identifier, which is used for all subsequent communication throughout the interaction. This ensures a continuous, secure, and seamless conversational experience between the EM console and OCI services.

Secure, Browser-Based Connectivity:

The connection is established over the public internet, but importantly:

No changes are required to on-premises firewall configurations

No additional ports need to be opened

EM 24ai does not need to operate in any special “online mode”

As long as the user’s browser has internet access, Ask EM can securely connect to OCI services.

A key security principle is maintained throughout the process:

Only the user’s actual question (for example, “How is the performance of my database?”) is transmitted to OCI. No additional EM telemetry or sensitive enterprise data is sent outside your environment.

What Happens in Oracle Cloud

Once a question reaches OCI, Ask EM follows two primary processing workflows depending on the nature of the query:

1. Telemetry-Based Insights Workflow

For operational and performance-related queries, Ask EM leverages enterprise telemetry data through the following steps:

A similarity search is performed using Oracle Database 23ai to identify the most relevant operational data

The selected data is passed to the Generative AI service and LLM for augmentation and contextual reasoning

The LLM enriches the response with domain-specific intelligence tailored to the user’s query

The GenAI service returns contextual widgets back to Enterprise Manager 

Within the EM interface:

Clicking the Findings button opens a dedicated side panel

Relevant widgets are rendered along with smart filters

Users can:

Interact with widgets dynamically

Modify filter values in real time

Pin important widgets for later reference

As users continue asking follow-up questions, new relevant widgets are generated while pinned widgets remain persistent. Over time, these pinned insights can be used to create customized dashboards—built directly from conversational exploration.

2. Documentation Intelligence Workflow

Ask EM also provides powerful AI-driven documentation assistance.

All public Oracle Enterprise Manager documentation is ingested and indexed in Oracle Database 23ai. When a user asks a documentation-related question—such as:

“How do I troubleshoot buffer busy waits?”

the system uses Retrieval-Augmented Generation (RAG) to:

Search across relevant documentation sources

Retrieve the most contextually accurate content

Generate a natural-language, easy-to-understand response

The chatbot also provides:

Clickable reference links

Direct navigation to official documentation in a new browser tab

Support for follow-up questions for deeper exploration

This ensures users get not just answers, but verifiable and traceable guidance from official sources.

Key Takeaways:

• Secure WebSocket connection is established directly from the browser to OCI
• No inbound or outbound changes are required on the EM infrastructure
• Only user queries are transmitted—no additional EM data is shared
• Two core workflows power Ask EM:
• Telemetry insights via GenAI + Ops Insights + 23ai
• Documentation Q&A via RAG over indexed EM docs
• Interactive widgets and dashboards transform insights into actionable monitoring views

Ask EM Setup Wizard:

Step 1: Review the required OCI account, Ops Insights subscription, and IAM policies requirements.

Step 2:  Create a new OCI named credential or select an existing OCI credential. If you are unsure where to locate these values, helpful links are provided for each field to guide you through the process. Choose your GenAI-supported region, then click Test Connection and Save to verify. Optionally, enable Audit to track all “Ask EM” activities.

Step 3 (Optional):  By default, super administrators have access to use “Ask EM”. To extend access to additional administrators, simply click on ‘Select Users’. The chosen administrators will be assigned the ‘EM_ASKEM_ADMIN’ role, allowing them to access “Ask EM”.

Finalizing the “Ask EM” Setup

Once you have completed the three key steps—subscribing to Oracle Cloud and OCI Ops Insights, configuring credentials and selecting the appropriate region, and setting up the required access control—your Ask EM interface is fully ready for use.

At this stage, Ask EM is successfully integrated into your Oracle Enterprise Manager environment, enabling a seamless GenAI-powered experience.

The benefits in practice:

• Faster issue resolution—diagnose problems through conversation instead of navigating menus
• Reduced reliance on support teams for common operational and documentation queries
• Data-driven decisions backed by live telemetry surfaced as interactive, pinnable widgets
• Full auditability with built-in activity logs for every Ask EM interaction
• Privacy-first design—only your typed question is ever sent to Oracle Cloud