OCI Monitoring Should Have Active Notification Topic

More Info:

Notification topics must be configured in the tenancy. Without active topics, security alarms and Cloud Guard alerts cannot be routed to administrators, rendering monitoring ineffective.

Risk Level

Medium

Address

Compliance, Security

Compliance Standards

APRA CPS 234 (Australia)
AWS Well Architected Framework
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
DPDPA
Digital Operational Resilience Act (EU)
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST SP 800-171
NYDFS 23 NYCRR 500
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate “OCI Monitoring should have active notification topic configured” using the OCI Console, you need to:

Create (or verify) a Notifications Topic
1. In the OCI Console, open the navigation menu.
2. Go to Developer Services → Notifications (or Application Integration → Notifications depending on the UI).
3. Make sure you are in the correct Compartment.
4. Click Create Topic.
5. Enter:
  - Name and Description
  - Compartment (same or accessible compartment as your alarms)
6. Click Create.
Add at Least One Active Subscription
1. Click on the topic you just created.
2. Under Subscriptions, click Create Subscription.
3. Choose Protocol (e.g., Email, HTTPS, Slack via HTTPS, PagerDuty via HTTPS, etc.).
4. Enter the Endpoint (e.g., email address or webhook URL).
5. Click Create.
6. For email:
  - Check your email inbox.
  - Open the Oracle Cloud email and click Confirm Subscription.
7. Ensure subscription status becomes Active in the topic’s Subscriptions list.
Attach the Topic to Existing Alarms (Monitoring)
1. In the navigation menu, go to Observability & Management → Monitoring → Alarms.
2. Select the Compartment where your alarms are defined.
3. For each alarm that needs a notification:
  - Click the alarm name.
  - Click Edit (or Edit alarm).
  - In the Notifications or Destinations section:
    - Under Topic, choose the Notifications topic you created.
    - Ensure Severity and Enabled are set as desired.
  - Click Save changes.
4. If any alarm has no notification topic, this is what typically triggers the misconfiguration finding—attach the topic as above.
Verify Alarm Status and Trigger (Optional but Recommended)
1. Ensure each alarm is Enabled.
2. Optionally, temporarily tweak the alarm’s metric or threshold to force a trigger, or:
  - Use a known test condition (e.g., a low threshold that will be exceeded).
  - Wait for the metric to trigger the alarm.
3. Confirm that:
  - The alarm changes to FIRING in the Alarms list when condition is met.
  - A notification is actually received at the configured endpoint.
Ensure Compartments and Policies Allow This
- Confirm the alarm’s compartment has permission to use Notifications:
  - IAM policy example (for reference to your admin):
    - Allow group <group-name> to manage ons-topics in compartment <compartment-name>
    - Allow service metrics to use ons-topics in compartment <compartment-name>
- If you lack permission to select topics, contact your tenancy administrator to add the appropriate policies.

Once each active OCI Monitoring alarm has a configured Notifications topic with at least one Active subscription, the “Monitoring Should Have Active Notification Topic Configured” finding will be remediated.

Using CLI

Below is a concise, CLI‑only flow to ensure OCI Monitoring Alarms have an active Notification Topic configured.

You will:

Find (or create) a Notification Topic
(Optionally) add a Subscription to that topic
Associate the topic with the Monitoring Alarm using --destinations

1. Set common variables

Adjust these to your environment:

# Region / Compartment
export OCI_REGION="us-ashburn-1"
export COMPARTMENT_OCID="ocid1.compartment.oc1..xxxx"

# Alarm to fix
export ALARM_OCID="ocid1.alarm.oc1..xxxx"

# Topic
export TOPIC_NAME="monitoring-alerts-topic"

Ensure your OCI CLI is configured (oci setup config) and using the correct region.

2. Check the current Alarm configuration

oci monitoring alarm get \
  --alarm-id "$ALARM_OCID" \
  --region "$OCI_REGION" \
  --query "data.{name:\"display-name\",destinations:destinations,severity:severity}" \
  --output table

If destinations is empty or missing, you need to attach a topic.

3. Create (or reuse) an OCI Notifications topic

3.1. See if a suitable topic already exists

oci ons topic list \
  --compartment-id "$COMPARTMENT_OCID" \
  --region "$OCI_REGION" \
  --query "data[?\"name\"=='$TOPIC_NAME'].[\"topic-id\",\"name\"]" \
  --output table

If you see no rows, create one.

3.2. Create a new topic

oci ons topic create \
  --compartment-id "$COMPARTMENT_OCID" \
  --name "$TOPIC_NAME" \
  --description "Topic for Monitoring Alarms" \
  --region "$OCI_REGION" \
  --query "data.id" \
  --raw-output

Save the returned OCID:

export TOPIC_OCID="ocid1.onstopic.oc1..xxxx"

If you already had a topic, set:

export TOPIC_OCID="<existing-topic-ocid>"

4. (Optional but recommended) Add a subscription to the topic

Example: email subscription

export EMAIL_ADDRESS="alerts@example.com"

oci ons subscription create \
  --endpoint "$EMAIL_ADDRESS" \
  --protocol "EMAIL" \
  --topic-id "$TOPIC_OCID" \
  --region "$OCI_REGION" \
  --query "data.id" \
  --raw-output

The recipient must confirm the subscription from the email sent by OCI.

5. Attach the Notification Topic to the Alarm

Get the current alarm definition (JSON) so you don’t accidentally overwrite other fields:

oci monitoring alarm get \
  --alarm-id "$ALARM_OCID" \
  --region "$OCI_REGION" \
  --query "data" \
  --raw-output > alarm.json

Edit alarm.json minimally:

Ensure destinations includes the topic OCID
Do not remove required fields (compartmentId, namespace, query, resolution, severity, isEnabled, displayName, etc.).

Example destinations entry:

"destinations": [
  "ocid1.onstopic.oc1..xxxx"
],

If destinations already exists, add your topic OCID to the array.

6. Update the Alarm with the new destination

You can update only specific fields rather than posting the entire JSON:

oci monitoring alarm update \
  --alarm-id "$ALARM_OCID" \
  --destinations '["'"$TOPIC_OCID"'"]' \
  --region "$OCI_REGION"

If you want to preserve multiple existing destinations:

Fetch them:

CURRENT_DESTS=$(oci monitoring alarm get \
  --alarm-id "$ALARM_OCID" \
  --region "$OCI_REGION" \
  --query "data.destinations" \
  --raw-output)

Combine with the new one (ensuring uniqueness) and pass in as JSON.

Example (simple overwrite with two known topics):

oci monitoring alarm update \
  --alarm-id "$ALARM_OCID" \
  --destinations '["'"$TOPIC_OCID"'","ocid1.onstopic.oc1..other"]' \
  --region "$OCI_REGION"

7. Verify

oci monitoring alarm get \
  --alarm-id "$ALARM_OCID" \
  --region "$OCI_REGION" \
  --query "data.destinations" \
  --output table

You should now see at least one topic OCID listed. That satisfies the requirement that OCI Monitoring has an active Notification Topic configured for that alarm.

Using Python

Below is a minimal end‑to‑end approach to remediate “OCI Monitoring Should Have Active Notification Topic Configured” using Python and the OCI SDK.

Assumptions:

You have oci Python SDK installed: pip install oci
You use a config file at ~/.oci/config with a profile called DEFAULT
You already have an alarm created, but it has no destinations (i.e., no notification topic)

1. Set up OCI Python SDK client

import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")

monitoring_client = oci.monitoring.MonitoringClient(config)
ons_client = oci.ons.NotificationControlPlaneClient(config)

2. Create a Notifications topic (if you don’t already have one)

compartment_id = "<YOUR_COMPARTMENT_OCID>"  # same compartment as your alarm

create_topic_details = oci.ons.models.CreateTopicDetails(
    name="monitoring-alerts-topic",
    compartment_id=compartment_id,
    description="Topic for OCI Monitoring alarms"
)

topic = ons_client.create_topic(create_topic_details).data
topic_ocid = topic.topic_id
print("Created/Using topic:", topic_ocid)

If you already have a topic, just set topic_ocid to that topic’s OCID.

3. (Optional but recommended) Add a subscription (e.g., email)

subscription_details = oci.ons.models.CreateSubscriptionDetails(
    compartment_id=compartment_id,
    topic_id=topic_ocid,
    protocol="EMAIL",                # or "HTTPS", "SLACK", etc.
    endpoint="you@example.com"       # your email address
)

subscription = ons_client.create_subscription(subscription_details).data
print("Created subscription:", subscription.id)

You’ll need to confirm the subscription via email for it to become ACTIVE.

4. Attach the topic to your existing alarm

You need:

The OCID of the existing alarm that currently has no active notification topic.

alarm_id = "<YOUR_ALARM_OCID>"

# Get existing alarm
alarm = monitoring_client.get_alarm(alarm_id).data

# Add topic to destinations if not already present
destinations = list(alarm.destinations or [])
if topic_ocid not in destinations:
    destinations.append(topic_ocid)

update_details = oci.monitoring.models.UpdateAlarmDetails(
    display_name=alarm.display_name,
    is_enabled=alarm.is_enabled,
    severity=alarm.severity,
    metric_compartment_id=alarm.metric_compartment_id,
    namespace=alarm.namespace,
    query=alarm.query,
    resolution=alarm.resolution,
    pending_duration=alarm.pending_duration,
    message_format=alarm.message_format,
    body=alarm.body,
    repeat_notification_duration=alarm.repeat_notification_duration,
    suppress_notifications=alarm.suppress_notifications,
    destinations=destinations,
    # keep any other fields you use, such as defined_tags, freeform_tags
    defined_tags=alarm.defined_tags,
    freeform_tags=alarm.freeform_tags
)

updated_alarm = monitoring_client.update_alarm(
    alarm_id=alarm_id,
    update_alarm_details=update_details
).data

print("Updated alarm destinations:", updated_alarm.destinations)

5. Verify

In OCI Console: Monitoring → Alarms → select the alarm → check “Destinations” includes your topic.
Confirm the subscription (email or other) so the topic is ACTIVE.
Trigger the alarm condition (or wait for it naturally) to verify you receive notifications.

This ensures your OCI Monitoring alarm has an active notification topic and clears the “OCI Monitoring Should Have Active Notification Topic Configured” finding.

Using Terraform

# Notification topic that OCI Monitoring / Alarms can publish to
resource "oci_ons_notification_topic" "monitoring_alerts_topic" {
  compartment_id = "OCID_OF_COMPARTMENT_FOR_TOPIC"  # e.g. the security/ops compartment
  name           = "monitoring-alerts-topic"
  description    = "Topic for OCI Monitoring and Cloud Guard alerts"
}

# (Optional but typical) at least one subscription so alerts reach admins
resource "oci_ons_subscription" "monitoring_alerts_email" {
  compartment_id = "OCID_OF_COMPARTMENT_FOR_TOPIC"
  topic_id       = oci_ons_notification_topic.monitoring_alerts_topic.id
  protocol       = "EMAIL"
  endpoint       = "SECURITY_TEAM_EMAIL@example.com"
}

/*
Attach the topic to your alarm; ensure every alarm has at least one
notification destination. If you already have oci_monitoring_alarm
resources, add or update the 'destinations' list as below.
*/
resource "oci_monitoring_alarm" "cpu_high_alarm" {
  compartment_id = "OCID_OF_COMPARTMENT_FOR_ALARM"
  display_name   = "High CPU Utilization"
  is_enabled     = true

  # Metric and condition as appropriate to your environment
  namespace   = "oci_computeagent"
  query       = "CpuUtilization[5m]{resourceId = \"INSTANCE_OCID\"}.mean() > 80"
  severity    = "CRITICAL"
  destinations = [
    oci_ons_notification_topic.monitoring_alerts_topic.id,
  ]

  # Other required arguments:
  metric_compartment_id = "OCID_OF_METRIC_COMPARTMENT"
  # message_format, pending_duration, etc., as needed
}

This does not force replacement of existing alarms unless you are changing immutable fields (e.g., alarm compartment_id); adding or updating destinations is an in‑place update. Creating the oci_ons_notification_topic is additive.

To verify, terraform plan should show:

+ creation of oci_ons_notification_topic.monitoring_alerts_topic
+ creation of any oci_ons_subscription resources you’ve added
~ update of each oci_monitoring_alarm to include the topic ID in destinations.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

1. Set common variables​

2. Check the current Alarm configuration​

3. Create (or reuse) an OCI Notifications topic​

3.1. See if a suitable topic already exists​

3.2. Create a new topic​

4. (Optional but recommended) Add a subscription to the topic​

5. Attach the Notification Topic to the Alarm​

6. Update the Alarm with the new destination​

7. Verify​

1. Set up OCI Python SDK client​

2. Create a Notifications topic (if you don’t already have one)​

3. (Optional but recommended) Add a subscription (e.g., email)​

4. Attach the topic to your existing alarm​

5. Verify​