Skip to main content

OCI Monitoring Should Have Event Rule For VCN Changes

More Info:​

VCN lifecycle events must be tracked via Event Rules. Deploying rogue virtual networks is often a precursor to launching illicit infrastructure or isolated cryptomining rigs.

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • HIPAA
  • HITRUST CSF
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Below are concise, step‑by‑step instructions to create an OCI Event Rule for VCN changes and wire it into alerting via Notifications (and optionally Monitoring Alarms), using only the OCI Console.

1. Prerequisites​

  1. Make sure you have:
    • Permissions to manage events and ons (Notifications) in the target compartment.
  2. Decide:
    • Which compartment you want to monitor VCN changes in.
    • Where you want alerts to go (email, Slack via HTTPS, PagerDuty, etc.).

2. Create a Notifications Topic​

  1. Sign in to OCI Console.
  2. Open the hamburger menu → Developer Services → Notifications → Topics.
  3. Click Create Topic.
    • Name: e.g., vcn-change-alerts-topic
    • Compartment: Choose the target compartment.
  4. Click Create.

Add a Subscription​

  1. Open the topic you just created.
  2. Under Subscriptions, click Create Subscription.
  3. Choose:
    • Protocol: e.g., Email.
    • Email: enter the recipient address.
  4. Click Create.
  5. Go to your email and confirm the subscription (mandatory).

3. Create an Event Rule for VCN Changes​

  1. Open the hamburger menu → Observability & Management → Events Service → Rules.
  2. Make sure the compartment is the one where you want the rule to live.
  3. Click Create Rule.

Rule Details​

  1. Name: e.g., detect-vcn-changes.
  2. Description: Alert on VCN create, update, and delete events.
  3. State: Ensure it is set to Enabled.

Define the Event Pattern​

You have two main options:

Option A: Use the Basic Pattern (Service + Event Types)​

  1. Under Rule Conditions, select:
    • Service Name: Networking (or Virtual Cloud Network depending on console wording).
  2. For Event Type, select VCN-related events such as:
    • com.oraclecloud.virtualnetwork.createvcn.end
    • com.oraclecloud.virtualnetwork.updatevcn.end
    • com.oraclecloud.virtualnetwork.deletevcn.end (Name may appear slightly differently; pick all VCN Create/Update/Delete event types).
  3. Narrow by Compartment:
    • Choose the compartment where the VCNs are/will be created (or root if you want tenancy-wide and then filter via conditions or multiple rules).

Option B: Use an Advanced Pattern (if needed)​

  1. Switch to Use a Custom Event Pattern (Advanced).
  2. Use a filter similar to:
{
  "eventType": [
    "com.oraclecloud.virtualnetwork.createvcn.end",
    "com.oraclecloud.virtualnetwork.updatevcn.end",
    "com.oraclecloud.virtualnetwork.deletevcn.end"
  ],
  "data": {
    "compartmentId": [
      "<OCID_OF_TARGET_COMPARTMENT>"
    ]
  }
}

Replace <OCID_OF_TARGET_COMPARTMENT> with your compartment OCID if you want to constrain scope.

4. Add the Action (Send Notification)​

  1. In the Actions section of the rule, click Add Action.
  2. Action Type: Notifications.
  3. Topic: Select the topic you created (vcn-change-alerts-topic).
  4. Click Add.
  5. Click Create to finalize the Event Rule.

Now, every time a VCN is created, updated, or deleted in the specified compartment(s), an event will trigger a message to your Notifications topic, which will send email (or other protocol) alerts.

5. (Optional) Integrate with Monitoring Alarms​

If you specifically want OCI Monitoring Alarms (metrics‑based) in addition to event‑based notifications:

  1. Typically, VCN configuration changes are event‑driven, not metric‑driven, so you:
    • Keep the Event Rule to push messages via Notifications to people/tools.
    • Use Monitoring Alarms for metrics (e.g., traffic, errors) separately.
  2. If you want an alarm-like behavior:
    • Create an Alarm in Observability & Management → Monitoring → Alarms for relevant network metrics (e.g., dropped packets, high traffic) and send it to the same Notifications topic.

6. Validate the Setup​

  1. Make a small, safe VCN change in the monitored compartment:
    • e.g., update the VCN display name or create a test VCN.
  2. Confirm:
    • Event Rule logs an invocation (visible in Events Service details).
    • A notification email (or other protocol message) is received at the configured subscription.

This completes remediation: OCI now has an Event Rule for VCN changes wired into your alerting via Notifications (and optionally Monitoring alarms).

Using CLI

Below are step‑by‑step OCI CLI instructions to ensure Monitoring/Alerting is in place for VCN changes by creating an Events rule that triggers a Notifications topic whenever a VCN is created/updated/deleted.

0. Prerequisites​

  • OCI CLI installed and configured (oci setup config already done).

  • Your compartment OCID is known:

    COMPARTMENT_OCID="<your_compartment_ocid>"

  • You have permission to use:

    • oci ons (Notifications)
    • oci events
    • oci iam (if you need policies)

1. (Optional) Create a Notifications Topic​

If you already have a Notifications topic you want to use, skip to step 3 and use its OCID.

TOPIC_NAME="vcn-change-topic"
TOPIC_DESC="Topic for VCN change events"

oci ons topic create \
  --name "$TOPIC_NAME" \
  --compartment-id "$COMPARTMENT_OCID" \
  --description "$TOPIC_DESC" \
  --wait-for-state ACTIVE \
  --query "data.id" \
  --raw-output

Save the output as:

TOPIC_OCID="<output_from_command_above>"

2. (Optional) Add a Subscription to the Topic​

For example, an email subscription:

SUBSCR_PROTOCOL="EMAIL"
SUBSCR_ENDPOINT="you@example.com"

oci ons subscription create \
  --compartment-id "$COMPARTMENT_OCID" \
  --topic-id "$TOPIC_OCID" \
  --protocol "$SUBSCR_PROTOCOL" \
  --endpoint "$SUBSCR_ENDPOINT" \
  --wait-for-state ACTIVE

Confirm the subscription by clicking the link in the email.

3. Create Event Rule JSON Condition for VCN Changes​

Create a file vcn-events-condition.json:

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.createvcn",
    "com.oraclecloud.virtualnetwork.updatevcn",
    "com.oraclecloud.virtualnetwork.deletevcn"
  ],
  "data": {
    "resourceName": [],
    "compartmentId": []
  }
}

You can also filter to a specific compartment or VCN by filling data.compartmentId or data.resourceName arrays, but for all VCNs, leave them empty as above.

Wrap this in the Events Rule “condition” structure (OCI requires "eventType" and "data" to be inside "conditions"):

Create vcn-rule-condition.json:

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.createvcn",
    "com.oraclecloud.virtualnetwork.updatevcn",
    "com.oraclecloud.virtualnetwork.deletevcn"
  ],
  "data": {
    "resourceName": [],
    "compartmentId": []
  }
}

The CLI expects it like this:

CONDITION_JSON=$(cat vcn-rule-condition.json | python -c 'import json,sys; print(json.dumps({"eventType": json.load(sys.stdin)["eventType"], "data": json.load(open("vcn-rule-condition.json"))["data"]}))')

To avoid confusion, simply create a single correct condition file:

Final vcn-rule-condition.json:

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.createvcn",
    "com.oraclecloud.virtualnetwork.updatevcn",
    "com.oraclecloud.virtualnetwork.deletevcn"
  ],
  "data": {
    "resourceName": [],
    "compartmentId": []
  }
}

4. Create the Events Rule​

Use the Notifications topic as the rule’s action:

RULE_DISPLAY_NAME="VCN-Change-Rule"
RULE_DESC="Triggers when VCNs are created, updated, or deleted"

oci events rule create \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$RULE_DISPLAY_NAME" \
  --is-enabled true \
  --condition "$(cat vcn-rule-condition.json)" \
  --actions '{
    "actions": [
      {
        "actionType": "ONS",
        "isEnabled": true,
        "topicId": "'"$TOPIC_OCID"'"
      }
    ]
  }' \
  --description "$RULE_DESC" \
  --wait-for-state ACTIVE

This creates a rule that:

  • Listens for these event types:
    • com.oraclecloud.virtualnetwork.createvcn
    • com.oraclecloud.virtualnetwork.updatevcn
    • com.oraclecloud.virtualnetwork.deletevcn
  • Sends a notification to the ONS topic when they occur.

5. (Optional) Verify the Rule​

List rules in the compartment:

oci events rule list \
  --compartment-id "$COMPARTMENT_OCID" \
  --all \
  --query "data[?\"display-name\"=='$RULE_DISPLAY_NAME']"

6. (Optional) Update an Existing Rule​

If a rule exists but lacks VCN events, adjust it:

  1. Get the rule OCID:

    RULE_OCID="<existing_rule_ocid>"

  2. Update the condition file with VCN event types and then run:

    oci events rule update \
      --rule-id "$RULE_OCID" \
      --condition "$(cat vcn-rule-condition.json)" \
      --force \
      --wait-for-state ACTIVE

Once these steps are done, your OCI environment will have an Events rule that alerts (via Notifications) for all VCN configuration changes, satisfying the requirement “OCI Monitoring Should Have Event Rule For VCN Changes.”

Using Python

Below is a concrete way to remediate “OCI Monitoring should have Event Rule for VCN changes” using Python and the OCI SDK.

Goal
Create an Event Rule that listens to VCN configuration changes and sends alerts (via OCI Notifications / Monitoring).

Assumptions

  • You have:
    • OCI tenancy, compartment OCID
    • Proper IAM permissions: manage events-rules, manage ons-topics, etc.
    • Working ~/.oci/config profile (or equivalent config in environment variables).
  • You want:
    • An Events rule that triggers when a VCN is created/updated/deleted.
    • An alert via Notifications (email) or similar.

1. Define what events you want to capture​

Typical VCN configuration change events come from the com.oraclecloud.virtualnetwork service and category Resource (or Api depending on how strict you want). Safe generic pattern:

{
  "eventType": "com.oraclecloud.virtualnetwork.vcn.*",
  "data": {
    "eventType": "com.oraclecloud.virtualnetwork.vcn.*"
  }
}

To be more precise, you can match:

  • com.oraclecloud.virtualnetwork.vcn.create
  • com.oraclecloud.virtualnetwork.vcn.update
  • com.oraclecloud.virtualnetwork.vcn.delete

OCI Events use an event pattern (JSON) to filter events.

2. Create (or reuse) a Notifications topic​

You generally want the Event Rule to send messages to an OCI Notifications topic, then subscribe email / HTTPS, etc.

Sample Python script: create topic (if not exists) and subscription​

import oci

config = oci.config.from_file()  # default profile and path
compartment_id = "<YOUR_COMPARTMENT_OCID>"
topic_name = "vcn-change-alerts-topic"
subscription_endpoint = "<YOUR_EMAIL_ADDRESS>"  # or HTTPS endpoint

ons_client = oci.ons.NotificationControlPlaneClient(config)

# 1. Check if topic exists
existing_topics = oci.pagination.list_call_get_all_results(
    ons_client.list_topics,
    compartment_id=compartment_id
).data

topic = next((t for t in existing_topics if t.name == topic_name), None)

# 2. Create topic if needed
if not topic:
    create_topic_details = oci.ons.models.CreateTopicDetails(
        name=topic_name,
        compartment_id=compartment_id,
        description="Alerts for VCN configuration changes"
    )
    topic = ons_client.create_topic(create_topic_details).data
    print(f"Created topic: {topic.name} ({topic.topic_id})")
else:
    print(f"Using existing topic: {topic.name} ({topic.topic_id})")

topic_id = topic.topic_id

# 3. Create subscription (email example)
ons_sub_client = oci.ons.NotificationDataPlaneClient(config)

create_sub_details = oci.ons.models.CreateSubscriptionDetails(
    compartment_id=compartment_id,
    topic_id=topic_id,
    protocol="EMAIL",  # or "HTTPS", "PAGERDUTY", "SLACK", etc.
    endpoint=subscription_endpoint,
    freeform_tags={"purpose": "vcn-change-alerts"}
)

subscription = ons_sub_client.create_subscription(create_sub_details).data
print(f"Created subscription: {subscription.id}")
print("You must confirm the subscription from your email/endpoint.")

3. Create the Event Rule for VCN changes​

Use the Events client and create a rule that:

  • Targets your compartment
  • Has an event pattern that matches VCN changes
  • Uses the Notifications topic (topic_id) as an action

Event pattern (example)​

This pattern matches all VCN events (create, update, delete):

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.vcn.create",
    "com.oraclecloud.virtualnetwork.vcn.update",
    "com.oraclecloud.virtualnetwork.vcn.delete"
  ]
}

You can further constrain by data.compartmentId or other fields if needed.

Python script to create the Event Rule​

import json
import oci

config = oci.config.from_file()
compartment_id = "<YOUR_COMPARTMENT_OCID>"
topic_id = "<YOUR_TOPIC_OCID>"  # from previous step
rule_display_name = "VCN-Change-Event-Rule"

events_client = oci.events.EventsClient(config)

# 1. Build the event pattern
event_pattern = {
    "eventType": [
        "com.oraclecloud.virtualnetwork.vcn.create",
        "com.oraclecloud.virtualnetwork.vcn.update",
        "com.oraclecloud.virtualnetwork.vcn.delete"
    ]
    # You could optionally add more filters like:
    # "data": {
    #     "compartmentId": ["<YOUR_COMPARTMENT_OCID>"]
    # }
}

# 2. Define the action to send to Notifications
action = oci.events.models.CreateRuleActionDetails(
    action_type="ONS",
    is_enabled=True,
    description="Send VCN change events to Notifications topic",
    topic_id=topic_id
)

# 3. Build the rule details
create_rule_details = oci.events.models.CreateRuleDetails(
    compartment_id=compartment_id,
    display_name=rule_display_name,
    is_enabled=True,
    condition=event_pattern,
    actions=oci.events.models.Actions(
        actions=[action]
    ),
    description="Rule that triggers on VCN create/update/delete events"
)

# 4. Check if rule already exists
existing_rules = oci.pagination.list_call_get_all_results(
    events_client.list_rules,
    compartment_id=compartment_id
).data

rule = next((r for r in existing_rules if r.display_name == rule_display_name), None)

if rule:
    print(f"Rule '{rule_display_name}' already exists: {rule.id}")
else:
    # 5. Create the rule
    response = events_client.create_rule(create_rule_details)
    rule = response.data
    print(f"Created rule: {rule.display_name} ({rule.id})")
    print("Event Rule for VCN changes is now active.")

4. (Optional) Integrate with Monitoring Alarms​

If your security standard specifically wants Monitoring service to raise alarms from events, you can:

  1. Use Event Rule → Notifications → custom HTTPS endpoint.
  2. That endpoint can push metrics (via oci.monitoring.MonitoringClient) and then:
  3. Create a Monitoring Alarm on those custom metrics.

However, for most CSPM requirements, having an Event Rule + Notifications alert is sufficient and is what “OCI Monitoring / Alerting” usually refers to at policy level.

5. Validation​

  1. Confirm Notifications subscription.
  2. Create/update/delete a test VCN in the compartment.
  3. Verify that:
    • Event shows in OCI Console → Observability & Management → Events.
    • Notification is received at your configured endpoint.

If you paste your compartment OCID and preferred channel (email/HTTPS/Slack/PagerDuty), I can adjust the Python snippets exactly to your environment.

Using Terraform
resource "oci_events_rule" "vcn_lifecycle_events" {
  # Monitors VCN lifecycle events and routes them to an Alerting/Notifications target.
  compartment_id = "COMPARTMENT_OCID"         # replace with the OCID of the compartment to monitor
  display_name   = "VCN-Lifecycle-Events-Rule"

  is_enabled = true

  # Track create, update, and delete operations for VCNs.
  # You can narrow this to a specific compartment/VCN using an additional "data" filter if required.
  condition = <<EOT
{
  "eventType": [
    "com.oraclecloud.virtualnetwork.createvcn",
    "com.oraclecloud.virtualnetwork.updatevcn",
    "com.oraclecloud.virtualnetwork.deletevcn"
  ]
}
EOT

  actions {
    # Example: send the events to an existing Notifications topic that you plug into OCI Monitoring/Alerting.
    actions {
      action_type = "ONS"
      is_enabled  = true
      description = "Route VCN lifecycle events to Alerting/Monitoring"

      topic_id = "OCI_ONS_TOPIC_OCID"         # replace with the OCID of an ONS Notifications topic
    }

    # If you use Streaming, Functions, or other targets, add additional `actions {}` blocks here.
  }

  # Optional: freeform_tags or defined_tags if you use tagging standards
  # freeform_tags = {
  #   "Owner" = "NETWORK_TEAM"
  # }
}

This change does not force replacement of other resources; it only creates or updates the oci_events_rule itself.

For verification, terraform plan should show this oci_events_rule.vcn_lifecycle_events being created (or updated if you are adding the condition to an existing rule), with is_enabled = true and the condition JSON listing the three com.oraclecloud.virtualnetwork.*vcn event types.