Skip to main content

OCI Monitoring Should Have Local Authentication Alarm

More Info:​

Alert on LocalAuthentication usage. Organizations using federated SSO should heavily scrutinize local logins, as they bypass enterprise identity controls and conditional access policies.

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HIPAA
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Below are step‑by‑step instructions to configure a Monitoring alarm in OCI Console that alerts when local authentication is used (e.g., local IAM users logging into the Console).

Because metric and dimension names can vary slightly by tenancy/region, I’ll show you how to find the right metric interactively and then wire it into an alarm.

1. Open Monitoring → Alarms​

  1. Sign in to the OCI Console.
  2. In the left menu, go to:
    Observability & Management → Monitoring → Alarms.
  3. Make sure you’re in the correct region and compartment (top-left selectors).

2. Start Creating the Alarm​

  1. Click Create alarm.
  2. Enter:
    • Alarm name: e.g. local-authentication-alarm
    • Alarm severity: typically Critical or Warning.
    • Alarm compartment: your security/monitoring compartment.

3. Select the Metric for Local Authentication​

  1. Under Alarm body, click Select metric.
  2. In the Metric namespace dropdown, choose the IAM/Authentication namespace (commonly something like):
    • oci_iam_authentication
      or search for iam, identity, or auth in the namespace box.
  3. In the Metric name dropdown, look for a metric that records authentication attempts, e.g.:
    • AuthenticationRequests, AuthenticationSuccess, AuthenticationFailures
      (the exact name may differ; you can see a preview graph when selected).
  4. Once a likely metric is selected, use the Dimensions panel to filter for local authentication. Look for dimensions such as:
    • identityProviderType or authenticationMethod = LOCAL or LOCAL_USER
    • or similar wording indicating “local” vs “federated/SAML”.
  5. Apply the filter. Confirm the metric graph now shows data only for local-auth events.

If you don’t see any local events, try:

  • Removing all filters and then
  • Adding filters one-by-one while watching how the graph changes to locate the “local” dimension value.

4. Define the Alarm Query / Condition​

  1. After metric selection and filters, OCI will build a Monitoring Query Language (MQL) expression for you.

  2. Typical pattern (example – yours will be auto-generated):

    oci_iam_authentication[5m]{identityProviderType="LOCAL"}.count() > 0

    or something similar generated by the console.

  3. Set:

    • Interval (e.g. 5 minutes)
    • Trigger rule:
      • Condition: >
      • Threshold: 0
      • Breaching duration: e.g. 1 interval.

This means: “If any local authentication occurs in the last 5 minutes, fire the alarm.”

5. Configure Notifications​

  1. Under Notifications, choose an existing topic or click Create a topic (this opens the Notifications service):
    • Add email addresses, Slack/HTTPS, PagerDuty, etc., as subscriptions for this topic.
  2. Back in the alarm form, select that topic as the Destination.
  3. Optionally, customize:
    • Alarm message (include “Local authentication detected”)
    • Repeat notification frequency.

6. Set Alarm State Management​

Configure:

  • Auto-resolve: enabled (so alarm returns to OK when condition clears).
  • Suppression (optional): e.g., suppress after firing to avoid notification storms.

7. Review and Create​

  1. Review all details:
    • Correct compartment + region
    • Metric namespace/name
    • Filter for local authentication
    • Condition > 0 over a short period
    • Notification topic configured
  2. Click Create alarm.

8. Test the Alarm​

  1. Trigger a local authentication (sign in with a local IAM user) or wait for one to occur.
  2. Check:
    • Monitoring → Alarms: alarm state should change to FIRING when a local auth occurs.
    • Your email/notification channel receives the alert.

If it doesn’t fire, adjust:

  • Metric dimensions (ensure you’re truly filtering for the LOCAL value),
  • Interval and threshold (maybe volume is low; try longer window like 15m).

This completes remediation: you now have an OCI Monitoring alarm that detects and alerts on local authentication events via the OCI Console.

Using CLI

Below is a concise, CLI‑only way to remediate “OCI Monitoring Should Have Local Authentication Alarm Configured” by creating an alarm that fires when there are local console sign‑ins.

Assumptions (adjust as needed):

  • You want to alert on any local console sign‑in in a given compartment.
  • Metric namespace: oci_identity
  • Metric name: ConsoleSignins
  • Dimension for auth method: authType (value LOCAL for local auth)

1. Set common variables​

# IDs to reuse
COMPARTMENT_OCID="<your_compartment_ocid>"
REGION="<your_region>"           # e.g. us-phoenix-1
ALARM_DISPLAY_NAME="Local Authentication Console Sign-ins Alarm"
ALARM_DESC="Alarm when any local authentication console sign-in occurs."
TOPIC_NAME="local-auth-alerts-topic"

2. Create an ONS topic for alerts​

oci ons topic create \
  --name "$TOPIC_NAME" \
  --compartment-id "$COMPARTMENT_OCID" \
  --region "$REGION"

Note the ocid of the topic from the output (call it TOPIC_OCID).

3. (Optional) Add a subscription (email, pager, etc.)​

SUBS_PROTOCOL="EMAIL"
SUBS_ENDPOINT="security-team@example.com"

oci ons subscription create \
  --topic-id "$TOPIC_OCID" \
  --protocol "$SUBS_PROTOCOL" \
  --endpoint "$SUBS_ENDPOINT" \
  --region "$REGION"

Confirm the subscription via email (if using email).

4. Confirm metric and dimensions (one‑time validation)​

Run once to see actual metric/dimension names in your tenancy:

oci monitoring metric-data summarize-metrics-data \
  --compartment-id "$COMPARTMENT_OCID" \
  --namespace "oci_identity" \
  --query-text "ConsoleSignins[5m].sum()" \
  --region "$REGION"

Look in the response for:

  • name: ConsoleSignins
  • Dimensions, including something like authType (value LOCAL for local auth).
    If the dimension name/value differs, update the query in step 5 accordingly.

5. Create the alarm for local authentication​

Example: trigger when any local sign‑in occurs in a 5‑minute window.

TOPIC_OCID="<topic_ocid_from_step_2>"

oci monitoring alarm create \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$ALARM_DISPLAY_NAME" \
  --description "$ALARM_DESC" \
  --metric-compartment-id "$COMPARTMENT_OCID" \
  --namespace "oci_identity" \
  --severity "CRITICAL" \
  --is-enabled true \
  --query-text 'ConsoleSignins[5m]{authType="LOCAL"}.sum() > 0' \
  --destinations "[\"$TOPIC_OCID\"]" \
  --pending-duration "PT1M" \
  --region "$REGION"

Key parts:

  • ConsoleSignins[5m]{authType="LOCAL"}.sum() > 0
    • Filters to local auth sign‑ins.
    • Sums them over 5 minutes.
    • Fires if more than 0 events occur.

Adjust:

  • pending-duration for how long the condition must hold (e.g. PT5M).
  • Add more filters (e.g., status="SUCCESS" or region).

6. Verify the alarm​

List alarms:

oci monitoring alarm list \
  --compartment-id "$COMPARTMENT_OCID" \
  --region "$REGION"

Check alarm status and configuration:

ALARM_OCID="<alarm_ocid_from_list>"

oci monitoring alarm get \
  --alarm-id "$ALARM_OCID" \
  --region "$REGION"

Once this alarm exists and is enabled, the “OCI Monitoring Should Have Local Authentication Alarm Configured” requirement is typically satisfied, as you now have a monitoring alarm explicitly detecting local authentication events.

Using Python

Below is one practical way to meet the requirement “OCI Monitoring Should Have Local Authentication Alarm Configured” using Python:

Idea:

  1. Turn local authentication events into a custom metric (via Logging → Service Connector → Monitoring).
  2. Create an alarm in OCI Monitoring that fires whenever the metric shows any local logins.
  3. Do step 2 with Python.

1. Prerequisites​

  • OCI Python SDK installed: 
    pip install oci
  • A working ~/.oci/config file (or equivalent config in code).
  • Permissions for:
    • Logging
    • Service Connector Hub
    • Monitoring
    • Notifications (if you want email/Slack/etc.)

2. Enable/Confirm Logging for Local Authentication​

  1. In OCI Console:
    • Go to Identity & Security → Identity Domains (or IAM, depending on your tenancy type).
    • Open your Identity Domain.
    • Go to Security → Logs (or Audit Logs / Security Events Logs).
    • Ensure SecurityEvents / Authentication (or similar) logs are enabled.
    • These logs contain events for local authentication (local user passwords, etc.).

You need these logs as the source for your metric.

3. Create a Service Connector: Logs → Monitoring (Custom Metric)​

You can do this via console (simpler) or via Terraform/SDK. Minimal console steps:

  1. Go to Developer Services → Service Connector Hub → Service Connectors → Create Service Connector.
  2. Source:
    • Type: Logging
    • Select the Log Group where your Security / Authentication / Local auth logs are emitted.
  3. Target:
    • Type: Monitoring
    • Choose a Namespace, e.g. security_custom.
    • Choose a Metric name, e.g. local_authentication_count.
  4. Transformation / Filter:
    • Add a log filter that only matches local authentication events.
      Example (pseudocode style filter – adapt to actual log field names): 
      data.eventType = "LOCAL_AUTHENTICATION"
    • In the metric mapping, set:
      • value: 1
      • dimensions: include things like userName, authMethod, etc. if available.
  5. Save and activate the Service Connector.

Result: Every local authentication log produces +1 on metric:

  • Namespace: security_custom
  • Metric: local_authentication_count

4. Decide on Alarm Condition​

Common requirement: alarm on any local auth in last X minutes. Example:

query:
  security_custom.local_authentication_count[5m].sum() > 0

This means: if at least 1 local auth in the last 5 minutes, trigger the alarm.

5. Python Script to Create the OCI Monitoring Alarm​

Below is example code using the OCI Python SDK.

What it does:

  • Uses a profile from ~/.oci/config (e.g. DEFAULT).
  • Creates an alarm on the metric from step 3.
  • Sends alarm notifications to an OCI Notifications topic.
import oci
from oci.monitoring import MonitoringClient
from oci.monitoring.models import (
    CreateAlarmDetails,
    AlarmBody,
    AlarmDimension,
    AlarmSuppression
)

# --- CONFIG SECTION (edit these values) ---

CONFIG_PROFILE = "DEFAULT"  # or whatever profile in ~/.oci/config
COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxxx"
# Notification topic for alarm (OCI Notifications)
TOPIC_OCID = "ocid1.onstopic.oc1..xxxxx"

# Monitoring metric info (must match your Service Connector config)
NAMESPACE = "security_custom"
METRIC_NAME = "local_authentication_count"

# --- END CONFIG SECTION ---

config = oci.config.from_file("~/.oci/config", CONFIG_PROFILE)
monitoring_client = MonitoringClient(config)

alarm_expression = (
    f"{NAMESPACE}.{METRIC_NAME}[5m].sum() > 0"
)

create_alarm_details = CreateAlarmDetails(
    display_name="Local Authentication Detected",
    compartment_id=COMPARTMENT_OCID,
    namespace=NAMESPACE,
    query=alarm_expression,
    severity="CRITICAL",  # or "ERROR", "WARNING", etc.
    destinations=[TOPIC_OCID],
    # The body displayed in Notifications
    body="Alarm triggered: Local authentication activity detected.",
    is_enabled=True,
    # Evaluate every minute; adjust as needed
    resolution="1m",
    # If you want to avoid repeated notifications, you can control repeat notifications:
    repeat_notification_duration="PT30M",  # ISO 8601, e.g. every 30 min
    # Docs: https://docs.oracle.com/en-us/iaas/tools/python/latest/api/monitoring/models/oci.monitoring.models.CreateAlarmDetails.html
)

response = monitoring_client.create_alarm(create_alarm_details)
print("Created alarm OCID:", response.data.id)

Notes​

  • query format is:
    namespace.metric_name[window].statistic() <operator> value
  • Window: [5m] = last 5 minutes.
  • Statistic: .sum() here. You can also use .count() or .max() depending on how you emit the metric.

6. Test​

  1. Perform a test local authentication (e.g., sign in as a local user).
  2. Confirm:
    • Log entry appears in the Security/Authentication logs.
    • Service Connector sends data to Monitoring (you can view the metric under Monitoring → Metrics Explorer using security_custom namespace).
    • The alarm triggers and sends a notification to the configured topic.

If you share the exact log shape (sample JSON for a local auth event), I can give you a more precise filter expression and metric mapping for the Service Connector.

Using Terraform
# This finding cannot be remediated directly on `oci_monitoring_alarm` alone,
# because Monitoring alarms in OCI can trigger only on METRICS, while
# "LocalAuthentication" is an audit/log event and is not exposed as a native metric.

# To alert on LocalAuthentication usage you must:
# 1. In OCI Logging / Audit, route LocalAuthentication events (from Audit or Identity)
#    through a Service Connector into a custom Monitoring metric.
# 2. THEN create an `oci_monitoring_alarm` on that custom metric, something like:

resource "oci_monitoring_alarm" "local_authentication_alarm" {
  compartment_id  = var.COMPartment_OCID   # replace with your compartment OCID
  display_name    = "LocalAuthentication Usage Alarm"
  is_enabled      = true
  namespace       = "custom_namespace"     # replace with the namespace used by your custom metric
  query           = "custom_namespace.custom_local_auth_metric[1m].sum() > 0"
  severity        = "CRITICAL"
  destinations    = [oci_ons_notification_topic.local_auth_topic.id]

  # optional tuning
  pending_duration = "PT5M"                # example: fire if condition holds for 5 minutes
  repeat_notification_duration = "PT1H"    # example: repeat at most once per hour
}

resource "oci_ons_notification_topic" "local_auth_topic" {
  compartment_id = var.COMPartment_OCID   # same compartment as above
  name           = "local-auth-alerts"
  description    = "Alerts for LocalAuthentication usage"
}

# You must first ensure that:
# - A Service Connector (or equivalent pipeline) is pushing a metric named
#   `custom_local_auth_metric` in namespace `custom_namespace` whenever a
#   LocalAuthentication event occurs.
# That Service Connector and log routing are configured in Logging/Service Connector Hub,
# not via `oci_monitoring_alarm`, and may need to be created via separate Terraform.

# Verification: after wiring the custom metric pipeline and this alarm, `terraform plan`
# should show creation of `oci_ons_notification_topic.local_auth_topic` and
# `oci_monitoring_alarm.local_authentication_alarm` with the desired query and no diffs
# on unrelated resources.