Oci Monitoring No Local Auth Alarm Remediation

Triage and Remediation

Remediation

Remediation

Using Console

Below are step‑by‑step instructions to configure a Monitoring alarm in OCI Console that alerts when local authentication is used (e.g., local IAM users logging into the Console).

Because metric and dimension names can vary slightly by tenancy/region, I’ll show you how to find the right metric interactively and then wire it into an alarm.

1. Open Monitoring → Alarms

Sign in to the OCI Console.
In the left menu, go to:
Observability & Management → Monitoring → Alarms.
Make sure you’re in the correct region and compartment (top-left selectors).

2. Start Creating the Alarm

Click Create alarm.
Enter:
- Alarm name: e.g. local-authentication-alarm
- Alarm severity: typically Critical or Warning.
- Alarm compartment: your security/monitoring compartment.

3. Select the Metric for Local Authentication

Under Alarm body, click Select metric.
In the Metric namespace dropdown, choose the IAM/Authentication namespace (commonly something like):
- oci_iam_authentication
  or search for iam, identity, or auth in the namespace box.
In the Metric name dropdown, look for a metric that records authentication attempts, e.g.:
- AuthenticationRequests, AuthenticationSuccess, AuthenticationFailures
  (the exact name may differ; you can see a preview graph when selected).
Once a likely metric is selected, use the Dimensions panel to filter for local authentication. Look for dimensions such as:
- identityProviderType or authenticationMethod = LOCAL or LOCAL_USER
- or similar wording indicating “local” vs “federated/SAML”.
Apply the filter. Confirm the metric graph now shows data only for local-auth events.

If you don’t see any local events, try:

Removing all filters and then
Adding filters one-by-one while watching how the graph changes to locate the “local” dimension value.

4. Define the Alarm Query / Condition

After metric selection and filters, OCI will build a Monitoring Query Language (MQL) expression for you.
Typical pattern (example – yours will be auto-generated):
```
oci_iam_authentication[5m]{identityProviderType="LOCAL"}.count() > 0
```
or something similar generated by the console.
Set:
- Interval (e.g. 5 minutes)
- Trigger rule:
  - Condition: >
  - Threshold: 0
  - Breaching duration: e.g. 1 interval.

This means: “If any local authentication occurs in the last 5 minutes, fire the alarm.”

5. Configure Notifications

Under Notifications, choose an existing topic or click Create a topic (this opens the Notifications service):
- Add email addresses, Slack/HTTPS, PagerDuty, etc., as subscriptions for this topic.
Back in the alarm form, select that topic as the Destination.
Optionally, customize:
- Alarm message (include “Local authentication detected”)
- Repeat notification frequency.

6. Set Alarm State Management

Configure:

Auto-resolve: enabled (so alarm returns to OK when condition clears).
Suppression (optional): e.g., suppress after firing to avoid notification storms.

7. Review and Create

Review all details:
- Correct compartment + region
- Metric namespace/name
- Filter for local authentication
- Condition > 0 over a short period
- Notification topic configured
Click Create alarm.

8. Test the Alarm

Trigger a local authentication (sign in with a local IAM user) or wait for one to occur.
Check:
- Monitoring → Alarms: alarm state should change to FIRING when a local auth occurs.
- Your email/notification channel receives the alert.

If it doesn’t fire, adjust:

Metric dimensions (ensure you’re truly filtering for the LOCAL value),
Interval and threshold (maybe volume is low; try longer window like 15m).

This completes remediation: you now have an OCI Monitoring alarm that detects and alerts on local authentication events via the OCI Console.

Using CLI

Below is a concise, CLI‑only way to remediate “OCI Monitoring Should Have Local Authentication Alarm Configured” by creating an alarm that fires when there are local console sign‑ins.

Assumptions (adjust as needed):

You want to alert on any local console sign‑in in a given compartment.

Metric namespace: oci_identity

Metric name: ConsoleSignins

Dimension for auth method: authType (value LOCAL for local auth)

1. Set common variables

# IDs to reuse
COMPARTMENT_OCID="<your_compartment_ocid>"
REGION="<your_region>"           # e.g. us-phoenix-1
ALARM_DISPLAY_NAME="Local Authentication Console Sign-ins Alarm"
ALARM_DESC="Alarm when any local authentication console sign-in occurs."
TOPIC_NAME="local-auth-alerts-topic"

2. Create an ONS topic for alerts

oci ons topic create \
  --name "$TOPIC_NAME" \
  --compartment-id "$COMPARTMENT_OCID" \
  --region "$REGION"

Note the ocid of the topic from the output (call it TOPIC_OCID).

SUBS_PROTOCOL="EMAIL"
SUBS_ENDPOINT="security-team@example.com"

oci ons subscription create \
  --topic-id "$TOPIC_OCID" \
  --protocol "$SUBS_PROTOCOL" \
  --endpoint "$SUBS_ENDPOINT" \
  --region "$REGION"

Confirm the subscription via email (if using email).

4. Confirm metric and dimensions (one‑time validation)

Run once to see actual metric/dimension names in your tenancy:

oci monitoring metric-data summarize-metrics-data \
  --compartment-id "$COMPARTMENT_OCID" \
  --namespace "oci_identity" \
  --query-text "ConsoleSignins[5m].sum()" \
  --region "$REGION"

Look in the response for:

name: ConsoleSignins
Dimensions, including something like authType (value LOCAL for local auth).
If the dimension name/value differs, update the query in step 5 accordingly.

5. Create the alarm for local authentication

Example: trigger when any local sign‑in occurs in a 5‑minute window.

TOPIC_OCID="<topic_ocid_from_step_2>"

oci monitoring alarm create \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$ALARM_DISPLAY_NAME" \
  --description "$ALARM_DESC" \
  --metric-compartment-id "$COMPARTMENT_OCID" \
  --namespace "oci_identity" \
  --severity "CRITICAL" \
  --is-enabled true \
  --query-text 'ConsoleSignins[5m]{authType="LOCAL"}.sum() > 0' \
  --destinations "[\"$TOPIC_OCID\"]" \
  --pending-duration "PT1M" \
  --region "$REGION"

Key parts:

ConsoleSignins[5m]{authType="LOCAL"}.sum() > 0
- Filters to local auth sign‑ins.
- Sums them over 5 minutes.
- Fires if more than 0 events occur.

Adjust:

pending-duration for how long the condition must hold (e.g. PT5M).
Add more filters (e.g., status="SUCCESS" or region).

6. Verify the alarm

List alarms:

oci monitoring alarm list \
  --compartment-id "$COMPARTMENT_OCID" \
  --region "$REGION"

Check alarm status and configuration:

ALARM_OCID="<alarm_ocid_from_list>"

oci monitoring alarm get \
  --alarm-id "$ALARM_OCID" \
  --region "$REGION"

Once this alarm exists and is enabled, the “OCI Monitoring Should Have Local Authentication Alarm Configured” requirement is typically satisfied, as you now have a monitoring alarm explicitly detecting local authentication events.

Using Python

Below is one practical way to meet the requirement “OCI Monitoring Should Have Local Authentication Alarm Configured” using Python:

Idea:

Turn local authentication events into a custom metric (via Logging → Service Connector → Monitoring).
Create an alarm in OCI Monitoring that fires whenever the metric shows any local logins.
Do step 2 with Python.

1. Prerequisites

OCI Python SDK installed:
```
pip install oci
```
A working ~/.oci/config file (or equivalent config in code).
Permissions for:
- Logging
- Service Connector Hub
- Monitoring
- Notifications (if you want email/Slack/etc.)

2. Enable/Confirm Logging for Local Authentication

In OCI Console:
- Go to Identity & Security → Identity Domains (or IAM, depending on your tenancy type).
- Open your Identity Domain.
- Go to Security → Logs (or Audit Logs / Security Events Logs).
- Ensure SecurityEvents / Authentication (or similar) logs are enabled.
- These logs contain events for local authentication (local user passwords, etc.).

You need these logs as the source for your metric.

3. Create a Service Connector: Logs → Monitoring (Custom Metric)

You can do this via console (simpler) or via Terraform/SDK. Minimal console steps:

Go to Developer Services → Service Connector Hub → Service Connectors → Create Service Connector.
Source:
- Type: Logging
- Select the Log Group where your Security / Authentication / Local auth logs are emitted.
Target:
- Type: Monitoring
- Choose a Namespace, e.g. security_custom.
- Choose a Metric name, e.g. local_authentication_count.
Transformation / Filter:
- Add a log filter that only matches local authentication events.
  Example (pseudocode style filter – adapt to actual log field names):
```
data.eventType = "LOCAL_AUTHENTICATION"
```
- In the metric mapping, set:
  - value: 1
  - dimensions: include things like userName, authMethod, etc. if available.
Save and activate the Service Connector.

Result: Every local authentication log produces +1 on metric:

Namespace: security_custom
Metric: local_authentication_count

4. Decide on Alarm Condition

Common requirement: alarm on any local auth in last X minutes. Example:

query:
  security_custom.local_authentication_count[5m].sum() > 0

This means: if at least 1 local auth in the last 5 minutes, trigger the alarm.

5. Python Script to Create the OCI Monitoring Alarm

Below is example code using the OCI Python SDK.

What it does:

Uses a profile from ~/.oci/config (e.g. DEFAULT).
Creates an alarm on the metric from step 3.
Sends alarm notifications to an OCI Notifications topic.

import oci
from oci.monitoring import MonitoringClient
from oci.monitoring.models import (
    CreateAlarmDetails,
    AlarmBody,
    AlarmDimension,
    AlarmSuppression
)

# --- CONFIG SECTION (edit these values) ---

CONFIG_PROFILE = "DEFAULT"  # or whatever profile in ~/.oci/config
COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxxx"
# Notification topic for alarm (OCI Notifications)
TOPIC_OCID = "ocid1.onstopic.oc1..xxxxx"

# Monitoring metric info (must match your Service Connector config)
NAMESPACE = "security_custom"
METRIC_NAME = "local_authentication_count"

# --- END CONFIG SECTION ---

config = oci.config.from_file("~/.oci/config", CONFIG_PROFILE)
monitoring_client = MonitoringClient(config)

alarm_expression = (
    f"{NAMESPACE}.{METRIC_NAME}[5m].sum() > 0"
)

create_alarm_details = CreateAlarmDetails(
    display_name="Local Authentication Detected",
    compartment_id=COMPARTMENT_OCID,
    namespace=NAMESPACE,
    query=alarm_expression,
    severity="CRITICAL",  # or "ERROR", "WARNING", etc.
    destinations=[TOPIC_OCID],
    # The body displayed in Notifications
    body="Alarm triggered: Local authentication activity detected.",
    is_enabled=True,
    # Evaluate every minute; adjust as needed
    resolution="1m",
    # If you want to avoid repeated notifications, you can control repeat notifications:
    repeat_notification_duration="PT30M",  # ISO 8601, e.g. every 30 min
    # Docs: https://docs.oracle.com/en-us/iaas/tools/python/latest/api/monitoring/models/oci.monitoring.models.CreateAlarmDetails.html
)

response = monitoring_client.create_alarm(create_alarm_details)
print("Created alarm OCID:", response.data.id)

Notes

query format is:
namespace.metric_name[window].statistic() <operator> value
Window: [5m] = last 5 minutes.
Statistic: .sum() here. You can also use .count() or .max() depending on how you emit the metric.

6. Test

Perform a test local authentication (e.g., sign in as a local user).
Confirm:
- Log entry appears in the Security/Authentication logs.
- Service Connector sends data to Monitoring (you can view the metric under Monitoring → Metrics Explorer using security_custom namespace).
- The alarm triggers and sends a notification to the configured topic.

If you share the exact log shape (sample JSON for a local auth event), I can give you a more precise filter expression and metric mapping for the Service Connector.

Using Terraform

# This finding cannot be remediated directly on `oci_monitoring_alarm` alone,
# because Monitoring alarms in OCI can trigger only on METRICS, while
# "LocalAuthentication" is an audit/log event and is not exposed as a native metric.

# To alert on LocalAuthentication usage you must:
# 1. In OCI Logging / Audit, route LocalAuthentication events (from Audit or Identity)
#    through a Service Connector into a custom Monitoring metric.
# 2. THEN create an `oci_monitoring_alarm` on that custom metric, something like:

resource "oci_monitoring_alarm" "local_authentication_alarm" {
  compartment_id  = var.COMPartment_OCID   # replace with your compartment OCID
  display_name    = "LocalAuthentication Usage Alarm"
  is_enabled      = true
  namespace       = "custom_namespace"     # replace with the namespace used by your custom metric
  query           = "custom_namespace.custom_local_auth_metric[1m].sum() > 0"
  severity        = "CRITICAL"
  destinations    = [oci_ons_notification_topic.local_auth_topic.id]

  # optional tuning
  pending_duration = "PT5M"                # example: fire if condition holds for 5 minutes
  repeat_notification_duration = "PT1H"    # example: repeat at most once per hour
}

resource "oci_ons_notification_topic" "local_auth_topic" {
  compartment_id = var.COMPartment_OCID   # same compartment as above
  name           = "local-auth-alerts"
  description    = "Alerts for LocalAuthentication usage"
}

# You must first ensure that:
# - A Service Connector (or equivalent pipeline) is pushing a metric named
#   `custom_local_auth_metric` in namespace `custom_namespace` whenever a
#   LocalAuthentication event occurs.
# That Service Connector and log routing are configured in Logging/Service Connector Hub,
# not via `oci_monitoring_alarm`, and may need to be created via separate Terraform.

# Verification: after wiring the custom metric pipeline and this alarm, `terraform plan`
# should show creation of `oci_ons_notification_topic.local_auth_topic` and
# `oci_monitoring_alarm.local_authentication_alarm` with the desired query and no diffs
# on unrelated resources.

Triage and Remediation​

Remediation​

1. Open Monitoring → Alarms​

2. Start Creating the Alarm​

3. Select the Metric for Local Authentication​

4. Define the Alarm Query / Condition​

5. Configure Notifications​

6. Set Alarm State Management​

7. Review and Create​

8. Test the Alarm​

1. Set common variables​

2. Create an ONS topic for alerts​

3. (Optional) Add a subscription (email, pager, etc.)​

4. Confirm metric and dimensions (one‑time validation)​

5. Create the alarm for local authentication​

6. Verify the alarm​

1. Prerequisites​

2. Enable/Confirm Logging for Local Authentication​

3. Create a Service Connector: Logs → Monitoring (Custom Metric)​

4. Decide on Alarm Condition​

5. Python Script to Create the OCI Monitoring Alarm​

Notes​

6. Test​