Skip to main content

OCI Monitoring Should Have Network Change Alarm Configured

More Info:​

An alarm must exist for MfaRequirementViolation. This ensures security administrators are immediately notified if a user attempts to bypass Multi-Factor Authentication constraints.

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • HIPAA
  • HITRUST CSF
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Below are concise, console-based steps to configure alerts for network changes in OCI (VCNs, subnets, security lists, route tables, etc.).

Note: In OCI, configuration changes like network changes are best captured with the Events Service + Notifications, not classic Monitoring metrics. This is still part of “alerting/monitoring” in OCI.

1. Create a Notifications Topic​

  1. In the OCI Console, open the navigation menu:
    Observability & Management → Notifications → Topics.
  2. Click Create Topic.
  3. Enter:
    • Name: e.g., network-change-alerts
    • Description: e.g., Alerts for OCI network configuration changes
    • Compartment: select appropriate compartment.
  4. Click Create.

2. Subscribe Your Alert Recipients​

  1. Open the topic you just created (network-change-alerts).
  2. Under Subscriptions, click Create Subscription.
  3. Select Protocol (e.g., Email).
  4. Enter the Email address (or HTTPS/Slack, etc., as required).
  5. Click Create.
  6. Confirm the subscription using the link sent to the email (or configure the chosen protocol endpoint).

3. Create an Events Rule for Network Changes​

  1. In the navigation menu:
    Observability & Management → Events Service → Rules.

  2. Click Create Rule.

  3. Enter:

    • Name: e.g., network-configuration-changes
    • Description: e.g., Trigger on create/update/delete of networking resources
    • Status: leave as Enabled.
    • Compartment: the tenancy/compartment where you want to detect changes.
      • If you want tenant-wide coverage, choose the root compartment.

  4. Under Rule Conditions:

    • Choose Event Type:
      Select “Service = Virtual Cloud Network (VCN)” (or “Core Services” depending on UI version) and pick events like:

      • CreateVcn, UpdateVcn, DeleteVcn
      • CreateSubnet, UpdateSubnet, DeleteSubnet
      • CreateRouteTable, UpdateRouteTable, DeleteRouteTable
      • CreateSecurityList, UpdateSecurityList, DeleteSecurityList
      • CreateNetworkSecurityGroup, UpdateNetworkSecurityGroup, DeleteNetworkSecurityGroup
      • CreateInternetGateway, UpdateInternetGateway, DeleteInternetGateway
      • CreateLocalPeeringGateway, UpdateLocalPeeringGateway, DeleteLocalPeeringGateway
      • CreateDrg, UpdateDrg, DeleteDrg (and attachments, as available)

    • In some consoles, you instead define a Rule Condition (JSON). Example pattern:

      {
        "eventType": [
          "com.oraclecloud.vcn.createvcn",
          "com.oraclecloud.vcn.updatevcn",
          "com.oraclecloud.vcn.deletevcn",
          "com.oraclecloud.vcn.createsubnet",
          "com.oraclecloud.vcn.updatesubnet",
          "com.oraclecloud.vcn.deletesubnet",
          "com.oraclecloud.vcn.createroutetable",
          "com.oraclecloud.vcn.updateroutetable",
          "com.oraclecloud.vcn.deleteroutetable",
          "com.oraclecloud.vcn.createsecuritylist",
          "com.oraclecloud.vcn.updatesecuritylist",
          "com.oraclecloud.vcn.deletesecuritylist",
          "com.oraclecloud.vcn.createnetworksecuritygroup",
          "com.oraclecloud.vcn.updatenetworksecuritygroup",
          "com.oraclecloud.vcn.deletenetworksecuritygroup",
          "com.oraclecloud.vcn.createinternetgateway",
          "com.oraclecloud.vcn.updateinternetgateway",
          "com.oraclecloud.vcn.deleteinternetgateway"
        ]
      }

    • Adjust resource/event types to align with your requirements and what’s available in your region/tenant.

  5. Under Actions:

    • Click Add Action.
    • Action Type: Notifications.
    • Topic: select the topic network-change-alerts.

  6. Click Create Rule.

4. (Optional) Scope and Filter More Precisely​

  • If required, refine with conditions on compartments, VCN OCIDs, or tags in the rule’s JSON pattern, to limit alerts to production or specific networks.

5. Test the Alert​

  1. Make a safe change, e.g., modify a test security list or test route table.
  2. Confirm:
    • The event is recorded (check Events → Recent Events).
    • An email (or other protocol) notification is received.

If you want instructions specifically for one network resource type (e.g., only security list changes), list that, and I’ll give an exact event pattern for it.

Using CLI

Below is a concise, CLI‑only way to configure an OCI “network change” alert using Events + Notifications (this is how you detect config changes in networking; Monitoring alarms are metric-based and don’t see config changes directly).

Replace all placeholder values (<...>) with your own.

1. Set variables (shell)​

export COMPARTMENT_OCID="<compartment-ocid>"
export TOPIC_NAME="network-change-alerts"
export EMAIL_ADDRESS="<you@example.com>"
export RULE_NAME="network-change-rule"

2. Create a Notifications Topic​

oci ons topic create \
  --compartment-id "$COMPARTMENT_OCID" \
  --name "$TOPIC_NAME" \
  --description "Alerts for OCI network configuration changes" \
  --query 'data.id' \
  --raw-output

Save the returned Topic OCID:

export TOPIC_OCID="<topic-ocid-returned-above>"

3. Create a Subscription (e.g., Email)​

oci ons subscription create \
  --topic-id "$TOPIC_OCID" \
  --protocol EMAIL \
  --endpoint "$EMAIL_ADDRESS"

Check your email and confirm the subscription.

4. Create an Events Rule for Network Changes​

Example: watch for creation, update, deletion of VCNs, Subnets, Security Lists, NSGs, and Route Tables.

Create a JSON file for the condition (e.g. network-condition.json):

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.vcn.create",
    "com.oraclecloud.virtualnetwork.vcn.update",
    "com.oraclecloud.virtualnetwork.vcn.delete",
    "com.oraclecloud.virtualnetwork.subnet.create",
    "com.oraclecloud.virtualnetwork.subnet.update",
    "com.oraclecloud.virtualnetwork.subnet.delete",
    "com.oraclecloud.virtualnetwork.securitylist.create",
    "com.oraclecloud.virtualnetwork.securitylist.update",
    "com.oraclecloud.virtualnetwork.securitylist.delete",
   "com.oraclecloud.virtualnetwork.networksecuritygroup.create",
    "com.oraclecloud.virtualnetwork.networksecuritygroup.update",
    "com.oraclecloud.virtualnetwork.networksecuritygroup.delete",
    "com.oraclecloud.virtualnetwork.routetable.create",
    "com.oraclecloud.virtualnetwork.routetable.update",
    "com.oraclecloud.virtualnetwork.routetable.delete"
  ],
  "data": {
    "additionalDetails": {
      "compartmentId": "<compartment-ocid>"
    }
  }
}

Create a JSON file for actions (e.g. network-actions.json):

{
  "actions": [
    {
      "actionType": "ONS",
      "isEnabled": true,
      "description": "Send notification on network configuration change",
      "topicId": "<topic-ocid>"
    }
  ]
}

Now create the Events rule:

oci events rule create \
  --display-name "$RULE_NAME" \
  --compartment-id "$COMPARTMENT_OCID" \
  --is-enabled true \
  --condition "$(cat network-condition.json)" \
  --actions "$(cat network-actions.json)"

5. Validate​

Make a small network change (e.g., update a security list description) and confirm you receive an email.

This setup satisfies the “network change alarm” requirement for OCI by using Events + Notifications to alert on network configuration changes, callable and fully manageable via OCI CLI.

Using Python

Below is how you can remediate this by programmatically creating a network-change alarm in OCI Monitoring using Python, wired to OCI Notifications.

The example assumes:

  • You want an alarm on unusual network activity (e.g., high egress traffic) as a proxy for potential network changes/abuse.
  • You’re using the OCI Python SDK and a config file (~/.oci/config).

1. Prerequisites​

  1. Install/upgrade the OCI Python SDK:

    pip install --upgrade oci

  2. Ensure your ~/.oci/config has:

    [DEFAULT]
    user=ocid1.user.oc1..xxxx
    fingerprint=xx:xx:xx:xx
    key_file=/path/to/oci_api_key.pem
    tenancy=ocid1.tenancy.oc1..xxxx
    region=us-phoenix-1

  3. Get required OCIDs:

    • compartment_ocid where your network resources (VCNs, VNics) live.

2. Create a Notifications Topic (destination for the alarm)​

import oci

config = oci.config.from_file()  # default profile
compartment_id = "ocid1.compartment.oc1..xxxxx"   # replace with your compartment OCID
topic_name = "network-change-alerts-topic"

ons_client = oci.ons.NotificationControlPlaneClient(config)

create_topic_details = oci.ons.models.CreateTopicDetails(
    name=topic_name,
    compartment_id=compartment_id,
    description="Topic for network change / anomaly alerts"
)

topic = ons_client.create_topic(create_topic_details).data
topic_ocid = topic.topic_id
print("Created topic:", topic_ocid)

Optionally, add a subscription (email, Slack via HTTPS, etc.):

subscription_details = oci.ons.models.CreateSubscriptionDetails(
    topic_id=topic_ocid,
    protocol="EMAIL",               # or HTTPS, PAGERDUTY, etc.
    endpoint="you@example.com"
)

subscription = ons_client.create_subscription(subscription_details).data
print("Created subscription:", subscription.id)

3. Create the Network Alarm in Monitoring​

Example: alarm on sudden high egress bytes on VNics (you can tune the query and threshold for your environment).

Example Metric Query​

For VNics (namespace oci_vcn, metric VnicEgressBytes):

Query (MQL):

sum(metric[1m].VnicEgressBytes) > 100000000
  • metric[1m] → 1-minute aggregation windows
  • sum(...) → sum across resources
  • > 100000000 → threshold (e.g., >100MB/min) – adjust as needed

Python: Create the Alarm​

from datetime import datetime
from oci.monitoring import MonitoringClient
from oci.monitoring.models import CreateAlarmDetails

monitoring_client = MonitoringClient(config)

alarm_display_name = "Network Egress Spike Alarm"
alarm_query = "sum(metric[1m].VnicEgressBytes) > 100000000"  # adjust threshold

create_alarm_details = CreateAlarmDetails(
    compartment_id=compartment_id,
    display_name=alarm_display_name,
    metric_compartment_id=compartment_id,      # compartment where VNics live
    namespace="oci_vcn",
    query=alarm_query,
    severity="CRITICAL",                       # INFO | WARNING | ERROR | CRITICAL
    destinations=[topic_ocid],                 # Notifications topic
    is_enabled=True,
    repeat_notification_duration="PT15M",      # re-notify every 15 min while in alarm
    pending_duration="PT5M",                   # must breach for 5 min before firing
    resolution="1m",                           # metric resolution
    body="High network egress detected – possible network change or data exfiltration.",
    message_format="TEXT",                     # or "JSON"
)

alarm = monitoring_client.create_alarm(create_alarm_details).data
print("Created alarm:", alarm.id)

4. Hardening / “Network Change” Angle​

To more closely align with “network change”:

  • Add multiple alarms, for example:
    • Egress & ingress volume spikes: VnicEgressBytes, VnicIngressBytes
    • Connection count spikes (if you collect such custom metrics).
  • Narrow the metrics using resourceGroup or dimension filters in the query if you want to monitor only specific VCNs / VNics.

Example with a dimension filter for a specific VCN OCID:

sum(metric[1m].VnicEgressBytes{vcnId="ocid1.vcn.oc1..xxxxx"}) > 50000000

Use that exact query string in alarm_query.

5. Verify​

  1. In OCI Console → Observability & Management → Alarms:
    • Confirm the alarm appears and is Enabled.
  2. Generate test network traffic to cross the threshold, or temporarily lower the threshold.
  3. Confirm:
    • Alarm state changes to FIRING.
    • Notification (email, etc.) is received.

This fulfills the requirement “OCI Monitoring Should Have Network Change Alarm Configured” by implementing a programmatically managed Monitoring alarm and notifications pipeline using Python.

Using Terraform
resource "oci_monitoring_alarm" "mfa_requirement_violation_alarm" {
  # Replace with your OCIDs and notification destination
  compartment_id = "OCID_OF_TARGET_COMPARTMENT"
  display_name   = "MFA Requirement Violation Alarm"

  # This is the key part: monitor the MfaRequirementViolation metric
  # Adjust namespace / dimension filters if your tenancy uses a different convention
  query = "MfaRequirementViolation[1m].sum() > 0"

  # Alarm behavior
  is_enabled          = true
  severity            = "CRITICAL"
  body                = "MFA requirement was violated. Investigate immediately."
  message_format      = "TEXT"
  metric_compartment_id = "OCID_OF_TARGET_COMPARTMENT"

  # At least one notification destination (e.g., OCI Notifications topic)
  destinations = [
    "OCID_OF_OCI_NOTIFICATIONS_TOPIC",
  ]

  # Optional: how often the alarm is evaluated
  resolution = "1m"

  # Optional: notify on state transitions
  pending_duration = "PT1M"
  repeat_notification_duration = "PT0S"

  # Optional: suppress reminders when in OK state
  # is_notifications_per_rule_enabled = false

  # Optional tags
  freeform_tags = {
    OWNER = "TEAM_NAME"
    ENV   = "ENVIRONMENT_NAME"
  }
}

This configuration does not force replacement of any existing alarm; it creates (or manages) an alarm specifically for the MfaRequirementViolation metric with a threshold of > 0 over a 1‑minute window.

To verify, terraform plan should show this alarm resource with + create (or, if you are importing an existing alarm to manage it, only the drifted fields being updated and no -/+ replacement).