OCI Logging Audit Service Should Be Actively Monitored

More Info:

The OCI Audit service should be actively producing events. If audit is not enabled or has zero events, security-critical activities are not being recorded for investigation.

Risk Level

Medium

Address

Compliance, Security

Compliance Standards

APRA CPS 234 (Australia)
AWS Well Architected Framework
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS AWS
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
Cloudanix Best Practice
DPDPA
Digital Operational Resilience Act (EU)
FedRAMP
GDPR
HIPAA
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST
NIST CSF
NIST SP 800-171
NYDFS 23 NYCRR 500
PCI
Reserve Bank of India (RBI) Cyber Security Framework
Reserve Bank of India (RBI) Master Direction – Information Technology Framework
SOC2
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Here’s how to actively monitor OCI Audit logs using Logging search alerts and Notifications in the OCI Console.

1. Confirm Audit Logs Are Being Collected

Sign in to the OCI Console.
Open the navigation menu → Logging → Logs.
In the top-left compartment selector, choose your root compartment (tenancy).
Filter for Service = Audit or look for a log named Audit or Audit Logs.
- If present and showing recent entries, Audit logging is active (Audit is usually always-on; you’re verifying visibility in Logging).

2. Create a Notification Topic & Subscription

You will use OCI Notifications to receive alerts (email, Slack, etc.).

Open the navigation menu → Developer Services → Notifications → Topics.
Click Create Topic.
- Name: e.g. audit-alerts-topic
- Description: e.g. Alerts for OCI Audit events
- Compartment: choose the compartment where you manage ops/security.
Click Create.

Add a subscription:

On the topic details page, click Create Subscription.
Choose protocol (e.g. Email).
Enter destination (e.g. your security team’s email).
Click Create.
Go to your email and confirm the subscription (required before alerts are delivered).

3. Build a Logging Search for Audit Events

Open the navigation menu → Logging → Logs.
In the compartment selector, choose the compartment with your Audit log (often root).
Click on the Audit log (the log resource, not a single entry).
Click Search or View Log (depending on UI version).

Use a filter query defining what you want to be alerted on. For example, to catch sensitive API calls:

Example query:

data.eventName in ("DELETE_INSTANCE", "TERMINATE_INSTANCE", "DELETE_BUCKET", "DELETE_COMPARE", "DELETE_VCN", "DELETE_SECURITY_LIST")

Or to alert on any ERROR:

data.responseStatus >= 400

Run the query and verify it returns the events you care about.

4. Create a Logging Alert from the Search

With the query loaded and validated, look for Create Alert or Save as Alert (typically near the search bar).
Click Create Alert (wording may be “Create” → “Alert Rule” or similar).

Configure the alert:

Name: e.g. High-Risk Audit API Calls Alert.
Description: e.g. Triggers when destructive or high-risk Audit events happen.
Compartment: choose where you manage security/ops resources.
Query: your tested logging query should already be populated.
Schedule:
- Choose how frequently to run (e.g. Every 5 minutes or Every 15 minutes).
Trigger condition:
- Example: “Trigger when count of matches > 0”.
Notifications:
- Select Notifications Topic and choose the topic you created: audit-alerts-topic.
Save / Create the alert.

5. Test the Alert

Perform a non-destructive test action that will generate a relevant Audit event (e.g. modify a test resource’s tag, or create/delete a small, non-critical resource, depending on your query).
Wait for the schedule interval (e.g. 5–15 minutes).
Confirm that:
- The event shows up under Logging → Audit log search.
- A notification email (or other protocol) is received.

6. Operationalize & Tune

Refine queries to:
- Include only critical services / compartments.
- Exclude known-noisy operations.
Create multiple alerts for different severities, e.g.:
- Critical destructive actions.
- IAM/Policy changes (data.eventSource = "identity").
- Unexpected regions or compartments.

With this in place, your OCI Audit Logging is actively monitored via OCI Logging, scheduled searches, and Notifications, all configured from the OCI Console.

Using CLI

Below is a minimal, step‑by‑step way to ensure OCI Audit logs are actively monitored using OCI CLI:

enable (or confirm) Audit logs are going into OCI Logging
create a metric‑based alarm on those logs with OCI Monitoring

Replace all ... placeholders (compartment OCIDs, regions, etc.) with your values.

1. Prerequisites

Make sure:

OCI CLI is configured:
```
oci setup config
```
You know:
- Tenancy OCID: ocid1.tenancy.oc1..xxxxx
- Compartment OCID for security/logging: ocid1.compartment.oc1..xxxxx
- Region: e.g., us-ashburn-1

You can set region at CLI level (recommended):

export OCI_CLI_REGION=us-ashburn-1

2. Ensure OCI Audit is sending logs to OCI Logging

OCI Audit is always on, but you must create a service log for audit in Logging so you can monitor it.

2.1 Create (or identify) a Log Group for Audit

oci logging log-group create \
  --compartment-id ocid1.compartment.oc1..COMPARTMENT_OCID \
  --display-name "security-audit-log-group" \
  --description "Log group for Audit service logs"

Save the returned "id" as LOG_GROUP_OCID.
Example:

LOG_GROUP_OCID="ocid1.loggroup.oc1..xxxx"

(If you already have a log group, you can list and pick one:)

oci logging log-group list \
  --compartment-id ocid1.compartment.oc1..COMPARTMENT_OCID

2.2 Create a service log for Audit

oci logging log create \
  --log-group-id "$LOG_GROUP_OCID" \
  --display-name "audit-service-log" \
  --log-type SERVICE \
  --is-enabled true \
  --configuration '{
    "source": {
      "category": "audit",
      "service": "audit"
    },
    "compartmentId": "ocid1.tenancy.oc1..TENANCY_OCID"
  }'

Save "id" as AUDIT_LOG_OCID (optional for later reference).

3. Create a Monitoring Alarm for Audit Logs

Typical security control: alert if no audit events occur for a certain period (e.g., 1 hour) in a tenancy or key compartment.

OCI exposes metrics for logs in namespace oci_logging. When you enabled the service log, you can now build alarms on those metrics.

3.1 Decide on alarm behavior

Example:

Trigger if no audit log entries are written for 1 hour.
Evaluation period: 1h
Severity: CRITICAL
Destination: an ONS topic (email/SNS endpoint).

First, make (or reuse) an ONS topic:

oci ons topic create \
  --compartment-id ocid1.compartment.oc1..COMPARTMENT_OCID \
  --name "audit-monitoring-topic" \
  --description "Notifications for Audit logging monitoring"

Save "topic-id" as TOPIC_OCID.

Then subscribe your email (one time only):

oci ons subscription create \
  --topic-id "$TOPIC_OCID" \
  --protocol EMAIL \
  --endpoint you@example.com

Confirm the subscription from your email.

3.2 Create the alarm

We’ll use the Logging metrics to detect when the Audit service log is completely quiet. Metric name examples: LogsVolume, LogsCount.
Below is a generic example using LogsCount — adjust as needed if your tenancy uses different metric names or dimensions.

Alarm logic: if LogsCount for our Audit log group in the last hour is 0, raise an alarm.

oci monitoring alarm create \
  --compartment-id ocid1.compartment.oc1..COMPARTMENT_OCID \
  --display-name "audit-logs-quiet-too-long" \
  --is-enabled true \
  --severity CRITICAL \
  --namespace "oci_logging" \
  --query-text "LogsCount[1h]{logGroupId = \"$LOG_GROUP_OCID\"}.sum() < 1" \
  --destinations "[\"$TOPIC_OCID\"]" \
  --pending-duration "PT0M" \
  --resolution "1h" \
  --message-format PRETTY_JSON \
  --body "No audit log entries have been ingested into Logging for at least 1 hour. Check Audit/Logging pipeline immediately." \
  --repeat-notification-duration "PT0M"

Notes:

namespace "oci_logging" is used for Logging metrics.

The exact metric name and dimensions (LogsCount, logGroupId) may vary; if necessary, list available metrics:

oci monitoring metric list \
  --compartment-id ocid1.compartment.oc1..COMPARTMENT_OCID \
  --namespace "oci_logging" \
  --group-by "name,dimensions"

Update the alarm query if your metrics differ (for example, filter by resourceDisplayName = "audit-service-log" or by sourceService = "audit" if that dimension exists).

4. (Optional) Alarm for high audit volume

You can also detect abnormal spikes (possible attack / misconfiguration). For example, alert if audit events > 10,000 in 5 minutes:

oci monitoring alarm create \
  --compartment-id ocid1.compartment.oc1..COMPARTMENT_OCID \
  --display-name "audit-logs-volume-spike" \
  --is-enabled true \
  --severity WARNING \
  --namespace "oci_logging" \
  --query-text "LogsCount[5m]{logGroupId = \"$LOG_GROUP_OCID\"}.sum() > 10000" \
  --destinations "[\"$TOPIC_OCID\"]" \
  --pending-duration "PT0M" \
  --resolution "5m" \
  --message-format PRETTY_JSON \
  --body "Audit log volume is unusually high in the past 5 minutes. Investigate potential security events or configuration issues." \
  --repeat-notification-duration "PT0M"

5. Verification

List alarms:

oci monitoring alarm list \
  --compartment-id ocid1.compartment.oc1..COMPARTMENT_OCID

Check their state:

oci monitoring alarm-status get \
  --alarm-id ocid1.alarm.oc1..ALARM_OCID

Confirm you receive email from the ONS topic when alarm triggers (you can temporarily lower thresholds or query values to force a test).

If you share the output of oci monitoring metric list --namespace oci_logging I can give you an exact --query-text tailored to your environment.

Using Python

Below is one straightforward way to “actively monitor” the OCI Audit Logging service using Python:

use the OCI Python SDK
create an ONS notification topic and subscription
create a Monitoring Alarm on Audit metrics (namespace oci_audit)

That satisfies common “actively monitored” requirements for security/compliance.

0. Prerequisites

Install OCI SDK:
```
pip install oci
```
Configure ~/.oci/config (or use instance principals) with:
- tenancy
- user
- fingerprint
- key_file
- region
- profile name (e.g., DEFAULT)

1. Create a Notification Topic and Subscription (Email) via Python

import oci

# Use DEFAULT profile in ~/.oci/config; change if needed
config = oci.config.from_file("~/.oci/config", "DEFAULT")

# Replace with your compartment OCID and email
COMPARTMENT_ID = "<your_compartment_ocid>"
EMAIL_ADDRESS = "security-team@example.com"
TOPIC_NAME = "audit-log-monitoring-topic"

ons_client = oci.ons.NotificationControlPlaneClient(config)

# 1. Create topic
create_topic_details = oci.ons.models.CreateTopicDetails(
    name=TOPIC_NAME,
    compartment_id=COMPARTMENT_ID,
    description="Topic for OCI Audit Logging monitoring alerts"
)

topic = ons_client.create_topic(create_topic_details).data
topic_ocid = topic.topic_id
print("Created topic:", topic_ocid)

# 2. Create email subscription
create_sub_details = oci.ons.models.CreateSubscriptionDetails(
    compartment_id=COMPARTMENT_ID,
    protocol="EMAIL",
    endpoint=EMAIL_ADDRESS,
    topic_id=topic_ocid
)

subscription = ons_client.create_subscription(create_sub_details).data
print("Created subscription:", subscription.id)
print("IMPORTANT: Confirm the subscription from the email that OCI sends.")

2. Create an Alarm on Audit Metrics via Python

You can monitor the Audit service using the metric namespace oci_audit.
Example: fire an alarm if the number of audit events suddenly spikes beyond a threshold.

Below example:

Metric namespace: oci_audit
Metric: audit.events.count
Condition: sum(audit.events.count) > 100 over a 5-minute window
(Tune this threshold to your environment.)
Sends notifications to the ONS topic created above.

import oci
from datetime import datetime

config = oci.config.from_file("~/.oci/config", "DEFAULT")

COMPARTMENT_ID = "<your_compartment_ocid>"
TOPIC_OCID = "<topic_ocid_from_previous_step>"

monitoring_client = oci.monitoring.MonitoringClient(config)

# Monitoring query:
#   sum(audit.events.count) [5m] > 100
# Over last 5 minutes, if sum of audit events is more than 100, alarm triggers.
#
# You can further filter by dimensions (like compartment or target service)
# with something like: {resourceId = "ocid1.tenancy.oc1..xxxxx"}

alarm_query = 'sum(audit.events.count[5m]) > 100'

from oci.monitoring.models import (
    CreateAlarmDetails,
    AlarmSuppression,
)

alarm_details = CreateAlarmDetails(
    display_name="Audit Events Spike Alarm",
    compartment_id=COMPARTMENT_ID,
    is_enabled=True,
    namespace="oci_audit",
    query=alarm_query,
    severity="CRITICAL",
    body="Audit Logging events count exceeded expected threshold.",
    destinations=[TOPIC_OCID],
    resolution="Check recent configuration/API actions and validate they are authorized.",
    message_format="TEXT",
    # Use "FIRING" for when threshold exceeded; could also add alarms for low volume/absence.
    pending_duration="PT1M",   # 1 minute pending before state change
    repeat_notification_duration="PT15M"  # repeat every 15 mins while firing
)

alarm = monitoring_client.create_alarm(alarm_details).data
print("Created alarm:", alarm.id)

3. Optional: Alarm for “No Audit Logs Seen”

To detect if the Audit service stops emitting events (e.g., misconfiguration, region issue), you can create an alarm on absence of data by using comparison to 0 with evaluate_missing_data = "EVALUATE_AS_ZERO" and a condition like:

from oci.monitoring.models import CreateAlarmDetails

alarm_query = 'sum(audit.events.count[15m]) < 1'

alarm_details = CreateAlarmDetails(
    display_name="Audit Events Missing Alarm",
    compartment_id=COMPARTMENT_ID,
    is_enabled=True,
    namespace="oci_audit",
    query=alarm_query,
    severity="CRITICAL",
    body="No Audit events observed in the last 15 minutes.",
    destinations=[TOPIC_OCID],
    message_format="TEXT",
    pending_duration="PT5M",
    repeat_notification_duration="PT30M",
    evaluate_missing_data="EVALUATE_AS_ZERO"
)

alarm = monitoring_client.create_alarm(alarm_details).data
print("Created missing-audit-events alarm:", alarm.id)

4. Validate

In OCI Console:
- Go to Monitoring → Alarms
- Verify the alarms exist and are enabled.
In Notifications:
- Confirm subscription is CONFIRMED.
Generate audit activity (e.g., create/delete small test resources) and ensure:
- Audit metrics update (Monitoring → Metrics → oci_audit)
- Alarms fire when thresholds are crossed and email is received.

This configuration uses Python to put Monitoring and Notifications around the OCI Audit Logging service, which is typically what “OCI Logging Audit Service should be actively monitored” requires.

Using Terraform

resource "oci_logging_audit_configuration" "audit_monitoring" {
  # Set this to the TENANCY OCID (root compartment) or the specific COMPARTMENT OCID
  compartment_id = "OCID_OF_TENANCY_OR_TARGET_COMPARTMENT"

  # Ensure the Audit service is actively producing events into OCI Logging
  is_enabled = true
}

Substitute:

OCID_OF_TENANCY_OR_TARGET_COMPARTMENT with the OCID where you want Audit logs configured (typically the tenancy/root compartment).

This change updates the existing configuration in place and does not force resource replacement.

Verification: terraform plan should show is_enabled changing from false (or unset) to true on oci_logging_audit_configuration.audit_monitoring.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

1. Confirm Audit Logs Are Being Collected​

2. Create a Notification Topic & Subscription​

3. Build a Logging Search for Audit Events​

4. Create a Logging Alert from the Search​

5. Test the Alert​

6. Operationalize & Tune​

1. Prerequisites​

2. Ensure OCI Audit is sending logs to OCI Logging​

2.1 Create (or identify) a Log Group for Audit​

2.2 Create a service log for Audit​

3. Create a Monitoring Alarm for Audit Logs​

3.1 Decide on alarm behavior​

3.2 Create the alarm​

4. (Optional) Alarm for high audit volume​

5. Verification​

0. Prerequisites​

1. Create a Notification Topic and Subscription (Email) via Python​

2. Create an Alarm on Audit Metrics via Python​

3. Optional: Alarm for “No Audit Logs Seen”​

4. Validate​