OCI Monitoring Cloud Guard Should Be Enabled

Using Console

Here’s how to fix “OCI Monitoring Cloud Guard Should Be Enabled” using the OCI Console by enabling Cloud Guard and its Monitoring detectors.

1. Enable Cloud Guard (if not already enabled)

Sign in to the OCI Console.
Open the navigation menu → Security & Identity → Cloud Guard.
If Cloud Guard is not enabled, you’ll see an Enable Cloud Guard button. Click it.
Configure:
- Reporting region: choose your primary region.
- Target: for full coverage, select your tenancy as the target (or select the compartments you want).
- Detector recipe: use the Oracle-managed default detector recipes, or a cloned custom one.
- Responder recipe: choose Oracle-managed (optional but recommended).
Click Enable.

This turns on Cloud Guard so it can evaluate Monitoring/Alerting resources.

2. Ensure Monitoring detectors are active in the Detector Recipe

Still in Cloud Guard, go to the left menu: Detector Recipes.
Identify the detector recipe associated with the target where the violation is reported (often OCI Activity Detector Recipe and OCI Configuration Detector Recipe).
Click the recipe name → View Details.
Go to the Detectors tab.
In the filter box, search for “Monitoring” or look for a detector similar to:
- OCI Monitoring Cloud Guard should be enabled
- or any detector referencing Monitoring or Alarms.
Make sure:
- Status is Enabled.
- Condition and scope match the compartments / tenancy where you use Monitoring.

If using an Oracle-managed recipe directly, you must first:

Click Create Clone on the recipe.
Save the cloned recipe.
Attach the cloned recipe to your Cloud Guard Target (next step).
Then modify/enable the Monitoring-related detector in the cloned recipe.

3. Attach the correct recipe to the Cloud Guard Target

In Cloud Guard → Targets.
Click the Target covering the affected compartments (or tenancy).
Under Attached Recipes, ensure:
- The target uses the cloned detector recipe where the Monitoring detector is enabled.
If not:
- Click Edit Recipes.
- Select your cloned detector recipe.
- Save.

Cloud Guard will now evaluate Monitoring resources with that detector.

4. Verify that the violation is cleared

In Cloud Guard → Dashboard or Problems.
Filter by the problem type/rule that mentioned “OCI Monitoring Cloud Guard Should Be Enabled”.
After a few minutes / next evaluation cycle, confirm:
- Status changes to Resolved or
- New problems are no longer created for this rule.

If you share the exact problem name or detector rule ID from Cloud Guard, I can map it to the specific detector and confirm its exact label and settings.

Using CLI

Below are the exact steps to enable OCI Cloud Guard (so the “OCI Monitoring Cloud Guard Should Be Enabled” check passes) using the OCI CLI.

1. Prerequisites

Install and configure OCI CLI (with tenancy OCID, user OCID, API key, etc.).
Ensure you are using the home region of the tenancy (Cloud Guard is configured at tenancy level and uses a reporting region).

Check current region:

oci iam region-subscription list --all

Your home region is marked "is-home-region": true. Use that region in the --region flag (or set it in your CLI config).

2. Check Current Cloud Guard Configuration

Run:

oci cloud-guard cloud-guard-configuration get --region <home-region>

Example:

oci cloud-guard cloud-guard-configuration get --region us-phoenix-1

Look for "status" in the output. If it is DISABLED, proceed to enable.

3. Enable Cloud Guard

Run:

oci cloud-guard cloud-guard-configuration update \
  --status ENABLED \
  --reporting-region <home-region> \
  --region <home-region>

Example:

oci cloud-guard cloud-guard-configuration update \
  --status ENABLED \
  --reporting-region us-phoenix-1 \
  --region us-phoenix-1

Notes:

--reporting-region must be the tenancy’s home region.
No compartment ID is required; this is a tenancy-level setting.

4. Verify Cloud Guard Is Enabled

Re-run:

oci cloud-guard cloud-guard-configuration get --region <home-region>

Confirm:

"status": "ENABLED"

At this point, Cloud Guard is enabled, and monitoring/alerting tools that check this control (“OCI Monitoring Cloud Guard Should Be Enabled”) should become compliant after their next scan.

Using Python

Below is a minimal, end‑to‑end example of how to enable Cloud Guard for Monitoring (so the “OCI Monitoring Cloud Guard Should Be Enabled” finding is remediated) using Python and the OCI SDK.Assumptions:

You already have a Cloud Guard target pointing at your tenancy or compartment (if not, I’ll show how to create one as well).
You’re using a standard OCI config file (~/.oci/config) with a profile that has permissions to manage Cloud Guard.

1. Install and configure the OCI Python SDK

pip install oci

Ensure your ~/.oci/config has at least:

[DEFAULT]
user=ocid1.user.oc1..xxxxx
fingerprint=xx:xx:xx:xx:xx
key_file=/path/to/oci_api_key.pem
tenancy=ocid1.tenancy.oc1..xxxxx
region=us-phoenix-1

2. Enable Cloud Guard in the tenancy

Cloud Guard must be globally enabled first.

import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")
cloud_guard_client = oci.cloud_guard.CloudGuardClient(config)

tenancy_ocid = config["tenancy"]

# 1) Get current Cloud Guard configuration
get_resp = cloud_guard_client.get_configuration()
current_status = get_resp.data.status
print("Current Cloud Guard status:", current_status)

# 2) Enable Cloud Guard if not already enabled
if current_status != "ENABLED":
    update_details = oci.cloud_guard.models.UpdateConfigurationDetails(
        reporting_region=config["region"],
        status="ENABLED"
    )
    cloud_guard_client.update_configuration(update_details)
    print("Cloud Guard ENABLED at tenancy level")

3. Ensure the Monitoring data source is enabled

Cloud Guard ingests from multiple data sources (Activity Logs, VCN Flow Logs, Monitoring, etc.). You must enable the MONITORING data source for your tenancy:

from oci.cloud_guard.models import UpdateDataSourceDetails

# List Cloud Guard data sources
list_ds = cloud_guard_client.list_data_sources(
    compartment_id=tenancy_ocid
)

for ds in list_ds.data:
    print(ds.display_name, ds.data_source_feed_provider, ds.status)

    # Enable MONITORING data source if disabled
    if ds.data_source_feed_provider == "MONITORING" and ds.status != "ENABLED":
        update_ds_details = UpdateDataSourceDetails(status="ENABLED")
        cloud_guard_client.update_data_source(
            data_source_id=ds.id,
            update_data_source_details=update_ds_details
        )
        print("Enabled MONITORING data source:", ds.display_name)

This is the key step that satisfies “Monitoring Cloud Guard should be enabled”.

4. (Optional) Create/verify a Cloud Guard target for Monitoring

If you don’t yet have a Cloud Guard target for your tenancy or a specific compartment, create one (Cloud Guard will use all enabled data sources for that target, including Monitoring):

from oci.cloud_guard.models import CreateTargetDetails, TargetResourceType

compartment_ocid = tenancy_ocid  # or a specific compartment OCID

# Check if a target for this compartment already exists
existing_targets = cloud_guard_client.list_targets(
    compartment_id=compartment_ocid
).data

if not existing_targets:
    create_target_details = CreateTargetDetails(
        compartment_id=compartment_ocid,
        display_name="tenancy-cloud-guard-target",
        description="Cloud Guard target for tenancy",
        target_resource_type=TargetResourceType.TENANCY,
        target_resource_id=tenancy_ocid
    )

    create_resp = cloud_guard_client.create_target(create_target_details)
    print("Created Cloud Guard target:", create_resp.data.id)
else:
    print("Cloud Guard target already exists for compartment.")

5. (Optional) Create a Monitoring Alarm that Cloud Guard can leverage

Cloud Guard works with Monitoring metrics and logs. For “alerting monitoring”, you usually also want an OCI Monitoring alarm. Example: create an alarm on CPU metrics using Python:

import oci
from oci.monitoring.models import CreateAlarmDetails, AlarmBody

monitoring_client = oci.monitoring.MonitoringClient(config)

alarm_compartment_ocid = compartment_ocid

alarm_details = CreateAlarmDetails(
    compartment_id=alarm_compartment_ocid,
    display_name="High CPU Utilization Alarm",
    is_enabled=True,
    metric_compartment_id=alarm_compartment_ocid,
    metric_compartment_id_in_subtree=True,
    namespace="oci_computeagent",
    query="""
        CpuUtilization[1m]{resourceDisplayName = 'my-instance-name'}.mean() > 80
    """.strip(),
    severity="CRITICAL",
    destinations=["<OCID-of-Notification-Topic>"],
    body=AlarmBody("CPU > 80% for my-instance-name"),
    message_format="PRETTY_JSON",
    repeat_notification_duration="PT15M"
)

alarm_resp = monitoring_client.create_alarm(alarm_details)
print("Created Monitoring Alarm:", alarm_resp.data.id)

Summary of remediation steps

Enable Cloud Guard at tenancy level (update_configuration with status="ENABLED").
Enable the MONITORING data source (update_data_source for data_source_feed_provider="MONITORING").
Ensure a Cloud Guard target exists for your tenancy/compartment.
(Optional but common) Create Monitoring alarms for the metrics you care about.

This sequence removes the “OCI Monitoring Cloud Guard Should Be Enabled” misconfiguration and wires Monitoring into Cloud Guard using Python.

Using Terraform

# Enable Cloud Guard at the root tenancy level for Monitoring/Alerting posture coverage
resource "oci_cloud_guard_configuration" "tenancy_cloud_guard" {
  # Replace with your tenancy OCID (root compartment)
  compartment_id = "OCID_OF_ROOT_TENANCY"

  # Region where Cloud Guard will run (must be a supported home region)
  reporting_region = "CLOUD_GUARD_REPORTING_REGION" # e.g. "us-ashburn-1"

  # This is the critical setting for the finding
  status = "ENABLED"

  # Optional: whether you manage Cloud Guard resources yourself
  # or allow the service to create/manage them
  self_manage_resources = true
}

This change does not force resource replacement; terraform plan should show an update to status from DISABLED (or absent) to ENABLED for oci_cloud_guard_configuration.tenancy_cloud_guard.

OCI Misconfigurations

OCI Monitoring Cloud Guard Should Be Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Enable Cloud Guard (if not already enabled)

2. Ensure Monitoring detectors are active in the Detector Recipe

3. Attach the correct recipe to the Cloud Guard Target

4. Verify that the violation is cleared

1. Prerequisites

2. Check Current Cloud Guard Configuration

3. Enable Cloud Guard

4. Verify Cloud Guard Is Enabled

1. Install and configure the OCI Python SDK

2. Enable Cloud Guard in the tenancy

3. Ensure the Monitoring data source is enabled

4. (Optional) Create/verify a Cloud Guard target for Monitoring

5. (Optional) Create a Monitoring Alarm that Cloud Guard can leverage

Summary of remediation steps

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Enable Cloud Guard (if not already enabled)

​2. Ensure Monitoring detectors are active in the Detector Recipe

​3. Attach the correct recipe to the Cloud Guard Target

​4. Verify that the violation is cleared

​1. Prerequisites

​2. Check Current Cloud Guard Configuration

​3. Enable Cloud Guard

​4. Verify Cloud Guard Is Enabled

​1. Install and configure the OCI Python SDK

​2. Enable Cloud Guard in the tenancy

​3. Ensure the Monitoring data source is enabled

​4. (Optional) Create/verify a Cloud Guard target for Monitoring

​5. (Optional) Create a Monitoring Alarm that Cloud Guard can leverage

​Summary of remediation steps

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Enable Cloud Guard (if not already enabled)

2. Ensure Monitoring detectors are active in the Detector Recipe

3. Attach the correct recipe to the Cloud Guard Target

4. Verify that the violation is cleared

1. Prerequisites

2. Check Current Cloud Guard Configuration

3. Enable Cloud Guard

4. Verify Cloud Guard Is Enabled

1. Install and configure the OCI Python SDK

2. Enable Cloud Guard in the tenancy

3. Ensure the Monitoring data source is enabled

4. (Optional) Create/verify a Cloud Guard target for Monitoring

5. (Optional) Create a Monitoring Alarm that Cloud Guard can leverage

Summary of remediation steps