> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI Monitoring Cloud Guard Should Be Enabled ### More Info: Oracle Cloud Guard must be enabled at the root tenancy level. Cloud Guard acts as the foundational posture management tool, continuously scanning for security misconfigurations and threat activity ### Risk Level Critical ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Here’s how to fix **“OCI Monitoring Cloud Guard Should Be Enabled”** using the **OCI Console** by enabling Cloud Guard and its Monitoring detectors. *** ### 1. Enable Cloud Guard (if not already enabled) 1. Sign in to the **OCI Console**. 2. Open the navigation menu → **Security & Identity** → **Cloud Guard**. 3. If Cloud Guard is **not enabled**, you’ll see an **Enable Cloud Guard** button. Click it. 4. Configure: * **Reporting region**: choose your primary region. * **Target**: for full coverage, select your **tenancy** as the target (or select the compartments you want). * **Detector recipe**: use the **Oracle-managed default** detector recipes, or a cloned custom one. * **Responder recipe**: choose Oracle-managed (optional but recommended). 5. Click **Enable**. This turns on Cloud Guard so it can evaluate Monitoring/Alerting resources. *** ### 2. Ensure Monitoring detectors are active in the Detector Recipe 1. Still in **Cloud Guard**, go to the left menu: **Detector Recipes**. 2. Identify the **detector recipe** associated with the target where the violation is reported (often `OCI Activity Detector Recipe` and `OCI Configuration Detector Recipe`). 3. Click the recipe name → **View Details**. 4. Go to the **Detectors** tab. 5. In the filter box, search for “Monitoring” or look for a detector similar to: * `OCI Monitoring Cloud Guard should be enabled` * or any detector referencing **Monitoring** or **Alarms**. 6. Make sure: * **Status** is **Enabled**. * **Condition** and **scope** match the compartments / tenancy where you use Monitoring. If using an **Oracle-managed** recipe directly, you must first: 1. Click **Create Clone** on the recipe. 2. Save the cloned recipe. 3. Attach the **cloned recipe** to your Cloud Guard **Target** (next step). 4. Then modify/enable the Monitoring-related detector in the cloned recipe. *** ### 3. Attach the correct recipe to the Cloud Guard Target 1. In **Cloud Guard** → **Targets**. 2. Click the Target covering the affected compartments (or tenancy). 3. Under **Attached Recipes**, ensure: * The target uses the **cloned detector recipe** where the Monitoring detector is enabled. 4. If not: * Click **Edit Recipes**. * Select your **cloned detector recipe**. * Save. Cloud Guard will now evaluate Monitoring resources with that detector. *** ### 4. Verify that the violation is cleared 1. In **Cloud Guard** → **Dashboard** or **Problems**. 2. Filter by the problem type/rule that mentioned **“OCI Monitoring Cloud Guard Should Be Enabled”**. 3. After a few minutes / next evaluation cycle, confirm: * Status changes to **Resolved** or * New problems are no longer created for this rule. *** If you share the exact problem name or detector rule ID from Cloud Guard, I can map it to the specific detector and confirm its exact label and settings. Below are the exact steps to enable OCI Cloud Guard (so the “OCI Monitoring Cloud Guard Should Be Enabled” check passes) using the OCI CLI. ### 1. Prerequisites 1. Install and configure OCI CLI (with tenancy OCID, user OCID, API key, etc.). 2. Ensure you are using the **home region** of the tenancy (Cloud Guard is configured at tenancy level and uses a reporting region). Check current region: ```bash theme={null} oci iam region-subscription list --all ``` Your **home region** is marked `"is-home-region": true`. Use that region in the `--region` flag (or set it in your CLI config). *** ### 2. Check Current Cloud Guard Configuration Run: ```bash theme={null} oci cloud-guard cloud-guard-configuration get --region ``` Example: ```bash theme={null} oci cloud-guard cloud-guard-configuration get --region us-phoenix-1 ``` Look for `"status"` in the output. If it is `DISABLED`, proceed to enable. *** ### 3. Enable Cloud Guard Run: ```bash theme={null} oci cloud-guard cloud-guard-configuration update \ --status ENABLED \ --reporting-region \ --region ``` Example: ```bash theme={null} oci cloud-guard cloud-guard-configuration update \ --status ENABLED \ --reporting-region us-phoenix-1 \ --region us-phoenix-1 ``` Notes: * `--reporting-region` must be the tenancy’s home region. * No compartment ID is required; this is a tenancy-level setting. *** ### 4. Verify Cloud Guard Is Enabled Re-run: ```bash theme={null} oci cloud-guard cloud-guard-configuration get --region ``` Confirm: ```json theme={null} "status": "ENABLED" ``` At this point, Cloud Guard is enabled, and monitoring/alerting tools that check this control (“OCI Monitoring Cloud Guard Should Be Enabled”) should become compliant after their next scan. Below is a minimal, end‑to‑end example of how to enable Cloud Guard for Monitoring (so the “OCI Monitoring Cloud Guard Should Be Enabled” finding is remediated) using Python and the OCI SDK. Assumptions: * You already have a Cloud Guard **target** pointing at your tenancy or compartment (if not, I’ll show how to create one as well). * You’re using a standard OCI config file (`~/.oci/config`) with a profile that has permissions to manage Cloud Guard. *** ## 1. Install and configure the OCI Python SDK ```bash theme={null} pip install oci ``` Ensure your `~/.oci/config` has at least: ```ini theme={null} [DEFAULT] user=ocid1.user.oc1..xxxxx fingerprint=xx:xx:xx:xx:xx key_file=/path/to/oci_api_key.pem tenancy=ocid1.tenancy.oc1..xxxxx region=us-phoenix-1 ``` *** ## 2. Enable Cloud Guard in the tenancy Cloud Guard must be globally enabled first. ```python theme={null} import oci config = oci.config.from_file("~/.oci/config", "DEFAULT") cloud_guard_client = oci.cloud_guard.CloudGuardClient(config) tenancy_ocid = config["tenancy"] # 1) Get current Cloud Guard configuration get_resp = cloud_guard_client.get_configuration() current_status = get_resp.data.status print("Current Cloud Guard status:", current_status) # 2) Enable Cloud Guard if not already enabled if current_status != "ENABLED": update_details = oci.cloud_guard.models.UpdateConfigurationDetails( reporting_region=config["region"], status="ENABLED" ) cloud_guard_client.update_configuration(update_details) print("Cloud Guard ENABLED at tenancy level") ``` *** ## 3. Ensure the Monitoring data source is enabled Cloud Guard ingests from multiple data sources (Activity Logs, VCN Flow Logs, **Monitoring**, etc.). You must enable the **MONITORING** data source for your tenancy: ```python theme={null} from oci.cloud_guard.models import UpdateDataSourceDetails # List Cloud Guard data sources list_ds = cloud_guard_client.list_data_sources( compartment_id=tenancy_ocid ) for ds in list_ds.data: print(ds.display_name, ds.data_source_feed_provider, ds.status) # Enable MONITORING data source if disabled if ds.data_source_feed_provider == "MONITORING" and ds.status != "ENABLED": update_ds_details = UpdateDataSourceDetails(status="ENABLED") cloud_guard_client.update_data_source( data_source_id=ds.id, update_data_source_details=update_ds_details ) print("Enabled MONITORING data source:", ds.display_name) ``` This is the key step that satisfies “Monitoring Cloud Guard should be enabled”. *** ## 4. (Optional) Create/verify a Cloud Guard target for Monitoring If you don’t yet have a Cloud Guard target for your tenancy or a specific compartment, create one (Cloud Guard will use all enabled data sources for that target, including Monitoring): ```python theme={null} from oci.cloud_guard.models import CreateTargetDetails, TargetResourceType compartment_ocid = tenancy_ocid # or a specific compartment OCID # Check if a target for this compartment already exists existing_targets = cloud_guard_client.list_targets( compartment_id=compartment_ocid ).data if not existing_targets: create_target_details = CreateTargetDetails( compartment_id=compartment_ocid, display_name="tenancy-cloud-guard-target", description="Cloud Guard target for tenancy", target_resource_type=TargetResourceType.TENANCY, target_resource_id=tenancy_ocid ) create_resp = cloud_guard_client.create_target(create_target_details) print("Created Cloud Guard target:", create_resp.data.id) else: print("Cloud Guard target already exists for compartment.") ``` *** ## 5. (Optional) Create a Monitoring Alarm that Cloud Guard can leverage Cloud Guard works with Monitoring metrics and logs. For “alerting monitoring”, you usually also want an OCI Monitoring alarm. Example: create an alarm on CPU metrics using Python: ```python theme={null} import oci from oci.monitoring.models import CreateAlarmDetails, AlarmBody monitoring_client = oci.monitoring.MonitoringClient(config) alarm_compartment_ocid = compartment_ocid alarm_details = CreateAlarmDetails( compartment_id=alarm_compartment_ocid, display_name="High CPU Utilization Alarm", is_enabled=True, metric_compartment_id=alarm_compartment_ocid, metric_compartment_id_in_subtree=True, namespace="oci_computeagent", query=""" CpuUtilization[1m]{resourceDisplayName = 'my-instance-name'}.mean() > 80 """.strip(), severity="CRITICAL", destinations=[""], body=AlarmBody("CPU > 80% for my-instance-name"), message_format="PRETTY_JSON", repeat_notification_duration="PT15M" ) alarm_resp = monitoring_client.create_alarm(alarm_details) print("Created Monitoring Alarm:", alarm_resp.data.id) ``` *** ## Summary of remediation steps 1. Enable Cloud Guard at tenancy level (`update_configuration` with `status="ENABLED"`). 2. Enable the **MONITORING** data source (`update_data_source` for `data_source_feed_provider="MONITORING"`). 3. Ensure a Cloud Guard target exists for your tenancy/compartment. 4. (Optional but common) Create Monitoring alarms for the metrics you care about. This sequence removes the “OCI Monitoring Cloud Guard Should Be Enabled” misconfiguration and wires Monitoring into Cloud Guard using Python. ```hcl theme={null} # Enable Cloud Guard at the root tenancy level for Monitoring/Alerting posture coverage resource "oci_cloud_guard_configuration" "tenancy_cloud_guard" { # Replace with your tenancy OCID (root compartment) compartment_id = "OCID_OF_ROOT_TENANCY" # Region where Cloud Guard will run (must be a supported home region) reporting_region = "CLOUD_GUARD_REPORTING_REGION" # e.g. "us-ashburn-1" # This is the critical setting for the finding status = "ENABLED" # Optional: whether you manage Cloud Guard resources yourself # or allow the service to create/manage them self_manage_resources = true } ``` This change does not force resource replacement; `terraform plan` should show an update to `status` from `DISABLED` (or absent) to `ENABLED` for `oci_cloud_guard_configuration.tenancy_cloud_guard`.