> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI Monitoring Should Have Active Notification Topic Configured ### More Info: Notification topics must be configured in the tenancy. Without active topics, security alarms and Cloud Guard alerts cannot be routed to administrators, rendering monitoring ineffective. ### Risk Level Medium ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate “OCI Monitoring should have active notification topic configured” using the OCI Console, you need to: 1. **Create (or verify) a Notifications Topic** 1. In the OCI Console, open the navigation menu. 2. Go to **Developer Services → Notifications** (or **Application Integration → Notifications** depending on the UI). 3. Make sure you are in the correct **Compartment**. 4. Click **Create Topic**. 5. Enter: * **Name** and **Description** * **Compartment** (same or accessible compartment as your alarms) 6. Click **Create**. 2. **Add at Least One Active Subscription** 1. Click on the topic you just created. 2. Under **Subscriptions**, click **Create Subscription**. 3. Choose **Protocol** (e.g., Email, HTTPS, Slack via HTTPS, PagerDuty via HTTPS, etc.). 4. Enter the **Endpoint** (e.g., email address or webhook URL). 5. Click **Create**. 6. For email: * Check your email inbox. * Open the Oracle Cloud email and click **Confirm Subscription**. 7. Ensure subscription status becomes **Active** in the topic’s Subscriptions list. 3. **Attach the Topic to Existing Alarms (Monitoring)** 1. In the navigation menu, go to **Observability & Management → Monitoring → Alarms**. 2. Select the **Compartment** where your alarms are defined. 3. For each alarm that needs a notification: * Click the alarm name. * Click **Edit** (or **Edit alarm**). * In the **Notifications** or **Destinations** section: * Under **Topic**, choose the Notifications topic you created. * Ensure **Severity** and **Enabled** are set as desired. * Click **Save changes**. 4. If any alarm has no notification topic, this is what typically triggers the misconfiguration finding—attach the topic as above. 4. **Verify Alarm Status and Trigger (Optional but Recommended)** 1. Ensure each alarm is **Enabled**. 2. Optionally, temporarily tweak the alarm’s metric or threshold to force a trigger, or: * Use a known test condition (e.g., a low threshold that will be exceeded). * Wait for the metric to trigger the alarm. 3. Confirm that: * The alarm changes to **FIRING** in the Alarms list when condition is met. * A notification is actually received at the configured endpoint. 5. **Ensure Compartments and Policies Allow This** * Confirm the alarm’s compartment has permission to use Notifications: * IAM policy example (for reference to your admin): * `Allow group to manage ons-topics in compartment ` * `Allow service metrics to use ons-topics in compartment ` * If you lack permission to select topics, contact your tenancy administrator to add the appropriate policies. Once each active OCI Monitoring alarm has a configured Notifications topic with at least one **Active** subscription, the “Monitoring Should Have Active Notification Topic Configured” finding will be remediated. Below is a concise, CLI‑only flow to ensure OCI Monitoring Alarms have an active Notification Topic configured. You will: 1. Find (or create) a Notification Topic 2. (Optionally) add a Subscription to that topic 3. Associate the topic with the Monitoring Alarm using `--destinations` *** ### 1. Set common variables Adjust these to your environment: ```bash theme={null} # Region / Compartment export OCI_REGION="us-ashburn-1" export COMPARTMENT_OCID="ocid1.compartment.oc1..xxxx" # Alarm to fix export ALARM_OCID="ocid1.alarm.oc1..xxxx" # Topic export TOPIC_NAME="monitoring-alerts-topic" ``` Ensure your OCI CLI is configured (`oci setup config`) and using the correct region. *** ### 2. Check the current Alarm configuration ```bash theme={null} oci monitoring alarm get \ --alarm-id "$ALARM_OCID" \ --region "$OCI_REGION" \ --query "data.{name:\"display-name\",destinations:destinations,severity:severity}" \ --output table ``` If `destinations` is empty or missing, you need to attach a topic. *** ### 3. Create (or reuse) an OCI Notifications topic #### 3.1. See if a suitable topic already exists ```bash theme={null} oci ons topic list \ --compartment-id "$COMPARTMENT_OCID" \ --region "$OCI_REGION" \ --query "data[?\"name\"=='$TOPIC_NAME'].[\"topic-id\",\"name\"]" \ --output table ``` If you see no rows, create one. #### 3.2. Create a new topic ```bash theme={null} oci ons topic create \ --compartment-id "$COMPARTMENT_OCID" \ --name "$TOPIC_NAME" \ --description "Topic for Monitoring Alarms" \ --region "$OCI_REGION" \ --query "data.id" \ --raw-output ``` Save the returned OCID: ```bash theme={null} export TOPIC_OCID="ocid1.onstopic.oc1..xxxx" ``` If you already had a topic, set: ```bash theme={null} export TOPIC_OCID="" ``` *** ### 4. (Optional but recommended) Add a subscription to the topic Example: email subscription ```bash theme={null} export EMAIL_ADDRESS="alerts@example.com" oci ons subscription create \ --endpoint "$EMAIL_ADDRESS" \ --protocol "EMAIL" \ --topic-id "$TOPIC_OCID" \ --region "$OCI_REGION" \ --query "data.id" \ --raw-output ``` The recipient must confirm the subscription from the email sent by OCI. *** ### 5. Attach the Notification Topic to the Alarm Get the current alarm definition (JSON) so you don’t accidentally overwrite other fields: ```bash theme={null} oci monitoring alarm get \ --alarm-id "$ALARM_OCID" \ --region "$OCI_REGION" \ --query "data" \ --raw-output > alarm.json ``` Edit `alarm.json` minimally: * Ensure `destinations` includes the topic OCID * Do not remove required fields (`compartmentId`, `namespace`, `query`, `resolution`, `severity`, `isEnabled`, `displayName`, etc.). Example `destinations` entry: ```json theme={null} "destinations": [ "ocid1.onstopic.oc1..xxxx" ], ``` If `destinations` already exists, add your topic OCID to the array. *** ### 6. Update the Alarm with the new destination You can update only specific fields rather than posting the entire JSON: ```bash theme={null} oci monitoring alarm update \ --alarm-id "$ALARM_OCID" \ --destinations '["'"$TOPIC_OCID"'"]' \ --region "$OCI_REGION" ``` If you want to preserve multiple existing destinations: 1. Fetch them: ```bash theme={null} CURRENT_DESTS=$(oci monitoring alarm get \ --alarm-id "$ALARM_OCID" \ --region "$OCI_REGION" \ --query "data.destinations" \ --raw-output) ``` 2. Combine with the new one (ensuring uniqueness) and pass in as JSON. Example (simple overwrite with two known topics): ```bash theme={null} oci monitoring alarm update \ --alarm-id "$ALARM_OCID" \ --destinations '["'"$TOPIC_OCID"'","ocid1.onstopic.oc1..other"]' \ --region "$OCI_REGION" ``` *** ### 7. Verify ```bash theme={null} oci monitoring alarm get \ --alarm-id "$ALARM_OCID" \ --region "$OCI_REGION" \ --query "data.destinations" \ --output table ``` You should now see at least one topic OCID listed. That satisfies the requirement that OCI Monitoring has an active Notification Topic configured for that alarm. Below is a minimal end‑to‑end approach to remediate “OCI Monitoring Should Have Active Notification Topic Configured” using Python and the OCI SDK. Assumptions: * You have `oci` Python SDK installed: `pip install oci` * You use a config file at `~/.oci/config` with a profile called `DEFAULT` * You already have an alarm created, but it has no `destinations` (i.e., no notification topic) *** ## 1. Set up OCI Python SDK client ```python theme={null} import oci config = oci.config.from_file("~/.oci/config", "DEFAULT") monitoring_client = oci.monitoring.MonitoringClient(config) ons_client = oci.ons.NotificationControlPlaneClient(config) ``` *** ## 2. Create a Notifications topic (if you don’t already have one) ```python theme={null} compartment_id = "" # same compartment as your alarm create_topic_details = oci.ons.models.CreateTopicDetails( name="monitoring-alerts-topic", compartment_id=compartment_id, description="Topic for OCI Monitoring alarms" ) topic = ons_client.create_topic(create_topic_details).data topic_ocid = topic.topic_id print("Created/Using topic:", topic_ocid) ``` If you already have a topic, just set `topic_ocid` to that topic’s OCID. *** ## 3. (Optional but recommended) Add a subscription (e.g., email) ```python theme={null} subscription_details = oci.ons.models.CreateSubscriptionDetails( compartment_id=compartment_id, topic_id=topic_ocid, protocol="EMAIL", # or "HTTPS", "SLACK", etc. endpoint="you@example.com" # your email address ) subscription = ons_client.create_subscription(subscription_details).data print("Created subscription:", subscription.id) ``` You’ll need to confirm the subscription via email for it to become ACTIVE. *** ## 4. Attach the topic to your existing alarm You need: * The OCID of the existing alarm that currently has no active notification topic. ```python theme={null} alarm_id = "" # Get existing alarm alarm = monitoring_client.get_alarm(alarm_id).data # Add topic to destinations if not already present destinations = list(alarm.destinations or []) if topic_ocid not in destinations: destinations.append(topic_ocid) update_details = oci.monitoring.models.UpdateAlarmDetails( display_name=alarm.display_name, is_enabled=alarm.is_enabled, severity=alarm.severity, metric_compartment_id=alarm.metric_compartment_id, namespace=alarm.namespace, query=alarm.query, resolution=alarm.resolution, pending_duration=alarm.pending_duration, message_format=alarm.message_format, body=alarm.body, repeat_notification_duration=alarm.repeat_notification_duration, suppress_notifications=alarm.suppress_notifications, destinations=destinations, # keep any other fields you use, such as defined_tags, freeform_tags defined_tags=alarm.defined_tags, freeform_tags=alarm.freeform_tags ) updated_alarm = monitoring_client.update_alarm( alarm_id=alarm_id, update_alarm_details=update_details ).data print("Updated alarm destinations:", updated_alarm.destinations) ``` *** ## 5. Verify * In OCI Console: Monitoring → Alarms → select the alarm → check “Destinations” includes your topic. * Confirm the subscription (email or other) so the topic is ACTIVE. * Trigger the alarm condition (or wait for it naturally) to verify you receive notifications. This ensures your OCI Monitoring alarm has an active notification topic and clears the “OCI Monitoring Should Have Active Notification Topic Configured” finding. ```hcl theme={null} # Notification topic that OCI Monitoring / Alarms can publish to resource "oci_ons_notification_topic" "monitoring_alerts_topic" { compartment_id = "OCID_OF_COMPARTMENT_FOR_TOPIC" # e.g. the security/ops compartment name = "monitoring-alerts-topic" description = "Topic for OCI Monitoring and Cloud Guard alerts" } # (Optional but typical) at least one subscription so alerts reach admins resource "oci_ons_subscription" "monitoring_alerts_email" { compartment_id = "OCID_OF_COMPARTMENT_FOR_TOPIC" topic_id = oci_ons_notification_topic.monitoring_alerts_topic.id protocol = "EMAIL" endpoint = "SECURITY_TEAM_EMAIL@example.com" } /* Attach the topic to your alarm; ensure every alarm has at least one notification destination. If you already have oci_monitoring_alarm resources, add or update the 'destinations' list as below. */ resource "oci_monitoring_alarm" "cpu_high_alarm" { compartment_id = "OCID_OF_COMPARTMENT_FOR_ALARM" display_name = "High CPU Utilization" is_enabled = true # Metric and condition as appropriate to your environment namespace = "oci_computeagent" query = "CpuUtilization[5m]{resourceId = \"INSTANCE_OCID\"}.mean() > 80" severity = "CRITICAL" destinations = [ oci_ons_notification_topic.monitoring_alerts_topic.id, ] # Other required arguments: metric_compartment_id = "OCID_OF_METRIC_COMPARTMENT" # message_format, pending_duration, etc., as needed } ``` This does not force replacement of existing alarms unless you are changing immutable fields (e.g., alarm `compartment_id`); adding or updating `destinations` is an in‑place update. Creating the `oci_ons_notification_topic` is additive. To verify, `terraform plan` should show: * `+` creation of `oci_ons_notification_topic.monitoring_alerts_topic` * `+` creation of any `oci_ons_subscription` resources you’ve added * `~` update of each `oci_monitoring_alarm` to include the topic ID in `destinations`.