OCI Monitoring Should Have Event Rule For Cloud Guard Problems

Using Console

Below are the exact steps in the OCI Console to create an Event Rule for Cloud Guard problems and connect it to alerting (via Notifications). This is what most security benchmarks are checking for.

Prerequisites

Cloud Guard is enabled
- Go to: Navigation Menu → Identity & Security → Cloud Guard
- If Cloud Guard is not enabled:
  - Click Enable Cloud Guard
  - Choose Target (e.g., root compartment/tenant)
  - Save
Notification Topic & Subscription exist (for email/Slack/etc.)
- Go to: Navigation Menu → Developer Services → Notifications (ONS)
- Click Create Topic
  - Name: e.g., cloudguard-problems-alerts
  - Description: e.g., Alerts for Cloud Guard problems
  - Compartment: choose correctly
  - Click Create
- Open the topic → Create Subscription
  - Protocol: e.g., Email
  - Endpoint: your email address
  - Click Create
- Go to your email and confirm the subscription.

Step 1 – Create an Event Rule for Cloud Guard Problems

In OCI Console, go to:
Navigation Menu → Observability & Management → Events Service → Rules
Click Create Rule.
Basic Information
- Name: e.g., cloudguard-problems-events-rule
- Description: Trigger notifications when Cloud Guard problems are created/updated
- Compartment: pick the compartment where you want the rule to live (typically root or security compartment).
Rule Conditions
- In “Rule Conditions,” choose:
  - Rule Type: Event Type
  - Service Name: select Cloud Guard
  - Event Type: add the relevant ones, for example:
    - com.oraclecloud.cloudguard.problem.create
    - com.oraclecloud.cloudguard.problem.update
    - (Optionally) com.oraclecloud.cloudguard.problem.stateChange
- You can add multiple event types to the same rule.
Actions
- Under Actions, click Add Action.
- Action Type: Notifications
- Topic: select the topic you created earlier (e.g., cloudguard-problems-alerts).
- Click Add Action.
Click Create Rule.

Step 2 – (Optional) Tie into Monitoring/Alarms

If your requirement is to route through Monitoring/Alarms (for metrics-based alerting dashboards):

Typically, Cloud Guard problems are event-based, not metric-based. Monitoring Alarms mainly work off metrics.
Recommended pattern:
- Keep the Event Rule → Notifications you just created for immediate alerts.
- If you have custom metrics or a log-based metric about Cloud Guard problems, you can:
  - Create a Monitoring Alarm on that metric.
  - Configure the alarm to send notifications to the same Notifications topic.

Validation

In Cloud Guard → Problems, create or simulate a problem (if possible) or trigger a known rule.
Confirm:
- The Event Rule shows as Active.
- The subscription endpoint (email, etc.) receives an alert when a problem is created or updated.

This satisfies the requirement: OCI Monitoring/Alerting is wired to an Event Rule that triggers when Cloud Guard Problems occur.

Using CLI

Below is a minimal, end‑to‑end way to create an Event Rule for Cloud Guard Problems and wire it into OCI Alerting (Notifications / Monitoring) using OCI CLI.Assumptions:

You already have oci CLI configured.
You have permissions to create policies, topics, and event rules.

1. (Optional) Enable Cloud Guard

If Cloud Guard isn’t already enabled:

COMPARTMENT_ID="<root-or-target-compartment-ocid>"

oci cloud-guard configuration update \
  --compartment-id "$COMPARTMENT_ID" \
  --status ENABLED

2. Create an OCI Notifications Topic

COMPARTMENT_ID="<compartment-ocid>"
TOPIC_NAME="cloudguard-problems-topic"

oci ons topic create \
  --compartment-id "$COMPARTMENT_ID" \
  --name "$TOPIC_NAME" \
  --wait-for-state ACTIVE \
  --max-wait-seconds 120

Get the topic OCID:

TOPIC_OCID=$(oci ons topic list \
  --compartment-id "$COMPARTMENT_ID" \
  --name "$TOPIC_NAME" \
  --query "data[0].\"topic-id\"" \
  --raw-output)
echo "$TOPIC_OCID"

3. Add a Subscription (for Email Alerting)

EMAIL_ADDRESS="your.email@example.com"

oci ons subscription create \
  --topic-id "$TOPIC_OCID" \
  --protocol EMAIL \
  --endpoint "$EMAIL_ADDRESS"

Confirm the email subscription from your inbox.

4. Create IAM Policy for Events to Publish to ONS

In the compartment (or tenancy) that holds the topic, create a policy like:

POLICY_NAME="policy-events-to-ons"
POLICY_COMPARTMENT_ID="<compartment-ocid-where-policy-lives>"

oci iam policy create \
  --compartment-id "$POLICY_COMPARTMENT_ID" \
  --name "$POLICY_NAME" \
  --description "Allow Events service to publish to Notifications topics" \
  --statements '[
    "Allow service events to use ons-topics in compartment '\"'"$COMPARTMENT_ID"'\"'",
    "Allow service events to use ons-subscriptions in compartment '\"'"$COMPARTMENT_ID"'\"'"
  ]'

Adjust compartment IDs as needed.

5. Create the Cloud Guard Problems Event Rule (via CLI)

5.1 Define the Rule Condition

Typical event types for Cloud Guard problems:

com.oraclecloud.cloudguard.problemdetected
com.oraclecloud.cloudguard.problemresolved
com.oraclecloud.cloudguard.problemupdated (optional)

Example condition JSON (only CRITICAL/HIGH problems):

RULE_CONDITION=$(cat << 'EOF'
{
  "eventType": [
    "com.oraclecloud.cloudguard.problemdetected",
    "com.oraclecloud.cloudguard.problemresolved",
    "com.oraclecloud.cloudguard.problemupdated"
  ],
  "data": {
    "riskLevel": [
      "CRITICAL",
      "HIGH"
    ]
  }
}
EOF
)

You can relax the filter by removing the riskLevel block if you want all problems.

5.2 Define the Actions (Send to the ONS Topic)

ACTIONS=$(cat << EOF
{
  "actions": [
    {
      "actionType": "ONS",
      "isEnabled": true,
      "description": "Notify on Cloud Guard Problems",
      "topicId": "$TOPIC_OCID"
    }
  ]
}
EOF
)

5.3 Create the Event Rule

RULE_NAME="CloudGuard-Problems-Rule"

oci events rule create \
  --compartment-id "$COMPARTMENT_ID" \
  --display-name "$RULE_NAME" \
  --is-enabled true \
  --condition "$RULE_CONDITION" \
  --actions "$ACTIONS"

6. (Optional) Tie into Monitoring Alarms

If you want Monitoring Alarms (e.g., metrics-based) to also notify on the same topic:

NAMESPACE="oci_cloud_guard"
QUERY="Problems[1m].count() > 0"
ALARM_NAME="CloudGuard-Problem-Alarm"
DESTINATION="$TOPIC_OCID"

oci monitoring alarm create \
  --compartment-id "$COMPARTMENT_ID" \
  --display-name "$ALARM_NAME" \
  --is-enabled true \
  --metric-compartment-id "$COMPARTMENT_ID" \
  --namespace "$NAMESPACE" \
  --query "$QUERY" \
  --severity CRITICAL \
  --destinations "[\"$DESTINATION\"]" \
  --message-format PRETTY_JSON

(Adjust the namespace/query to match your Cloud Guard metric configuration; they can vary by region/tenant and feature set.)

After this:

New / updated / resolved Cloud Guard problems that match your rule condition will trigger the Event Rule.
The Event Rule publishes to the Notifications topic, which sends alert emails (and can be reused by Monitoring alarms).

Using Python

Below is a step‑by‑step remediation using Python and the OCI SDK to ensure OCI Events has a rule for Cloud Guard problems and routes them to alerting (Notifications / Monitoring).

1. Prerequisites

Install OCI Python SDK:
pip install oci

Ensure you have an OCI config file at ~/.oci/config with:

[DEFAULT]
user=ocid1.user.oc1..xxxx
fingerprint=xx:xx:xx:xx
key_file=/path/to/oci_api_key.pem
tenancy=ocid1.tenancy.oc1..xxxx
region=us-ashburn-1

Cloud Guard must already be enabled in the tenancy.

2. Create a Notifications Topic (for Alerts)

You will use Notifications as the alerting backend which Monitoring alarms can also publish to.

import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")

TENANCY_OCID = config["tenancy"]
COMPARTMENT_OCID = "<COMPARTMENT_OCID_FOR_ALERTING>"  # often root = TENANCY_OCID

ons_client = oci.ons.NotificationControlPlaneClient(config)

topic_name = "cloudguard-problems-alerts"
topic_details = oci.ons.models.CreateTopicDetails(
    name=topic_name,
    compartment_id=COMPARTMENT_OCID,
    description="Topic for Cloud Guard problem events"
)

topic = ons_client.create_topic(topic_details).data
print("Topic OCID:", topic.topic_id)

3. (Optional) Add a Subscription to the Topic

Add an email subscription so people receive alerts.

subscription_details = oci.ons.models.CreateSubscriptionDetails(
    compartment_id=COMPARTMENT_OCID,
    topic_id=topic.topic_id,
    protocol="EMAIL",
    endpoint="security-team@example.com"
)

sub = ons_client.create_subscription(subscription_details).data
print("Subscription OCID:", sub.id)

Confirm the email when OCI sends the verification email.

4. Create an Events Rule for Cloud Guard Problems

The rule listens for Cloud Guard problem events and sends them to the Notifications topic.Common Cloud Guard event types include:

com.oraclecloud.cloudguard.problemdetected
com.oraclecloud.cloudguard.problemupdated
com.oraclecloud.cloudguard.problemresolved

You can match all three.

from oci.events import EventsClient
from oci.events.models import (
    CreateRuleDetails,
    RuleCondition,
    RuleActionDetails,
    CreateArnActionDetails
)

events_client = EventsClient(config)

rule_display_name = "cloudguard-problems-to-notifications"

# Event pattern to match Cloud Guard problem events
# Uses eventType and data.additionalDetails.lifecycleState if needed.
# Here we match on eventType only.
event_pattern = {
    "eventType": [
        "com.oraclecloud.cloudguard.problemdetected",
        "com.oraclecloud.cloudguard.problemupdated",
        "com.oraclecloud.cloudguard.problemresolved"
    ]
}

create_rule_details = CreateRuleDetails(
    compartment_id=COMPARTMENT_OCID,
    display_name=rule_display_name,
    description="Send Cloud Guard problem events to Notifications topic",
    is_enabled=True,
    condition=RuleCondition(
        # pattern is a JSON string
        expression=oci.util.to_json(event_pattern)
    ),
    actions=RuleActionDetails(
        actions=[
            CreateArnActionDetails(
                # Notifications ARN: ocid is ok; Events accepts OCID for ONS topic
                action_type="ONS",
                is_enabled=True,
                description="Send Cloud Guard problems to ONS topic",
                topic_id=topic.topic_id
            )
        ]
    )
)

rule = events_client.create_rule(create_rule_details).data
print("Events Rule OCID:", rule.id)

5. (Optional) Create Monitoring Alarm That Publishes to Same Topic

If you also want a traditional Monitoring alarm (metrics‑based) to publish to the same topic:

from oci.monitoring import MonitoringClient
from oci.monitoring.models import (
    CreateAlarmDetails,
    MetricDataDetails,
    AlarmSuppression
)

monitoring_client = MonitoringClient(config)

alarm_details = CreateAlarmDetails(
    display_name="CloudGuard-Problems-Metric-Alarm",
    compartment_id=COMPARTMENT_OCID,
    namespace="oci_cloud_guard",  # example; verify the actual namespace used for Cloud Guard metrics
    query="ProblemCount[1m].sum() > 0",  # example metric query
    severity="CRITICAL",
    is_enabled=True,
    destinations=[topic.topic_id],  # Notifications topic
    suppression=AlarmSuppression(is_suppressed=False),
    message_format="JSON"
)

alarm = monitoring_client.create_alarm(alarm_details).data
print("Alarm OCID:", alarm.id)

(Adjust namespace and query to match your actual Cloud Guard metrics if you use a metrics‑based alarm.)

6. Validate

In OCI Console:
- Go to Developer Services → Events: confirm the rule exists and is enabled.
- Go to Notifications → Topics: confirm the topic and subscription.
- (If created) Go to Monitoring → Alarms: confirm alarm exists and uses the topic.
Trigger a test Cloud Guard problem (or use an existing one) and verify an email/notification is received.

This completes remediation: OCI Monitoring / alerting is now wired via an Events rule listening for Cloud Guard problems and publishing to a Notifications topic using Python.

Using Terraform

resource "oci_events_rule" "cloud_guard_problem_detected" {
  # Replace with the OCID of the compartment where you want the rule to live
  compartment_id = "OCID_OF_TARGET_COMPARTMENT"

  display_name = "CloudGuard_Problem_Detected"
  description  = "Trigger on Cloud Guard Problem Detected events for automated remediation"
  is_enabled   = true

  # Match Cloud Guard "Problem Detected" events
  # If you already have a rule, update this JSON to include the eventType below.
  condition = jsonencode({
    "eventType" : [
      "com.oraclecloud.cloudguard.problemdetected"
    ]
    # Add any extra filters you need, for example:
    # "data" : {
    #   "additionalDetails" : {
    #     "riskLevel" : [ "CRITICAL", "HIGH" ]
    #   }
    # }
  })

  # Configure the action(s) you want Monitoring/Alerting to drive,
  # for example invoke a Function, send to Notifications, etc.
  actions {
    # Example: send to Notifications (ONS topic)
    actions {
      action_type = "ONS"

      # Replace with your Notifications topic OCID
      is_enabled = true
      topic_id   = "OCID_OF_OCI_NOTIFICATIONS_TOPIC"
    }

    # Example: invoke a Function for automated remediation instead:
    # actions {
    #   action_type = "FAAS"
    #   is_enabled  = true
    #   function_id = "OCID_OF_OCI_FUNCTION"
    # }
  }

  freeform_tags = {
    "OWNER" = "TEAM_NAME"
  }
}

Updating condition and is_enabled on oci_events_rule is an in‑place change and does not force replacement of the rule.To verify, terraform plan should show an update to the existing oci_events_rule (or creation of a new one) where condition now includes eventType = ["com.oraclecloud.cloudguard.problemdetected"] and the rule is is_enabled = true, along with any configured actions.

OCI Misconfigurations

OCI Monitoring Should Have Event Rule For Cloud Guard Problems

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Prerequisites

Step 1 – Create an Event Rule for Cloud Guard Problems

Step 2 – (Optional) Tie into Monitoring/Alarms

Validation

1. (Optional) Enable Cloud Guard

2. Create an OCI Notifications Topic

3. Add a Subscription (for Email Alerting)

4. Create IAM Policy for Events to Publish to ONS

5. Create the Cloud Guard Problems Event Rule (via CLI)

5.1 Define the Rule Condition

5.2 Define the Actions (Send to the ONS Topic)

5.3 Create the Event Rule

6. (Optional) Tie into Monitoring Alarms

1. Prerequisites

2. Create a Notifications Topic (for Alerts)

3. (Optional) Add a Subscription to the Topic

4. Create an Events Rule for Cloud Guard Problems

5. (Optional) Create Monitoring Alarm That Publishes to Same Topic

6. Validate

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Prerequisites

​Step 1 – Create an Event Rule for Cloud Guard Problems

​Step 2 – (Optional) Tie into Monitoring/Alarms

​Validation

​1. (Optional) Enable Cloud Guard

​2. Create an OCI Notifications Topic

​3. Add a Subscription (for Email Alerting)

​4. Create IAM Policy for Events to Publish to ONS

​5. Create the Cloud Guard Problems Event Rule (via CLI)

​5.1 Define the Rule Condition

​5.2 Define the Actions (Send to the ONS Topic)

​5.3 Create the Event Rule

​6. (Optional) Tie into Monitoring Alarms

​1. Prerequisites

​2. Create a Notifications Topic (for Alerts)

​3. (Optional) Add a Subscription to the Topic

​4. Create an Events Rule for Cloud Guard Problems

​5. (Optional) Create Monitoring Alarm That Publishes to Same Topic

​6. Validate

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Prerequisites

Step 1 – Create an Event Rule for Cloud Guard Problems

Step 2 – (Optional) Tie into Monitoring/Alarms

Validation

1. (Optional) Enable Cloud Guard

2. Create an OCI Notifications Topic

3. Add a Subscription (for Email Alerting)

4. Create IAM Policy for Events to Publish to ONS

5. Create the Cloud Guard Problems Event Rule (via CLI)

5.1 Define the Rule Condition

5.2 Define the Actions (Send to the ONS Topic)

5.3 Create the Event Rule

6. (Optional) Tie into Monitoring Alarms

1. Prerequisites

2. Create a Notifications Topic (for Alerts)

3. (Optional) Add a Subscription to the Topic

4. Create an Events Rule for Cloud Guard Problems

5. (Optional) Create Monitoring Alarm That Publishes to Same Topic

6. Validate