> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI Monitoring Should Have Event Rule For Cloud Guard Problems

### More Info:

Event Rules must trigger on Cloud Guard Problem Detected signals. Connecting Cloud Guard problems to Event Rules allows for automated, serverless remediation of identified vulnerabilities.

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* HITRUST CSF
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are the exact steps in the OCI Console to create an Event Rule for Cloud Guard problems and connect it to alerting (via Notifications). This is what most security benchmarks are checking for.

        ***

        ### Prerequisites

        1. **Cloud Guard is enabled**
           * Go to: **Navigation Menu → Identity & Security → Cloud Guard**
           * If Cloud Guard is not enabled:
             * Click **Enable Cloud Guard**
             * Choose **Target** (e.g., root compartment/tenant)
             * Save

        2. **Notification Topic & Subscription exist (for email/Slack/etc.)**
           * Go to: **Navigation Menu → Developer Services → Notifications (ONS)**
           * Click **Create Topic**
             * Name: e.g., `cloudguard-problems-alerts`
             * Description: e.g., `Alerts for Cloud Guard problems`
             * Compartment: choose correctly
             * Click **Create**
           * Open the topic → **Create Subscription**
             * Protocol: e.g., **Email**
             * Endpoint: your email address
             * Click **Create**
           * Go to your email and **confirm** the subscription.

        ***

        ### Step 1 – Create an Event Rule for Cloud Guard Problems

        1. In OCI Console, go to:\
           **Navigation Menu → Observability & Management → Events Service → Rules**

        2. Click **Create Rule**.

        3. **Basic Information**
           * Name: e.g., `cloudguard-problems-events-rule`
           * Description: `Trigger notifications when Cloud Guard problems are created/updated`
           * Compartment: pick the compartment where you want the rule to live (typically root or security compartment).

        4. **Rule Conditions**
           * In “Rule Conditions,” choose:
             * **Rule Type**: **Event Type**
             * **Service Name**: select **Cloud Guard**
             * **Event Type**: add the relevant ones, for example:
               * `com.oraclecloud.cloudguard.problem.create`
               * `com.oraclecloud.cloudguard.problem.update`
               * (Optionally) `com.oraclecloud.cloudguard.problem.stateChange`
           * You can add multiple event types to the same rule.

        5. **Actions**
           * Under **Actions**, click **Add Action**.
           * **Action Type**: **Notifications**
           * **Topic**: select the topic you created earlier (e.g., `cloudguard-problems-alerts`).
           * Click **Add Action**.

        6. Click **Create Rule**.

        ***

        ### Step 2 – (Optional) Tie into Monitoring/Alarms

        If your requirement is to route through Monitoring/Alarms (for metrics-based alerting dashboards):

        1. Typically, Cloud Guard problems are *event-based*, not metric-based. Monitoring Alarms mainly work off metrics.
        2. Recommended pattern:
           * Keep the **Event Rule → Notifications** you just created for immediate alerts.
           * If you have custom metrics or a log-based metric about Cloud Guard problems, you can:
             * Create a **Monitoring Alarm** on that metric.
             * Configure the alarm to send notifications to the **same Notifications topic**.

        ***

        ### Validation

        1. In **Cloud Guard → Problems**, create or simulate a problem (if possible) or trigger a known rule.
        2. Confirm:
           * The Event Rule shows as **Active**.
           * The subscription endpoint (email, etc.) receives an alert when a problem is created or updated.

        This satisfies the requirement: OCI Monitoring/Alerting is wired to an Event Rule that triggers when Cloud Guard Problems occur.
      </Accordion>

      <Accordion title="Using CLI">
        Below is a minimal, end‑to‑end way to create an **Event Rule for Cloud Guard Problems** and wire it into **OCI Alerting (Notifications / Monitoring)** using **OCI CLI**.

        Assumptions:

        * You already have `oci` CLI configured.
        * You have permissions to create policies, topics, and event rules.

        ***

        ## 1. (Optional) Enable Cloud Guard

        If Cloud Guard isn’t already enabled:

        ```bash theme={null}
        COMPARTMENT_ID="<root-or-target-compartment-ocid>"

        oci cloud-guard configuration update \
          --compartment-id "$COMPARTMENT_ID" \
          --status ENABLED
        ```

        ***

        ## 2. Create an OCI Notifications Topic

        ```bash theme={null}
        COMPARTMENT_ID="<compartment-ocid>"
        TOPIC_NAME="cloudguard-problems-topic"

        oci ons topic create \
          --compartment-id "$COMPARTMENT_ID" \
          --name "$TOPIC_NAME" \
          --wait-for-state ACTIVE \
          --max-wait-seconds 120
        ```

        Get the topic OCID:

        ```bash theme={null}
        TOPIC_OCID=$(oci ons topic list \
          --compartment-id "$COMPARTMENT_ID" \
          --name "$TOPIC_NAME" \
          --query "data[0].\"topic-id\"" \
          --raw-output)
        echo "$TOPIC_OCID"
        ```

        ***

        ## 3. Add a Subscription (for Email Alerting)

        ```bash theme={null}
        EMAIL_ADDRESS="your.email@example.com"

        oci ons subscription create \
          --topic-id "$TOPIC_OCID" \
          --protocol EMAIL \
          --endpoint "$EMAIL_ADDRESS"
        ```

        Confirm the email subscription from your inbox.

        ***

        ## 4. Create IAM Policy for Events to Publish to ONS

        In the compartment (or tenancy) that holds the topic, create a policy like:

        ```bash theme={null}
        POLICY_NAME="policy-events-to-ons"
        POLICY_COMPARTMENT_ID="<compartment-ocid-where-policy-lives>"

        oci iam policy create \
          --compartment-id "$POLICY_COMPARTMENT_ID" \
          --name "$POLICY_NAME" \
          --description "Allow Events service to publish to Notifications topics" \
          --statements '[
            "Allow service events to use ons-topics in compartment '\"'"$COMPARTMENT_ID"'\"'",
            "Allow service events to use ons-subscriptions in compartment '\"'"$COMPARTMENT_ID"'\"'"
          ]'
        ```

        Adjust compartment IDs as needed.

        ***

        ## 5. Create the Cloud Guard Problems Event Rule (via CLI)

        ### 5.1 Define the Rule Condition

        Typical event types for Cloud Guard problems:

        * `com.oraclecloud.cloudguard.problemdetected`
        * `com.oraclecloud.cloudguard.problemresolved`
        * `com.oraclecloud.cloudguard.problemupdated` (optional)

        Example condition JSON (only CRITICAL/HIGH problems):

        ```bash theme={null}
        RULE_CONDITION=$(cat << 'EOF'
        {
          "eventType": [
            "com.oraclecloud.cloudguard.problemdetected",
            "com.oraclecloud.cloudguard.problemresolved",
            "com.oraclecloud.cloudguard.problemupdated"
          ],
          "data": {
            "riskLevel": [
              "CRITICAL",
              "HIGH"
            ]
          }
        }
        EOF
        )
        ```

        You can relax the filter by removing the `riskLevel` block if you want all problems.

        ### 5.2 Define the Actions (Send to the ONS Topic)

        ```bash theme={null}
        ACTIONS=$(cat << EOF
        {
          "actions": [
            {
              "actionType": "ONS",
              "isEnabled": true,
              "description": "Notify on Cloud Guard Problems",
              "topicId": "$TOPIC_OCID"
            }
          ]
        }
        EOF
        )
        ```

        ### 5.3 Create the Event Rule

        ```bash theme={null}
        RULE_NAME="CloudGuard-Problems-Rule"

        oci events rule create \
          --compartment-id "$COMPARTMENT_ID" \
          --display-name "$RULE_NAME" \
          --is-enabled true \
          --condition "$RULE_CONDITION" \
          --actions "$ACTIONS"
        ```

        ***

        ## 6. (Optional) Tie into Monitoring Alarms

        If you want **Monitoring Alarms** (e.g., metrics-based) to also notify on the same topic:

        ```bash theme={null}
        NAMESPACE="oci_cloud_guard"
        QUERY="Problems[1m].count() > 0"
        ALARM_NAME="CloudGuard-Problem-Alarm"
        DESTINATION="$TOPIC_OCID"

        oci monitoring alarm create \
          --compartment-id "$COMPARTMENT_ID" \
          --display-name "$ALARM_NAME" \
          --is-enabled true \
          --metric-compartment-id "$COMPARTMENT_ID" \
          --namespace "$NAMESPACE" \
          --query "$QUERY" \
          --severity CRITICAL \
          --destinations "[\"$DESTINATION\"]" \
          --message-format PRETTY_JSON
        ```

        (Adjust the namespace/query to match your Cloud Guard metric configuration; they can vary by region/tenant and feature set.)

        ***

        After this:

        * New / updated / resolved Cloud Guard problems that match your rule condition will trigger the **Event Rule**.
        * The Event Rule publishes to the **Notifications topic**, which sends alert emails (and can be reused by Monitoring alarms).
      </Accordion>

      <Accordion title="Using Python">
        Below is a step‑by‑step remediation using Python and the OCI SDK to ensure OCI Events has a rule for Cloud Guard problems and routes them to alerting (Notifications / Monitoring).

        ***

        ## 1. Prerequisites

        1. Install OCI Python SDK:
           ```bash theme={null}
           pip install oci
           ```

        2. Ensure you have an OCI config file at `~/.oci/config` with:
           ```ini theme={null}
           [DEFAULT]
           user=ocid1.user.oc1..xxxx
           fingerprint=xx:xx:xx:xx
           key_file=/path/to/oci_api_key.pem
           tenancy=ocid1.tenancy.oc1..xxxx
           region=us-ashburn-1
           ```

        3. Cloud Guard must already be enabled in the tenancy.

        ***

        ## 2. Create a Notifications Topic (for Alerts)

        You will use Notifications as the alerting backend which Monitoring alarms can also publish to.

        ```python theme={null}
        import oci

        config = oci.config.from_file("~/.oci/config", "DEFAULT")

        TENANCY_OCID = config["tenancy"]
        COMPARTMENT_OCID = "<COMPARTMENT_OCID_FOR_ALERTING>"  # often root = TENANCY_OCID

        ons_client = oci.ons.NotificationControlPlaneClient(config)

        topic_name = "cloudguard-problems-alerts"
        topic_details = oci.ons.models.CreateTopicDetails(
            name=topic_name,
            compartment_id=COMPARTMENT_OCID,
            description="Topic for Cloud Guard problem events"
        )

        topic = ons_client.create_topic(topic_details).data
        print("Topic OCID:", topic.topic_id)
        ```

        ***

        ## 3. (Optional) Add a Subscription to the Topic

        Add an email subscription so people receive alerts.

        ```python theme={null}
        subscription_details = oci.ons.models.CreateSubscriptionDetails(
            compartment_id=COMPARTMENT_OCID,
            topic_id=topic.topic_id,
            protocol="EMAIL",
            endpoint="security-team@example.com"
        )

        sub = ons_client.create_subscription(subscription_details).data
        print("Subscription OCID:", sub.id)
        ```

        Confirm the email when OCI sends the verification email.

        ***

        ## 4. Create an Events Rule for Cloud Guard Problems

        The rule listens for Cloud Guard problem events and sends them to the Notifications topic.

        Common Cloud Guard event types include:

        * `com.oraclecloud.cloudguard.problemdetected`
        * `com.oraclecloud.cloudguard.problemupdated`
        * `com.oraclecloud.cloudguard.problemresolved`

        You can match all three.

        ```python theme={null}
        from oci.events import EventsClient
        from oci.events.models import (
            CreateRuleDetails,
            RuleCondition,
            RuleActionDetails,
            CreateArnActionDetails
        )

        events_client = EventsClient(config)

        rule_display_name = "cloudguard-problems-to-notifications"

        # Event pattern to match Cloud Guard problem events
        # Uses eventType and data.additionalDetails.lifecycleState if needed.
        # Here we match on eventType only.
        event_pattern = {
            "eventType": [
                "com.oraclecloud.cloudguard.problemdetected",
                "com.oraclecloud.cloudguard.problemupdated",
                "com.oraclecloud.cloudguard.problemresolved"
            ]
        }

        create_rule_details = CreateRuleDetails(
            compartment_id=COMPARTMENT_OCID,
            display_name=rule_display_name,
            description="Send Cloud Guard problem events to Notifications topic",
            is_enabled=True,
            condition=RuleCondition(
                # pattern is a JSON string
                expression=oci.util.to_json(event_pattern)
            ),
            actions=RuleActionDetails(
                actions=[
                    CreateArnActionDetails(
                        # Notifications ARN: ocid is ok; Events accepts OCID for ONS topic
                        action_type="ONS",
                        is_enabled=True,
                        description="Send Cloud Guard problems to ONS topic",
                        topic_id=topic.topic_id
                    )
                ]
            )
        )

        rule = events_client.create_rule(create_rule_details).data
        print("Events Rule OCID:", rule.id)
        ```

        ***

        ## 5. (Optional) Create Monitoring Alarm That Publishes to Same Topic

        If you also want a traditional Monitoring alarm (metrics‑based) to publish to the same topic:

        ```python theme={null}
        from oci.monitoring import MonitoringClient
        from oci.monitoring.models import (
            CreateAlarmDetails,
            MetricDataDetails,
            AlarmSuppression
        )

        monitoring_client = MonitoringClient(config)

        alarm_details = CreateAlarmDetails(
            display_name="CloudGuard-Problems-Metric-Alarm",
            compartment_id=COMPARTMENT_OCID,
            namespace="oci_cloud_guard",  # example; verify the actual namespace used for Cloud Guard metrics
            query="ProblemCount[1m].sum() > 0",  # example metric query
            severity="CRITICAL",
            is_enabled=True,
            destinations=[topic.topic_id],  # Notifications topic
            suppression=AlarmSuppression(is_suppressed=False),
            message_format="JSON"
        )

        alarm = monitoring_client.create_alarm(alarm_details).data
        print("Alarm OCID:", alarm.id)
        ```

        (Adjust `namespace` and `query` to match your actual Cloud Guard metrics if you use a metrics‑based alarm.)

        ***

        ## 6. Validate

        1. In OCI Console:
           * Go to **Developer Services → Events**: confirm the rule exists and is enabled.
           * Go to **Notifications → Topics**: confirm the topic and subscription.
           * (If created) Go to **Monitoring → Alarms**: confirm alarm exists and uses the topic.

        2. Trigger a test Cloud Guard problem (or use an existing one) and verify an email/notification is received.

        ***

        This completes remediation: OCI Monitoring / alerting is now wired via an Events rule listening for Cloud Guard problems and publishing to a Notifications topic using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "oci_events_rule" "cloud_guard_problem_detected" {
          # Replace with the OCID of the compartment where you want the rule to live
          compartment_id = "OCID_OF_TARGET_COMPARTMENT"

          display_name = "CloudGuard_Problem_Detected"
          description  = "Trigger on Cloud Guard Problem Detected events for automated remediation"
          is_enabled   = true

          # Match Cloud Guard "Problem Detected" events
          # If you already have a rule, update this JSON to include the eventType below.
          condition = jsonencode({
            "eventType" : [
              "com.oraclecloud.cloudguard.problemdetected"
            ]
            # Add any extra filters you need, for example:
            # "data" : {
            #   "additionalDetails" : {
            #     "riskLevel" : [ "CRITICAL", "HIGH" ]
            #   }
            # }
          })

          # Configure the action(s) you want Monitoring/Alerting to drive,
          # for example invoke a Function, send to Notifications, etc.
          actions {
            # Example: send to Notifications (ONS topic)
            actions {
              action_type = "ONS"

              # Replace with your Notifications topic OCID
              is_enabled = true
              topic_id   = "OCID_OF_OCI_NOTIFICATIONS_TOPIC"
            }

            # Example: invoke a Function for automated remediation instead:
            # actions {
            #   action_type = "FAAS"
            #   is_enabled  = true
            #   function_id = "OCID_OF_OCI_FUNCTION"
            # }
          }

          freeform_tags = {
            "OWNER" = "TEAM_NAME"
          }
        }
        ```

        Updating `condition` and `is_enabled` on `oci_events_rule` is an in‑place change and does not force replacement of the rule.

        To verify, `terraform plan` should show an update to the existing `oci_events_rule` (or creation of a new one) where `condition` now includes `eventType = ["com.oraclecloud.cloudguard.problemdetected"]` and the rule is `is_enabled = true`, along with any configured actions.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>