> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI Monitoring Should Have Event Rule For Network Gateway Changes

### More Info:

Ensure Event Rules track changes to Internet, NAT, and Service Gateways. Gateway modifications directly impact the ingress and egress routing perimeters of your secure networks.

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* HIPAA
* HITRUST CSF
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are the exact steps in the **OCI Console** to ensure you have an **Event Rule** that alerts on network gateway changes (e.g., Internet Gateways, NAT Gateways, DRGs) using **Events + Notifications**.

        ***

        ## 1. Create (or verify) a Notifications Topic

        1. In the OCI Console, open the menu and go to:\
           **Developer Services → Application Integration → Notifications**
        2. Click **Topics** (left side) → **Create Topic**.
        3. Enter:
           * **Name**: e.g., `network-gateway-changes-topic`
           * **Description**: e.g., `Alerts for OCI network gateway changes`
        4. Click **Create**.

        ### Add a subscription (email example)

        1. Open the topic you just created.
        2. Click **Create Subscription**.
        3. Protocol: **Email**\
           Endpoint: enter your email address.
        4. Click **Create**.
        5. Confirm the subscription via the email you receive (must click the confirmation link).

        ***

        ## 2. Create the Event Rule for Network Gateway Changes

        1. From the main menu go to:\
           **Observability & Management → Events Service → Rules**
        2. Click **Create Rule**.

        ### Rule Details

        3. **Name**: e.g., `network-gateway-change-rule`
        4. **Description**: e.g., `Triggers when OCI network gateways are created, updated, or deleted`
        5. **Compartment**: select the compartment that contains the gateways you want to monitor.
        6. **Rule Status**: ensure it is **Enabled**.

        ### Define the Events (Conditions)

        7. Under **Rule Conditions**, choose:
           * **Rule Type**: *Event Rules (when an event occurs)*
        8. In **Event Type**, filter by **Service = Virtual Cloud Network** (or similar naming; varies slightly by console version).
        9. Select all event types relevant to network gateways, for example (names may vary slightly by region/tenancy, but look for):

           For **Internet Gateway**:

           * `CreateInternetGateway`
           * `UpdateInternetGateway`
           * `DeleteInternetGateway`
           * (sometimes prefixed as `com.oraclecloud.virtualnetwork.createinternetgateway`, etc.)

           For **NAT Gateway**:

           * `CreateNatGateway`
           * `UpdateNatGateway`
           * `DeleteNatGateway`

           For **Dynamic Routing Gateway (DRG)**, if desired:

           * `CreateDrg`
           * `UpdateDrg`
           * `DeleteDrg`
           * `AttachDrgRouteTable`, `UpdateDrgRouteTable`, etc. (if you want route change alerts as well)

           Include all gateway types you require according to your policy.

        > If the UI only offers a generic filter builder, choose:
        >
        > * **Service**: `virtualnetwork`
        > * **Event Type**: then select the specific gateway events from the dropdown.

        ***

        ## 3. Add the Action (Send to Notifications)

        10. In **Actions**, choose **Notifications**.

        11. **Compartment**: same compartment where the topic exists.

        12. **Topic**: select the topic you created earlier:\
            `network-gateway-changes-topic`

        13. (Optional) Add tags for governance.

        14. Click **Create Rule**.

        ***

        ## 4. Verify

        * Perform a test change in a non‑production compartment (e.g., update the display name of an Internet Gateway).
        * Confirm that:
          * An **Event** is visible under **Events Service → Events**.
          * You receive an **email notification** (or whatever subscription you configured).

        This completes remediation for: **“OCI Monitoring Should Have Event Rule For Network Gateway Changes”** using the OCI Console.
      </Accordion>

      <Accordion title="Using CLI">
        Below is a minimal end‑to‑end approach using OCI CLI to:

        1. Create a Notifications topic
        2. (Optionally) add an email subscription
        3. Create an OCI Events rule that fires on network gateway changes and sends alerts to the topic

        You can adjust to your tenancy/compartment as needed.

        ***

        ## 0. Prerequisites

        * OCI CLI configured (`oci setup config`)
        * Your `compartment OCID`
        * A region where Events and Notifications are enabled
        * IAM policy that allows Events service to publish to Notifications, for example at tenancy or target compartment level:

        ```text theme={null}
        Allow service events to use ons-topics in compartment <COMPARTMENT_NAME>
        ```

        ***

        ## 1. Create a Notifications Topic

        ```bash theme={null}
        TOPIC_NAME="network-gateway-changes-topic"
        COMPARTMENT_OCID="<your_compartment_ocid>"

        oci ons topic create \
          --compartment-id "$COMPARTMENT_OCID" \
          --name "$TOPIC_NAME" \
          --description "Alerts for OCI network gateway changes"
        ```

        Capture the returned `topic-id` (OCID). For convenience:

        ```bash theme={null}
        TOPIC_OCID="<topic_ocid_from_above_command>"
        ```

        ***

        ## 2. (Optional) Add an Email Subscription

        ```bash theme={null}
        EMAIL_ADDRESS="you@example.com"

        oci ons subscription create \
          --topic-id "$TOPIC_OCID" \
          --protocol "EMAIL" \
          --endpoint "$EMAIL_ADDRESS"
        ```

        Confirm the subscription from the email you receive.

        ***

        ## 3. Prepare the Event Rule Condition

        Create a JSON file `gateway-events-condition.json`:

        ```json theme={null}
        {
          "eventType": [
            "com.oraclecloud.virtualnetwork.createinternetgateway.begin",
            "com.oraclecloud.virtualnetwork.createinternetgateway.end",
            "com.oraclecloud.virtualnetwork.updateinternetgateway.begin",
            "com.oraclecloud.virtualnetwork.updateinternetgateway.end",
            "com.oraclecloud.virtualnetwork.deleteinternetgateway.begin",
            "com.oraclecloud.virtualnetwork.deletenatgateway.begin",
            "com.oraclecloud.virtualnetwork.createnatgateway.begin",
            "com.oraclecloud.virtualnetwork.createnatgateway.end",
            "com.oraclecloud.virtualnetwork.updatenatgateway.begin",
            "com.oraclecloud.virtualnetwork.updatenatgateway.end",
            "com.oraclecloud.virtualnetwork.createservicegateway.begin",
            "com.oraclecloud.virtualnetwork.createservicegateway.end",
            "com.oraclecloud.virtualnetwork.deleteservicegateway.begin",
            "com.oraclecloud.virtualnetwork.createlocalpeeringgateway.begin",
            "com.oraclecloud.virtualnetwork.createlocalpeeringgateway.end",
            "com.oraclecloud.virtualnetwork.deletelocalpeeringgateway.begin",
            "com.oraclecloud.virtualnetwork.createdrg.begin",
            "com.oraclecloud.virtualnetwork.createdrg.end",
            "com.oraclecloud.virtualnetwork.updatedrg.begin",
            "com.oraclecloud.virtualnetwork.updatedrg.end",
            "com.oraclecloud.virtualnetwork.deletedrg.begin"
          ]
        }
        ```

        You can add/remove specific event types as required.\
        (Full list is in the Events service docs for Virtual Cloud Network / gateway resources.)

        ***

        ## 4. Create the Event Rule

        ```bash theme={null}
        RULE_NAME="network-gateway-changes-rule"
        DISPLAY_NAME="Network Gateway Change Alerts"

        oci events rule create \
          --compartment-id "$COMPARTMENT_OCID" \
          --display-name "$DISPLAY_NAME" \
          --is-enabled true \
          --condition "$(cat gateway-events-condition.json)" \
          --actions '{
            "actions": [
              {
                "actionType": "ONS",
                "isEnabled": true,
                "topicId": "'"$TOPIC_OCID"'"
              }
            ]
          }'
        ```

        This rule:

        * Listens for the specified **network gateway** events (Internet Gateway, NAT Gateway, Service Gateway, Local Peering Gateway, DRG, etc.)
        * Sends a notification to the specified **Notifications topic** when any of them occur

        ***

        ## 5. (Optional) Verify the Rule

        List rules in the compartment:

        ```bash theme={null}
        oci events rule list \
          --compartment-id "$COMPARTMENT_OCID"
        ```

        Get rule details:

        ```bash theme={null}
        RULE_OCID="<rule_ocid_from_list>"
        oci events rule get --rule-id "$RULE_OCID"
        ```

        You now have OCI monitoring/alerting for network gateway configuration changes via Events + Notifications, created entirely with OCI CLI.
      </Accordion>

      <Accordion title="Using Python">
        Below is a minimal, step‑by‑step way to ensure **OCI Events** raises alerts when **Network Gateway** resources change, using **Python + OCI SDK**.

        You will:

        1. Create a Notifications topic (if you don’t already have one).
        2. (Optionally) Add a subscription (email, Slack via HTTPS, etc.).
        3. Create an **Event Rule** that listens for **Network Gateway** changes and sends them to the topic.

        ***

        ## 0. Prerequisites

        * `oci` SDK installed:
          ```bash theme={null}
          pip install oci
          ```

        * `~/.oci/config` correctly set up with:
          * tenancy
          * user
          * fingerprint
          * key\_file
          * region
          * a profile name (e.g. `DEFAULT`)

        * Have your **compartment OCID** ready: `compartment_id = "ocid1.compartment.oc1...."`

        ***

        ## 1. Decide Which Gateways / Events You Want

        Common network gateway types in OCI:

        * Internet Gateway (`com.oraclecloud.virtualnetwork.internetgateway`)
        * NAT Gateway (`com.oraclecloud.virtualnetwork.natgateway`)
        * Dynamic Routing Gateway, DRG (`com.oraclecloud.virtualnetwork.drg`)
        * Service Gateway (`com.oraclecloud.virtualnetwork.servicegateway`)
        * Local Peering Gateway, LPG (`com.oraclecloud.virtualnetwork.localpeeringgateway`)

        Common event types:

        * `com.oraclecloud.virtualnetwork.create*`
        * `com.oraclecloud.virtualnetwork.update*`
        * `com.oraclecloud.virtualnetwork.delete*`

        You can match **all** events under the Network service or only specific ones with `eventType`.

        ***

        ## 2. Example Python Script (End‑to‑End)

        This script:

        * Creates a Notifications topic (if not present).
        * Adds an email subscription.
        * Creates an **Event Rule** for Network Gateway changes.
        * Routes Events → Notifications topic → your email (or other endpoint).

        ```python theme={null}
        import oci
        from oci.config import from_file

        # -------------------
        # CONFIG
        # -------------------
        PROFILE = "DEFAULT"  # profile in ~/.oci/config
        compartment_id = "ocid1.compartment.oc1..xxxxxxxxxxxxxxxxx"
        topic_name = "network-gateway-changes-topic"
        rule_display_name = "NetworkGatewayChangesRule"
        notification_email = "you@example.com"  # change or remove if not needed

        config = from_file(profile_name=PROFILE)

        ons_client = oci.ons.NotificationControlPlaneClient(config)
        events_client = oci.events.EventsClient(config)

        # -------------------
        # 1. Create (or get) Notifications Topic
        # -------------------
        def get_or_create_topic():
            existing = ons_client.list_topics(compartment_id=compartment_id).data
            for t in existing:
                if t.name == topic_name:
                    print(f"Using existing topic: {t.topic_id}")
                    return t

            create_details = oci.ons.models.CreateTopicDetails(
                name=topic_name,
                compartment_id=compartment_id,
                description="Alerts for OCI network gateway changes"
            )
            topic = ons_client.create_topic(create_details).data
            print(f"Created topic: {topic.topic_id}")
            return topic

        topic = get_or_create_topic()

        # -------------------
        # 2. (Optional) Create Email Subscription
        # -------------------
        def get_or_create_email_subscription(topic_id, email):
            subs = ons_client.list_subscriptions(
                compartment_id=compartment_id,
                topic_id=topic_id
            ).data
            for s in subs:
                if s.protocol == "EMAIL" and s.endpoint.lower() == email.lower():
                    print(f"Using existing email subscription: {s.id}")
                    return s

            create_sub = oci.ons.models.CreateSubscriptionDetails(
                topic_id=topic_id,
                protocol="EMAIL",
                endpoint=email
            )
            sub = ons_client.create_subscription(create_sub).data
            print(f"Created email subscription (confirm via email): {sub.id}")
            return sub

        if notification_email:
            get_or_create_email_subscription(topic.topic_id, notification_email)

        # -------------------
        # 3. Create Event Rule for Network Gateway Changes
        # -------------------
        # Event pattern for Network service – you can refine with specific resource types/eventTypes
        event_pattern = {
            "eventType": [
                # INTERNET GATEWAY
                "com.oraclecloud.virtualnetwork.createinternetgateway",
                "com.oraclecloud.virtualnetwork.updateinternetgateway",
                "com.oraclecloud.virtualnetwork.deleteinternetgateway",
                # NAT GATEWAY
                "com.oraclecloud.virtualnetwork.createnatgateway",
                "com.oraclecloud.virtualnetwork.updatenatgateway",
                "com.oraclecloud.virtualnetwork.deletenatgateway",
                # DRG
                "com.oraclecloud.virtualnetwork.createdrg",
                "com.oraclecloud.virtualnetwork.updatedrg",
                "com.oraclecloud.virtualnetwork.deletedrg",
                # SERVICE GATEWAY
                "com.oraclecloud.virtualnetwork.createservicegateway",
                "com.oraclecloud.virtualnetwork.updateservicegateway",
                "com.oraclecloud.virtualnetwork.deleteservicegateway",
                # LOCAL PEERING GATEWAY
                "com.oraclecloud.virtualnetwork.createlocalpeeringgateway",
                "com.oraclecloud.virtualnetwork.updatelocalpeeringgateway",
                "com.oraclecloud.virtualnetwork.deletelocalpeeringgateway"
            ]
        }

        # Build action to send events to Notifications topic
        action = oci.events.models.CreateActionDetails(
            action_type="ONS",
            is_enabled=True,
            description="Send network gateway change events to Notifications",
            topic_id=topic.topic_id
        )

        create_rule_details = oci.events.models.CreateRuleDetails(
            display_name=rule_display_name,
            description="Rule to capture all network gateway create/update/delete events",
            is_enabled=True,
            compartment_id=compartment_id,
            # pattern must be JSON string
            condition=str(event_pattern).replace("'", '"'),  # simple way to get JSON string
            actions=oci.events.models.ActionDetailsList(
                actions=[action]
            )
        )

        # Check if rule already exists
        existing_rules = events_client.list_rules(compartment_id=compartment_id).data
        for r in existing_rules:
            if r.display_name == rule_display_name:
                print(f"Rule '{rule_display_name}' already exists: {r.id}")
                break
        else:
            rule = events_client.create_rule(create_rule_details).data
            print(f"Created Events rule: {rule.id}")
        ```

        ***

        ## 3. How This Satisfies “Monitoring / Alerting”

        * **Monitoring**: OCI Events listens for control‑plane events (create / update / delete) on gateway resources.
        * **Alerting**: Events rule sends those events to an OCI Notifications topic.
          * Subscriptions (email, HTTPS, Slack via Webhook, PagerDuty etc.) receive alerts on each event.

        If you want to integrate with **OCI Monitoring service alarms** instead, you would typically:

        * Use Events → Notifications → Function (optional) to write metrics.
        * Or directly set up **Monitoring metrics + alarms** for data‑plane metrics (e.g., gateway traffic) — which is separate from “config change” events.

        If you tell me your exact gateway types and where you want alerts (email, Slack, webhook, etc.), I can adjust the event pattern and action code accordingly.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "oci_events_rule" "network_gateway_changes" {
          # Replace with your compartment OCID
          compartment_id = "OCID_OF_COMPARTMENT"

          display_name = "network-gateway-change-events"
          description  = "Track create, update, and delete operations on Internet, NAT, and Service Gateways"
          is_enabled   = true

          # Condition: emit events on any create, update, or delete of internet, NAT, or service gateways
          condition = jsonencode({
            "anyOf" = [
              # Internet Gateway
              { "eventType" = "com.oraclecloud.virtualnetwork.createinternetgateway" },
              { "eventType" = "com.oraclecloud.virtualnetwork.updateinternetgateway" },
              { "eventType" = "com.oraclecloud.virtualnetwork.deleteinternetgateway" },

              # NAT Gateway
              { "eventType" = "com.oraclecloud.virtualnetwork.createnatgateway" },
              { "eventType" = "com.oraclecloud.virtualnetwork.updatenatgateway" },
              { "eventType" = "com.oraclecloud.virtualnetwork.deletenatgateway" },

              # Service Gateway
              { "eventType" = "com.oraclecloud.virtualnetwork.createservicegateway" },
              { "eventType" = "com.oraclecloud.virtualnetwork.updateservicegateway" },
              { "eventType" = "com.oraclecloud.virtualnetwork.deleteservicegateway" }
            ]
          })

          actions {
            # Configure at least one action so the rule produces an alert/notification.
            # This example sends to an OCI Notifications topic.
            actions {
              action_type = "ONS"

              # Replace with your Notifications topic OCID
              is_enabled = true
              topic_id   = "OCID_OF_OCI_NOTIFICATIONS_TOPIC"
            }
          }
        }
        ```

        This change is an in-place update if the rule already exists; it does not force replacement of the rule or any gateway resources.

        For verification, `terraform plan` should show either:

        * a new `oci_events_rule.network_gateway_changes` to be created, or
        * an update to the existing rule where the `condition` (and possibly `actions`) argument changes to match the configuration above.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>