OCI Monitoring Should Have Event Rule For Interactive Logins

Using Console

Below are concise, console‑only steps to set up an OCI Event Rule and alerting for interactive (console) logins.

1. Prerequisites

You must have:
- Permission to manage events-rules and ons (Notifications) in the compartment.
- An email (or other channel) you can subscribe with.
Sign in to the OCI Console.

2. Create a Notification Topic

In the OCI Console, open the Navigation Menu.
Go to Developer Services → Application Integration → Notifications.
Click Create Topic.
Enter:
- Name: e.g., interactive-login-alerts
- Compartment: choose the compartment where you want to manage alerts.
Click Create.

Add a Subscription

On the topic details page, under Subscriptions, click Create Subscription.
Select Protocol (e.g., Email).
Enter Endpoint (e.g., your email address).
Click Create.
Check your email and confirm the subscription.

3. Create an Event Rule for Interactive Logins

Open the Navigation Menu.
Go to Developer Services → Application Integration → Events Service.
Make sure you’re in the correct Compartment.
Click Create Rule.

Rule Details

Name: interactive-console-login-events
(Optional) Description: Rule to capture interactive (console) login events
State: leave as Enabled.

Define the Event Pattern

You can do this in either Basic mode (if available) or Advanced (JSON) mode. To be explicit, use Advanced (JSON):

Select Advanced editor for the event pattern.
Use a filter similar to:
{ "eventType": [ "com.oraclecloud.identitycontrolplane.login.accept", "com.oraclecloud.identitycontrolplane.login.reject" ] }
Notes:
- accept = successful interactive login.
- reject = failed interactive login.
- If your tenancy uses slightly different event types, use the Events → Event Logs page to inspect a recent login event and adjust the eventType values accordingly.
Click Show preview (if present) to validate, then Save or Next.

Add an Action (Send Notification)

Under Actions, click Add Action.
Action Type: Notifications.
Topic: choose the topic you created earlier (e.g., interactive-login-alerts).
(Optional) Add free-form tags or defined tags as needed.
Click Create (or Save).

4. Verify the Rule

Log out of OCI.
Log back in via the web console (an interactive login).
Check:
- Notifications: email (or other protocol) message should arrive.
- Events Service → Event Logs: confirm login events are being captured and match your rule’s eventType.

This remediates the issue by ensuring all interactive (console) logins generate an OCI Event which triggers a Notification alert.

Using CLI

Below is a concrete, CLI‑only way to fix this by creating:

An Events rule that watches for interactive (console) logins
A Notifications topic + subscription so you actually get alerted

Replace placeholders (<...>) with your values.

1. Set some reusable variables

# Region and compartment
export OCI_REGION="<your-region>"         # e.g. eu-frankfurt-1
export COMP_OCID="<target-compartment-ocid>"

# Notification target (email, Slack via HTTPS, etc.)
export ALERT_EMAIL="<your-alert-email@example.com>"

# Optional: profile in ~/.oci/config
export OCI_CLI_PROFILE="<your-profile-name>"   # or omit --profile later

2. Create a Notifications topic

oci ons topic create \
  --name "InteractiveLoginAlertsTopic" \
  --compartment-id "$COMP_OCID" \
  --description "Alerting for OCI interactive (console) logins" \
  --region "$OCI_REGION" \
  ${OCI_CLI_PROFILE:+--profile "$OCI_CLI_PROFILE"}

Save the topic OCID from the output:

export TOPIC_OCID="<ocid1.onstopic.oc1....>"

3. Create a subscription (email example)

oci ons subscription create \
  --topic-id "$TOPIC_OCID" \
  --protocol EMAIL \
  --endpoint "$ALERT_EMAIL" \
  --region "$OCI_REGION" \
  ${OCI_CLI_PROFILE:+--profile "$OCI_CLI_PROFILE"}

Go to your email inbox and confirm the subscription (OCI won’t send messages until confirmed).

4. Create an Events rule for interactive (console) logins

OCI emits IAM login events like:

com.oraclecloud.identitycontrolplane.login.accept
com.oraclecloud.identitycontrolplane.login.reject (or login.failure depending on tenancy/region)

You want to filter console/UI logins only. A common pattern is to inspect data.additionalDetails.authenticationMechanism or similar fields. Because the exact field can vary, here is a broad but safe starting filter that watches all logins; you can then narrow it down after you inspect a few sample events.Create a file login_rule_condition.json:

{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.login.accept",
    "com.oraclecloud.identitycontrolplane.login.reject",
    "com.oraclecloud.identitycontrolplane.login.failure"
  ]
}

Now create the rule (Events service):

oci events rule create \
  --display-name "InteractiveLoginEventsRule" \
  --description "Capture all IAM login events (console/interactive) for alerting" \
  --compartment-id "$COMP_OCID" \
  --is-enabled true \
  --condition "$(cat login_rule_condition.json)" \
  --actions '{
    "actions": [
      {
        "actionType": "ONS",
        "isEnabled": true,
        "topicId": "'"$TOPIC_OCID"'"
      }
    ]
  }' \
  --region "$OCI_REGION" \
  ${OCI_CLI_PROFILE:+--profile "$OCI_CLI_PROFILE"}

This remediates the “no event rule for interactive logins” gap by at least ensuring all login events generate notifications.

5. (Optional but recommended) Refine to “interactive / console” only

After a few events arrive, take one event payload (from the email or from the Events history in the console) and note the fields that identify a console/interactive login, for example:

data.additionalDetails.authType or
data.additionalDetails.authenticationMechanism
or similar field with value like "UI", "console", or "password"

Then adjust login_rule_condition.json to be more specific. Example (you must adapt the field names/values to what you actually see):

{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.login.accept",
    "com.oraclecloud.identitycontrolplane.login.failure"
  ],
  "data": {
    "additionalDetails": {
      "authenticationMechanism": [
        "UI",
        "console"
      ]
    }
  }
}

Update the rule:

oci events rule update \
  --rule-id "<ocid1.eventsrule.oc1....>" \
  --condition "$(cat login_rule_condition.json)" \
  --is-enabled true \
  --region "$OCI_REGION" \
  ${OCI_CLI_PROFILE:+--profile "$OCI_CLI_PROFILE"}

This gives you an OCI Events rule (monitored via Notifications) that alerts on interactive/console logins, created and managed entirely with the OCI CLI.

Using Python

Below is a concise, practical way to remediate this in OCI using Python and the OCI SDK:Goal:
Create an Event Rule that triggers on interactive logins (Audit events) and sends alerts (Notifications / Monitoring).

0. Prereqs

Install OCI SDK:
pip install oci
Configure OCI CLI profile (used by SDK):
oci setup config
This creates ~/.oci/config with a profile (e.g. DEFAULT).
Make sure:
- You have permission to manage events-rules, ons-topics, ons-subscriptions.
- Audit is enabled (it is by default in OCI tenants).

Audit events come from com.oraclecloud.identitycontrolplane (sign‑in, token, etc.).
A common pattern for user sign‑in is:

eventType containing Login or similar identity events.
data.identity.type = "user"
data.subject or data.identity.principalName is the username.

For a simple “any user login” signal, use an event rule condition like:

"\"eventType\" = 'com.oraclecloud.identitycontrolplane.login'"

or a broader pattern (if you need to match more than one event type):

"\"eventType\" LIKE 'com.oraclecloud.identitycontrolplane.%login%'"

Adjust this expression to match exactly what your environment produces (you can inspect recent Audit logs in the Console → Audit).

2. Python Script – Create Notification Topic & Subscription

This creates a Notifications topic and subscribes your email to it. The Event Rule will publish to this topic.

import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")

compartment_id = "<YOUR_COMPARTMENT_OCID>"
topic_name = "interactive-login-alerts"
subscription_email = "you@example.com"

ons_client = oci.ons.NotificationControlPlaneClient(config)

# 1) Create topic
topic_details = oci.ons.models.CreateTopicDetails(
    name=topic_name,
    compartment_id=compartment_id,
    description="Alerts for interactive logins (audit events)"
)
topic = ons_client.create_topic(topic_details).data
print("Created topic:", topic.topic_id)

# 2) Create email subscription
subscription_details = oci.ons.models.CreateSubscriptionDetails(
    topic_id=topic.topic_id,
    protocol="EMAIL",
    endpoint=subscription_email,
    compartment_id=compartment_id
)
sub = ons_client.create_subscription(subscription_details).data
print("Created subscription:", sub.id)

Wait for the subscription confirmation email and confirm it.

3. Python Script – Create Event Rule for Interactive Logins

This rule will listen to Audit events and send them to the Notifications topic.

import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")

compartment_id = "<YOUR_COMPARTMENT_OCID>"
topic_id = "<TOPIC_OCID_FROM_PREVIOUS_STEP>"

events_client = oci.events.EventsClient(config)

rule_display_name = "interactive-login-event-rule"
rule_description = "Trigger on interactive user login events and send notification"

# Example condition: adjust 'eventType' to match your actual login event name
condition = """
{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.login"
  ]
}
"""

create_rule_details = oci.events.models.CreateRuleDetails(
    display_name=rule_display_name,
    description=rule_description,
    is_enabled=True,
    compartment_id=compartment_id,
    # AUDIT is the source for sign-in events
    # For region-wide Audit events, just use 'com.oraclecloud.audit'
    # or 'com.oraclecloud.audit.v2' depending on your tenancy (check docs / Audit event samples).
    condition=condition,
    # targets: Notifications topic
    actions=oci.events.models.ActionDetailsList(
        actions=[
            oci.events.models.NotificationActionDetails(
                action_type="ONS",
                is_enabled=True,
                topic_id=topic_id,
                description="Send alert for interactive login"
            )
        ]
    )
)

rule = events_client.create_rule(create_rule_details).data
print("Created event rule:", rule.id)

Notes:

condition must match the Audit event schema in your tenancy.
If your audit events use a slightly different event type, query Audit logs (Console) and adjust accordingly.

4. Validate

Perform an interactive login (or have a test user log in).
Check:
- Audit: event is logged.
- Events: Event Rule is ACTIVE.
- Notifications: email alert is received.

5. Optional – Turn This into “Monitoring Alarm”

If you must use Monitoring Alarms (metrics-based) instead of only Events:

Create a custom metric that increments on each login via an OCI Function or Stream/Log pipeline invoked by the Event Rule.
Create an Alarm on that metric using the Monitoring service (via Python oci.monitoring.MonitoringClient).

That is more complex and usually unnecessary if your compliance requirement is simply “Alert on interactive logins”; using Events + Notifications is the normal pattern in OCI.If you share a sample Audit event from your tenant, I can give you the exact condition JSON to use.

Using Terraform

resource "oci_events_rule" "interactive_console_logins" {
  # Replace with your compartment OCID
  compartment_id = "OCID_OF_TARGET_COMPARTMENT"

  display_name = "interactive-console-logins"
  description  = "Event rule to track interactive console (UI) logins"

  is_enabled = true

  # This pattern matches both successful and failed interactive (UI) console logins
  condition = jsonencode({
    "eventType" : [
      "com.oraclecloud.identitycontrolplane.login.success",
      "com.oraclecloud.identitycontrolplane.login.fail"
    ],
    "data" : {
      "additionalDetails" : {
        "authentication" : [
          "UI"
        ]
      }
    }
  })

  actions {
    # At least one action is required for the rule to be useful
    actions {
      # Replace with your Notifications topic OCID
      action_type = "ONS"
      is_enabled  = true
      topic_id    = "OCID_OF_NOTIFICATIONS_TOPIC_FOR_LOGIN_ALERTS"
    }
  }

  # Replace with desired freeform tags or remove block
  freeform_tags = {
    "ENV"  = "ENVIRONMENT_NAME"
    "TYPE" = "security-monitoring"
  }
}

If you change an existing oci_events_rule this way, Terraform will update it in place (no replacement/outage), unless you change immutable attributes like compartment_id, which would force recreation.To verify, run terraform plan and ensure it shows an in-place update (or creation) of oci_events_rule.interactive_console_logins with the new condition JSON and the desired actions block.

OCI Misconfigurations

OCI Monitoring Should Have Event Rule For Interactive Logins

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisites

2. Create a Notification Topic

Add a Subscription

3. Create an Event Rule for Interactive Logins

Rule Details

Define the Event Pattern

Add an Action (Send Notification)

4. Verify the Rule

1. Set some reusable variables

2. Create a Notifications topic

3. Create a subscription (email example)

4. Create an Events rule for interactive (console) logins

5. (Optional but recommended) Refine to “interactive / console” only

0. Prereqs

2. Python Script – Create Notification Topic & Subscription

3. Python Script – Create Event Rule for Interactive Logins

4. Validate

5. Optional – Turn This into “Monitoring Alarm”

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Prerequisites

​2. Create a Notification Topic

​Add a Subscription

​3. Create an Event Rule for Interactive Logins

​Rule Details

​Define the Event Pattern

​Add an Action (Send Notification)

​4. Verify the Rule

​1. Set some reusable variables

​2. Create a Notifications topic

​3. Create a subscription (email example)

​4. Create an Events rule for interactive (console) logins

​4.1: Broad login rule (accept + failure)

​5. (Optional but recommended) Refine to “interactive / console” only

​0. Prereqs

​1. Decide the “Interactive Login” Event Filter

​2. Python Script – Create Notification Topic & Subscription

​3. Python Script – Create Event Rule for Interactive Logins

​4. Validate

​5. Optional – Turn This into “Monitoring Alarm”

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisites

2. Create a Notification Topic

Add a Subscription

3. Create an Event Rule for Interactive Logins

Rule Details

Define the Event Pattern

Add an Action (Send Notification)

4. Verify the Rule

1. Set some reusable variables

2. Create a Notifications topic

3. Create a subscription (email example)

4. Create an Events rule for interactive (console) logins

4.1: Broad login rule (accept + failure)

5. (Optional but recommended) Refine to “interactive / console” only

0. Prereqs

1. Decide the “Interactive Login” Event Filter

2. Python Script – Create Notification Topic & Subscription

3. Python Script – Create Event Rule for Interactive Logins

4. Validate

5. Optional – Turn This into “Monitoring Alarm”