> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI Monitoring Should Have Event Rule For Interactive Logins ### More Info: Track interactive console logons via Event Rules. For highly automated environments, interactive human console access should be rare and heavily scrutinized for anomalies. ### Risk Level Medium ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS AWS * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * HIPAA * ISO 27001 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Below are concise, console‑only steps to set up an OCI Event Rule and alerting for interactive (console) logins. *** ## 1. Prerequisites 1. You must have: * Permission to manage `events-rules` and `ons` (Notifications) in the compartment. * An email (or other channel) you can subscribe with. 2. Sign in to the **OCI Console**. *** ## 2. Create a Notification Topic 1. In the OCI Console, open the **Navigation Menu**. 2. Go to **Developer Services → Application Integration → Notifications**. 3. Click **Create Topic**. 4. Enter: * **Name**: e.g., `interactive-login-alerts` * **Compartment**: choose the compartment where you want to manage alerts. 5. Click **Create**. ### Add a Subscription 1. On the topic details page, under **Subscriptions**, click **Create Subscription**. 2. Select **Protocol** (e.g., `Email`). 3. Enter **Endpoint** (e.g., your email address). 4. Click **Create**. 5. Check your email and **confirm** the subscription. *** ## 3. Create an Event Rule for Interactive Logins 1. Open the **Navigation Menu**. 2. Go to **Developer Services → Application Integration → Events Service**. 3. Make sure you’re in the correct **Compartment**. 4. Click **Create Rule**. ### Rule Details 1. **Name**: `interactive-console-login-events` 2. (Optional) **Description**: `Rule to capture interactive (console) login events` 3. **State**: leave as **Enabled**. ### Define the Event Pattern You can do this in either Basic mode (if available) or Advanced (JSON) mode. To be explicit, use **Advanced (JSON)**: 1. Select **Advanced** editor for the event pattern. 2. Use a filter similar to: ```json theme={null} { "eventType": [ "com.oraclecloud.identitycontrolplane.login.accept", "com.oraclecloud.identitycontrolplane.login.reject" ] } ``` Notes: * `accept` = successful interactive login. * `reject` = failed interactive login. * If your tenancy uses slightly different event types, use the **Events → Event Logs** page to inspect a recent login event and adjust the `eventType` values accordingly. 3. Click **Show preview** (if present) to validate, then **Save** or **Next**. ### Add an Action (Send Notification) 1. Under **Actions**, click **Add Action**. 2. **Action Type**: `Notifications`. 3. **Topic**: choose the topic you created earlier (e.g., `interactive-login-alerts`). 4. (Optional) Add **free-form tags** or **defined tags** as needed. 5. Click **Create** (or **Save**). *** ## 4. Verify the Rule 1. Log out of OCI. 2. Log back in via the web console (an interactive login). 3. Check: * **Notifications**: email (or other protocol) message should arrive. * **Events Service → Event Logs**: confirm login events are being captured and match your rule’s `eventType`. *** This remediates the issue by ensuring all interactive (console) logins generate an OCI Event which triggers a Notification alert. Below is a concrete, CLI‑only way to fix this by creating: 1. An Events rule that watches for interactive (console) logins 2. A Notifications topic + subscription so you actually get alerted Replace placeholders (`<...>`) with your values. *** ## 1. Set some reusable variables ```bash theme={null} # Region and compartment export OCI_REGION="" # e.g. eu-frankfurt-1 export COMP_OCID="" # Notification target (email, Slack via HTTPS, etc.) export ALERT_EMAIL="" # Optional: profile in ~/.oci/config export OCI_CLI_PROFILE="" # or omit --profile later ``` *** ## 2. Create a Notifications topic ```bash theme={null} oci ons topic create \ --name "InteractiveLoginAlertsTopic" \ --compartment-id "$COMP_OCID" \ --description "Alerting for OCI interactive (console) logins" \ --region "$OCI_REGION" \ ${OCI_CLI_PROFILE:+--profile "$OCI_CLI_PROFILE"} ``` Save the topic OCID from the output: ```bash theme={null} export TOPIC_OCID="" ``` *** ## 3. Create a subscription (email example) ```bash theme={null} oci ons subscription create \ --topic-id "$TOPIC_OCID" \ --protocol EMAIL \ --endpoint "$ALERT_EMAIL" \ --region "$OCI_REGION" \ ${OCI_CLI_PROFILE:+--profile "$OCI_CLI_PROFILE"} ``` Go to your email inbox and **confirm** the subscription (OCI won’t send messages until confirmed). *** ## 4. Create an Events rule for interactive (console) logins OCI emits IAM login events like: * `com.oraclecloud.identitycontrolplane.login.accept` * `com.oraclecloud.identitycontrolplane.login.reject` (or `login.failure` depending on tenancy/region) You want to filter **console/UI** logins only. A common pattern is to inspect `data.additionalDetails.authenticationMechanism` or similar fields. Because the exact field can vary, here is a broad but safe starting filter that watches *all* logins; you can then narrow it down after you inspect a few sample events. ### 4.1: Broad login rule (accept + failure) Create a file `login_rule_condition.json`: ```json theme={null} { "eventType": [ "com.oraclecloud.identitycontrolplane.login.accept", "com.oraclecloud.identitycontrolplane.login.reject", "com.oraclecloud.identitycontrolplane.login.failure" ] } ``` Now create the rule (Events service): ```bash theme={null} oci events rule create \ --display-name "InteractiveLoginEventsRule" \ --description "Capture all IAM login events (console/interactive) for alerting" \ --compartment-id "$COMP_OCID" \ --is-enabled true \ --condition "$(cat login_rule_condition.json)" \ --actions '{ "actions": [ { "actionType": "ONS", "isEnabled": true, "topicId": "'"$TOPIC_OCID"'" } ] }' \ --region "$OCI_REGION" \ ${OCI_CLI_PROFILE:+--profile "$OCI_CLI_PROFILE"} ``` This remediates the “no event rule for interactive logins” gap by at least ensuring *all* login events generate notifications. *** ## 5. (Optional but recommended) Refine to “interactive / console” only After a few events arrive, take one event payload (from the email or from the Events history in the console) and note the fields that identify a console/interactive login, for example: * `data.additionalDetails.authType` or * `data.additionalDetails.authenticationMechanism` * or similar field with value like `"UI"`, `"console"`, or `"password"` Then adjust `login_rule_condition.json` to be more specific. Example (you must adapt the field names/values to what you actually see): ```json theme={null} { "eventType": [ "com.oraclecloud.identitycontrolplane.login.accept", "com.oraclecloud.identitycontrolplane.login.failure" ], "data": { "additionalDetails": { "authenticationMechanism": [ "UI", "console" ] } } } ``` Update the rule: ```bash theme={null} oci events rule update \ --rule-id "" \ --condition "$(cat login_rule_condition.json)" \ --is-enabled true \ --region "$OCI_REGION" \ ${OCI_CLI_PROFILE:+--profile "$OCI_CLI_PROFILE"} ``` *** This gives you an OCI Events rule (monitored via Notifications) that alerts on interactive/console logins, created and managed entirely with the OCI CLI. Below is a concise, practical way to remediate this in OCI using Python and the OCI SDK: Goal:\ Create an Event Rule that triggers on **interactive logins** (Audit events) and sends alerts (Notifications / Monitoring). *** ## 0. Prereqs 1. Install OCI SDK: ```bash theme={null} pip install oci ``` 2. Configure OCI CLI profile (used by SDK): ```bash theme={null} oci setup config ``` This creates `~/.oci/config` with a profile (e.g. `DEFAULT`). 3. Make sure: * You have permission to manage `events-rules`, `ons-topics`, `ons-subscriptions`. * Audit is enabled (it is by default in OCI tenants). *** ## 1. Decide the “Interactive Login” Event Filter Audit events come from `com.oraclecloud.identitycontrolplane` (sign‑in, token, etc.).\ A common pattern for user sign‑in is: * `eventType` containing `Login` or similar identity events. * `data.identity.type = "user"` * `data.subject` or `data.identity.principalName` is the username. For a simple “any user login” signal, use an event rule condition like: ```json theme={null} "\"eventType\" = 'com.oraclecloud.identitycontrolplane.login'" ``` or a broader pattern (if you need to match more than one event type): ```json theme={null} "\"eventType\" LIKE 'com.oraclecloud.identitycontrolplane.%login%'" ``` Adjust this expression to match exactly what your environment produces (you can inspect recent Audit logs in the Console → Audit). *** ## 2. Python Script – Create Notification Topic & Subscription This creates a Notifications topic and subscribes your email to it. The Event Rule will publish to this topic. ```python theme={null} import oci config = oci.config.from_file("~/.oci/config", "DEFAULT") compartment_id = "" topic_name = "interactive-login-alerts" subscription_email = "you@example.com" ons_client = oci.ons.NotificationControlPlaneClient(config) # 1) Create topic topic_details = oci.ons.models.CreateTopicDetails( name=topic_name, compartment_id=compartment_id, description="Alerts for interactive logins (audit events)" ) topic = ons_client.create_topic(topic_details).data print("Created topic:", topic.topic_id) # 2) Create email subscription subscription_details = oci.ons.models.CreateSubscriptionDetails( topic_id=topic.topic_id, protocol="EMAIL", endpoint=subscription_email, compartment_id=compartment_id ) sub = ons_client.create_subscription(subscription_details).data print("Created subscription:", sub.id) ``` Wait for the subscription confirmation email and confirm it. *** ## 3. Python Script – Create Event Rule for Interactive Logins This rule will listen to Audit events and send them to the Notifications topic. ```python theme={null} import oci config = oci.config.from_file("~/.oci/config", "DEFAULT") compartment_id = "" topic_id = "" events_client = oci.events.EventsClient(config) rule_display_name = "interactive-login-event-rule" rule_description = "Trigger on interactive user login events and send notification" # Example condition: adjust 'eventType' to match your actual login event name condition = """ { "eventType": [ "com.oraclecloud.identitycontrolplane.login" ] } """ create_rule_details = oci.events.models.CreateRuleDetails( display_name=rule_display_name, description=rule_description, is_enabled=True, compartment_id=compartment_id, # AUDIT is the source for sign-in events # For region-wide Audit events, just use 'com.oraclecloud.audit' # or 'com.oraclecloud.audit.v2' depending on your tenancy (check docs / Audit event samples). condition=condition, # targets: Notifications topic actions=oci.events.models.ActionDetailsList( actions=[ oci.events.models.NotificationActionDetails( action_type="ONS", is_enabled=True, topic_id=topic_id, description="Send alert for interactive login" ) ] ) ) rule = events_client.create_rule(create_rule_details).data print("Created event rule:", rule.id) ``` Notes: * `condition` must match the **Audit** event schema in your tenancy. * If your audit events use a slightly different event type, query Audit logs (Console) and adjust accordingly. *** ## 4. Validate 1. Perform an interactive login (or have a test user log in). 2. Check: * **Audit**: event is logged. * **Events**: Event Rule is `ACTIVE`. * **Notifications**: email alert is received. *** ## 5. Optional – Turn This into “Monitoring Alarm” If you must use **Monitoring** Alarms (metrics-based) instead of only Events: 1. Create a **custom metric** that increments on each login via an OCI Function or Stream/Log pipeline invoked by the Event Rule. 2. Create an Alarm on that metric using the Monitoring service (via Python `oci.monitoring.MonitoringClient`). That is more complex and usually unnecessary if your compliance requirement is simply “Alert on interactive logins”; using Events + Notifications is the normal pattern in OCI. If you share a sample Audit event from your tenant, I can give you the exact `condition` JSON to use. ```hcl theme={null} resource "oci_events_rule" "interactive_console_logins" { # Replace with your compartment OCID compartment_id = "OCID_OF_TARGET_COMPARTMENT" display_name = "interactive-console-logins" description = "Event rule to track interactive console (UI) logins" is_enabled = true # This pattern matches both successful and failed interactive (UI) console logins condition = jsonencode({ "eventType" : [ "com.oraclecloud.identitycontrolplane.login.success", "com.oraclecloud.identitycontrolplane.login.fail" ], "data" : { "additionalDetails" : { "authentication" : [ "UI" ] } } }) actions { # At least one action is required for the rule to be useful actions { # Replace with your Notifications topic OCID action_type = "ONS" is_enabled = true topic_id = "OCID_OF_NOTIFICATIONS_TOPIC_FOR_LOGIN_ALERTS" } } # Replace with desired freeform tags or remove block freeform_tags = { "ENV" = "ENVIRONMENT_NAME" "TYPE" = "security-monitoring" } } ``` If you change an existing `oci_events_rule` this way, Terraform will update it in place (no replacement/outage), unless you change immutable attributes like `compartment_id`, which would force recreation. To verify, run `terraform plan` and ensure it shows an in-place update (or creation) of `oci_events_rule.interactive_console_logins` with the new `condition` JSON and the desired `actions` block.