OCI Monitoring Should Have Event Rule For VCN Changes

Using Console

Below are concise, step‑by‑step instructions to create an OCI Event Rule for VCN changes and wire it into alerting via Notifications (and optionally Monitoring Alarms), using only the OCI Console.

1. Prerequisites

Make sure you have:
- Permissions to manage events and ons (Notifications) in the target compartment.
Decide:
- Which compartment you want to monitor VCN changes in.
- Where you want alerts to go (email, Slack via HTTPS, PagerDuty, etc.).

2. Create a Notifications Topic

Sign in to OCI Console.
Open the hamburger menu → Developer Services → Notifications → Topics.
Click Create Topic.
- Name: e.g., vcn-change-alerts-topic
- Compartment: Choose the target compartment.
Click Create.

Add a Subscription

Open the topic you just created.
Under Subscriptions, click Create Subscription.
Choose:
- Protocol: e.g., Email.
- Email: enter the recipient address.
Click Create.
Go to your email and confirm the subscription (mandatory).

3. Create an Event Rule for VCN Changes

Open the hamburger menu → Observability & Management → Events Service → Rules.
Make sure the compartment is the one where you want the rule to live.
Click Create Rule.

Rule Details

Name: e.g., detect-vcn-changes.
Description: Alert on VCN create, update, and delete events.
State: Ensure it is set to Enabled.

Define the Event Pattern

You have two main options:

Option A: Use the Basic Pattern (Service + Event Types)

Under Rule Conditions, select:
- Service Name: Networking (or Virtual Cloud Network depending on console wording).
For Event Type, select VCN-related events such as:
- com.oraclecloud.virtualnetwork.createvcn.end
- com.oraclecloud.virtualnetwork.updatevcn.end
- com.oraclecloud.virtualnetwork.deletevcn.end (Name may appear slightly differently; pick all VCN Create/Update/Delete event types).
Narrow by Compartment:
- Choose the compartment where the VCNs are/will be created (or root if you want tenancy-wide and then filter via conditions or multiple rules).

Option B: Use an Advanced Pattern (if needed)

Switch to Use a Custom Event Pattern (Advanced).
Use a filter similar to:

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.createvcn.end",
    "com.oraclecloud.virtualnetwork.updatevcn.end",
    "com.oraclecloud.virtualnetwork.deletevcn.end"
  ],
  "data": {
    "compartmentId": [
      "<OCID_OF_TARGET_COMPARTMENT>"
    ]
  }
}

Replace <OCID_OF_TARGET_COMPARTMENT> with your compartment OCID if you want to constrain scope.

4. Add the Action (Send Notification)

In the Actions section of the rule, click Add Action.
Action Type: Notifications.
Topic: Select the topic you created (vcn-change-alerts-topic).
Click Add.
Click Create to finalize the Event Rule.

Now, every time a VCN is created, updated, or deleted in the specified compartment(s), an event will trigger a message to your Notifications topic, which will send email (or other protocol) alerts.

5. (Optional) Integrate with Monitoring Alarms

If you specifically want OCI Monitoring Alarms (metrics‑based) in addition to event‑based notifications:

Typically, VCN configuration changes are event‑driven, not metric‑driven, so you:
- Keep the Event Rule to push messages via Notifications to people/tools.
- Use Monitoring Alarms for metrics (e.g., traffic, errors) separately.
If you want an alarm-like behavior:
- Create an Alarm in Observability & Management → Monitoring → Alarms for relevant network metrics (e.g., dropped packets, high traffic) and send it to the same Notifications topic.

6. Validate the Setup

Make a small, safe VCN change in the monitored compartment:
- e.g., update the VCN display name or create a test VCN.
Confirm:
- Event Rule logs an invocation (visible in Events Service details).
- A notification email (or other protocol message) is received at the configured subscription.

This completes remediation: OCI now has an Event Rule for VCN changes wired into your alerting via Notifications (and optionally Monitoring alarms).

Using CLI

Below are step‑by‑step OCI CLI instructions to ensure Monitoring/Alerting is in place for VCN changes by creating an Events rule that triggers a Notifications topic whenever a VCN is created/updated/deleted.

0. Prerequisites

OCI CLI installed and configured (oci setup config already done).

Your compartment OCID is known:

COMPARTMENT_OCID="<your_compartment_ocid>"

You have permission to use:
- oci ons (Notifications)
- oci events
- oci iam (if you need policies)

1. (Optional) Create a Notifications Topic

If you already have a Notifications topic you want to use, skip to step 3 and use its OCID.

TOPIC_NAME="vcn-change-topic"
TOPIC_DESC="Topic for VCN change events"

oci ons topic create \
  --name "$TOPIC_NAME" \
  --compartment-id "$COMPARTMENT_OCID" \
  --description "$TOPIC_DESC" \
  --wait-for-state ACTIVE \
  --query "data.id" \
  --raw-output

Save the output as:

TOPIC_OCID="<output_from_command_above>"

2. (Optional) Add a Subscription to the Topic

For example, an email subscription:

SUBSCR_PROTOCOL="EMAIL"
SUBSCR_ENDPOINT="you@example.com"

oci ons subscription create \
  --compartment-id "$COMPARTMENT_OCID" \
  --topic-id "$TOPIC_OCID" \
  --protocol "$SUBSCR_PROTOCOL" \
  --endpoint "$SUBSCR_ENDPOINT" \
  --wait-for-state ACTIVE

Confirm the subscription by clicking the link in the email.

3. Create Event Rule JSON Condition for VCN Changes

Create a file vcn-events-condition.json:

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.createvcn",
    "com.oraclecloud.virtualnetwork.updatevcn",
    "com.oraclecloud.virtualnetwork.deletevcn"
  ],
  "data": {
    "resourceName": [],
    "compartmentId": []
  }
}

You can also filter to a specific compartment or VCN by filling data.compartmentId or data.resourceName arrays, but for all VCNs, leave them empty as above.Wrap this in the Events Rule “condition” structure (OCI requires "eventType" and "data" to be inside "conditions"):Create vcn-rule-condition.json:

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.createvcn",
    "com.oraclecloud.virtualnetwork.updatevcn",
    "com.oraclecloud.virtualnetwork.deletevcn"
  ],
  "data": {
    "resourceName": [],
    "compartmentId": []
  }
}

The CLI expects it like this:

CONDITION_JSON=$(cat vcn-rule-condition.json | python -c 'import json,sys; print(json.dumps({"eventType": json.load(sys.stdin)["eventType"], "data": json.load(open("vcn-rule-condition.json"))["data"]}))')

To avoid confusion, simply create a single correct condition file:Final vcn-rule-condition.json:

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.createvcn",
    "com.oraclecloud.virtualnetwork.updatevcn",
    "com.oraclecloud.virtualnetwork.deletevcn"
  ],
  "data": {
    "resourceName": [],
    "compartmentId": []
  }
}

4. Create the Events Rule

Use the Notifications topic as the rule’s action:

RULE_DISPLAY_NAME="VCN-Change-Rule"
RULE_DESC="Triggers when VCNs are created, updated, or deleted"

oci events rule create \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$RULE_DISPLAY_NAME" \
  --is-enabled true \
  --condition "$(cat vcn-rule-condition.json)" \
  --actions '{
    "actions": [
      {
        "actionType": "ONS",
        "isEnabled": true,
        "topicId": "'"$TOPIC_OCID"'"
      }
    ]
  }' \
  --description "$RULE_DESC" \
  --wait-for-state ACTIVE

This creates a rule that:

Listens for these event types:
- com.oraclecloud.virtualnetwork.createvcn
- com.oraclecloud.virtualnetwork.updatevcn
- com.oraclecloud.virtualnetwork.deletevcn
Sends a notification to the ONS topic when they occur.

5. (Optional) Verify the Rule

List rules in the compartment:

oci events rule list \
  --compartment-id "$COMPARTMENT_OCID" \
  --all \
  --query "data[?\"display-name\"=='$RULE_DISPLAY_NAME']"

6. (Optional) Update an Existing Rule

If a rule exists but lacks VCN events, adjust it:

Get the rule OCID:
RULE_OCID="<existing_rule_ocid>"

Update the condition file with VCN event types and then run:

oci events rule update \
  --rule-id "$RULE_OCID" \
  --condition "$(cat vcn-rule-condition.json)" \
  --force \
  --wait-for-state ACTIVE

Once these steps are done, your OCI environment will have an Events rule that alerts (via Notifications) for all VCN configuration changes, satisfying the requirement “OCI Monitoring Should Have Event Rule For VCN Changes.”

Using Python

Below is a concrete way to remediate “OCI Monitoring should have Event Rule for VCN changes” using Python and the OCI SDK.Goal
Create an Event Rule that listens to VCN configuration changes and sends alerts (via OCI Notifications / Monitoring).Assumptions

You have:
- OCI tenancy, compartment OCID
- Proper IAM permissions: manage events-rules, manage ons-topics, etc.
- Working ~/.oci/config profile (or equivalent config in environment variables).
You want:
- An Events rule that triggers when a VCN is created/updated/deleted.
- An alert via Notifications (email) or similar.

1. Define what events you want to capture

Typical VCN configuration change events come from the com.oraclecloud.virtualnetwork service and category Resource (or Api depending on how strict you want). Safe generic pattern:

{
  "eventType": "com.oraclecloud.virtualnetwork.vcn.*",
  "data": {
    "eventType": "com.oraclecloud.virtualnetwork.vcn.*"
  }
}

To be more precise, you can match:

com.oraclecloud.virtualnetwork.vcn.create
com.oraclecloud.virtualnetwork.vcn.update
com.oraclecloud.virtualnetwork.vcn.delete

OCI Events use an event pattern (JSON) to filter events.

2. Create (or reuse) a Notifications topic

You generally want the Event Rule to send messages to an OCI Notifications topic, then subscribe email / HTTPS, etc.

Sample Python script: create topic (if not exists) and subscription

import oci

config = oci.config.from_file()  # default profile and path
compartment_id = "<YOUR_COMPARTMENT_OCID>"
topic_name = "vcn-change-alerts-topic"
subscription_endpoint = "<YOUR_EMAIL_ADDRESS>"  # or HTTPS endpoint

ons_client = oci.ons.NotificationControlPlaneClient(config)

# 1. Check if topic exists
existing_topics = oci.pagination.list_call_get_all_results(
    ons_client.list_topics,
    compartment_id=compartment_id
).data

topic = next((t for t in existing_topics if t.name == topic_name), None)

# 2. Create topic if needed
if not topic:
    create_topic_details = oci.ons.models.CreateTopicDetails(
        name=topic_name,
        compartment_id=compartment_id,
        description="Alerts for VCN configuration changes"
    )
    topic = ons_client.create_topic(create_topic_details).data
    print(f"Created topic: {topic.name} ({topic.topic_id})")
else:
    print(f"Using existing topic: {topic.name} ({topic.topic_id})")

topic_id = topic.topic_id

# 3. Create subscription (email example)
ons_sub_client = oci.ons.NotificationDataPlaneClient(config)

create_sub_details = oci.ons.models.CreateSubscriptionDetails(
    compartment_id=compartment_id,
    topic_id=topic_id,
    protocol="EMAIL",  # or "HTTPS", "PAGERDUTY", "SLACK", etc.
    endpoint=subscription_endpoint,
    freeform_tags={"purpose": "vcn-change-alerts"}
)

subscription = ons_sub_client.create_subscription(create_sub_details).data
print(f"Created subscription: {subscription.id}")
print("You must confirm the subscription from your email/endpoint.")

3. Create the Event Rule for VCN changes

Use the Events client and create a rule that:

Targets your compartment
Has an event pattern that matches VCN changes
Uses the Notifications topic (topic_id) as an action

Event pattern (example)

This pattern matches all VCN events (create, update, delete):

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.vcn.create",
    "com.oraclecloud.virtualnetwork.vcn.update",
    "com.oraclecloud.virtualnetwork.vcn.delete"
  ]
}

You can further constrain by data.compartmentId or other fields if needed.

Python script to create the Event Rule

import json
import oci

config = oci.config.from_file()
compartment_id = "<YOUR_COMPARTMENT_OCID>"
topic_id = "<YOUR_TOPIC_OCID>"  # from previous step
rule_display_name = "VCN-Change-Event-Rule"

events_client = oci.events.EventsClient(config)

# 1. Build the event pattern
event_pattern = {
    "eventType": [
        "com.oraclecloud.virtualnetwork.vcn.create",
        "com.oraclecloud.virtualnetwork.vcn.update",
        "com.oraclecloud.virtualnetwork.vcn.delete"
    ]
    # You could optionally add more filters like:
    # "data": {
    #     "compartmentId": ["<YOUR_COMPARTMENT_OCID>"]
    # }
}

# 2. Define the action to send to Notifications
action = oci.events.models.CreateRuleActionDetails(
    action_type="ONS",
    is_enabled=True,
    description="Send VCN change events to Notifications topic",
    topic_id=topic_id
)

# 3. Build the rule details
create_rule_details = oci.events.models.CreateRuleDetails(
    compartment_id=compartment_id,
    display_name=rule_display_name,
    is_enabled=True,
    condition=event_pattern,
    actions=oci.events.models.Actions(
        actions=[action]
    ),
    description="Rule that triggers on VCN create/update/delete events"
)

# 4. Check if rule already exists
existing_rules = oci.pagination.list_call_get_all_results(
    events_client.list_rules,
    compartment_id=compartment_id
).data

rule = next((r for r in existing_rules if r.display_name == rule_display_name), None)

if rule:
    print(f"Rule '{rule_display_name}' already exists: {rule.id}")
else:
    # 5. Create the rule
    response = events_client.create_rule(create_rule_details)
    rule = response.data
    print(f"Created rule: {rule.display_name} ({rule.id})")
    print("Event Rule for VCN changes is now active.")

4. (Optional) Integrate with Monitoring Alarms

If your security standard specifically wants Monitoring service to raise alarms from events, you can:

Use Event Rule → Notifications → custom HTTPS endpoint.
That endpoint can push metrics (via oci.monitoring.MonitoringClient) and then:
Create a Monitoring Alarm on those custom metrics.

However, for most CSPM requirements, having an Event Rule + Notifications alert is sufficient and is what “OCI Monitoring / Alerting” usually refers to at policy level.

5. Validation

Confirm Notifications subscription.
Create/update/delete a test VCN in the compartment.
Verify that:
- Event shows in OCI Console → Observability & Management → Events.
- Notification is received at your configured endpoint.

If you paste your compartment OCID and preferred channel (email/HTTPS/Slack/PagerDuty), I can adjust the Python snippets exactly to your environment.

Using Terraform

resource "oci_events_rule" "vcn_lifecycle_events" {
  # Monitors VCN lifecycle events and routes them to an Alerting/Notifications target.
  compartment_id = "COMPARTMENT_OCID"         # replace with the OCID of the compartment to monitor
  display_name   = "VCN-Lifecycle-Events-Rule"

  is_enabled = true

  # Track create, update, and delete operations for VCNs.
  # You can narrow this to a specific compartment/VCN using an additional "data" filter if required.
  condition = <<EOT
{
  "eventType": [
    "com.oraclecloud.virtualnetwork.createvcn",
    "com.oraclecloud.virtualnetwork.updatevcn",
    "com.oraclecloud.virtualnetwork.deletevcn"
  ]
}
EOT

  actions {
    # Example: send the events to an existing Notifications topic that you plug into OCI Monitoring/Alerting.
    actions {
      action_type = "ONS"
      is_enabled  = true
      description = "Route VCN lifecycle events to Alerting/Monitoring"

      topic_id = "OCI_ONS_TOPIC_OCID"         # replace with the OCID of an ONS Notifications topic
    }

    # If you use Streaming, Functions, or other targets, add additional `actions {}` blocks here.
  }

  # Optional: freeform_tags or defined_tags if you use tagging standards
  # freeform_tags = {
  #   "Owner" = "NETWORK_TEAM"
  # }
}

This change does not force replacement of other resources; it only creates or updates the oci_events_rule itself.For verification, terraform plan should show this oci_events_rule.vcn_lifecycle_events being created (or updated if you are adding the condition to an existing rule), with is_enabled = true and the condition JSON listing the three com.oraclecloud.virtualnetwork.*vcn event types.

OCI Misconfigurations

OCI Monitoring Should Have Event Rule For VCN Changes

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisites

2. Create a Notifications Topic

Add a Subscription

3. Create an Event Rule for VCN Changes

Rule Details

Define the Event Pattern

Option A: Use the Basic Pattern (Service + Event Types)

Option B: Use an Advanced Pattern (if needed)

4. Add the Action (Send Notification)

5. (Optional) Integrate with Monitoring Alarms

6. Validate the Setup

0. Prerequisites

1. (Optional) Create a Notifications Topic

2. (Optional) Add a Subscription to the Topic

3. Create Event Rule JSON Condition for VCN Changes

4. Create the Events Rule

5. (Optional) Verify the Rule

6. (Optional) Update an Existing Rule

1. Define what events you want to capture

2. Create (or reuse) a Notifications topic

Sample Python script: create topic (if not exists) and subscription

3. Create the Event Rule for VCN changes

Event pattern (example)

Python script to create the Event Rule

4. (Optional) Integrate with Monitoring Alarms

5. Validation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Prerequisites

​2. Create a Notifications Topic

​Add a Subscription

​3. Create an Event Rule for VCN Changes

​Rule Details

​Define the Event Pattern

​Option A: Use the Basic Pattern (Service + Event Types)

​Option B: Use an Advanced Pattern (if needed)

​4. Add the Action (Send Notification)

​5. (Optional) Integrate with Monitoring Alarms

​6. Validate the Setup

​0. Prerequisites

​1. (Optional) Create a Notifications Topic

​2. (Optional) Add a Subscription to the Topic

​3. Create Event Rule JSON Condition for VCN Changes

​4. Create the Events Rule

​5. (Optional) Verify the Rule

​6. (Optional) Update an Existing Rule

​1. Define what events you want to capture

​2. Create (or reuse) a Notifications topic

​Sample Python script: create topic (if not exists) and subscription

​3. Create the Event Rule for VCN changes

​Event pattern (example)

​Python script to create the Event Rule

​4. (Optional) Integrate with Monitoring Alarms

​5. Validation

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisites

2. Create a Notifications Topic

Add a Subscription

3. Create an Event Rule for VCN Changes

Rule Details

Define the Event Pattern

Option A: Use the Basic Pattern (Service + Event Types)

Option B: Use an Advanced Pattern (if needed)

4. Add the Action (Send Notification)

5. (Optional) Integrate with Monitoring Alarms

6. Validate the Setup

0. Prerequisites

1. (Optional) Create a Notifications Topic

2. (Optional) Add a Subscription to the Topic

3. Create Event Rule JSON Condition for VCN Changes

4. Create the Events Rule

5. (Optional) Verify the Rule

6. (Optional) Update an Existing Rule

1. Define what events you want to capture

2. Create (or reuse) a Notifications topic

Sample Python script: create topic (if not exists) and subscription

3. Create the Event Rule for VCN changes

Event pattern (example)

Python script to create the Event Rule

4. (Optional) Integrate with Monitoring Alarms

5. Validation