OCI Monitoring Should Have Local Authentication Alarm Configured

Using Console

Below are step‑by‑step instructions to configure a Monitoring alarm in OCI Console that alerts when local authentication is used (e.g., local IAM users logging into the Console).Because metric and dimension names can vary slightly by tenancy/region, I’ll show you how to find the right metric interactively and then wire it into an alarm.

1. Open Monitoring → Alarms

Sign in to the OCI Console.
In the left menu, go to:
Observability & Management → Monitoring → Alarms.
Make sure you’re in the correct region and compartment (top-left selectors).

2. Start Creating the Alarm

Click Create alarm.
Enter:
- Alarm name: e.g. local-authentication-alarm
- Alarm severity: typically Critical or Warning.
- Alarm compartment: your security/monitoring compartment.

3. Select the Metric for Local Authentication

Under Alarm body, click Select metric.
In the Metric namespace dropdown, choose the IAM/Authentication namespace (commonly something like):
- oci_iam_authentication
  or search for iam, identity, or auth in the namespace box.
In the Metric name dropdown, look for a metric that records authentication attempts, e.g.:
- AuthenticationRequests, AuthenticationSuccess, AuthenticationFailures
  (the exact name may differ; you can see a preview graph when selected).
Once a likely metric is selected, use the Dimensions panel to filter for local authentication. Look for dimensions such as:
- identityProviderType or authenticationMethod = LOCAL or LOCAL_USER
- or similar wording indicating “local” vs “federated/SAML”.
Apply the filter. Confirm the metric graph now shows data only for local-auth events.

If you don’t see any local events, try:

Removing all filters and then
Adding filters one-by-one while watching how the graph changes to locate the “local” dimension value.

4. Define the Alarm Query / Condition

After metric selection and filters, OCI will build a Monitoring Query Language (MQL) expression for you.
Typical pattern (example – yours will be auto-generated):
oci_iam_authentication[5m]{identityProviderType="LOCAL"}.count() > 0
or something similar generated by the console.
Set:
- Interval (e.g. 5 minutes)
- Trigger rule:
  - Condition: >
  - Threshold: 0
  - Breaching duration: e.g. 1 interval.

This means: “If any local authentication occurs in the last 5 minutes, fire the alarm.”

5. Configure Notifications

Under Notifications, choose an existing topic or click Create a topic (this opens the Notifications service):
- Add email addresses, Slack/HTTPS, PagerDuty, etc., as subscriptions for this topic.
Back in the alarm form, select that topic as the Destination.
Optionally, customize:
- Alarm message (include “Local authentication detected”)
- Repeat notification frequency.

6. Set Alarm State Management

Configure:

Auto-resolve: enabled (so alarm returns to OK when condition clears).
Suppression (optional): e.g., suppress after firing to avoid notification storms.

7. Review and Create

Review all details:
- Correct compartment + region
- Metric namespace/name
- Filter for local authentication
- Condition > 0 over a short period
- Notification topic configured
Click Create alarm.

8. Test the Alarm

Trigger a local authentication (sign in with a local IAM user) or wait for one to occur.
Check:
- Monitoring → Alarms: alarm state should change to FIRING when a local auth occurs.
- Your email/notification channel receives the alert.

If it doesn’t fire, adjust:

Metric dimensions (ensure you’re truly filtering for the LOCAL value),
Interval and threshold (maybe volume is low; try longer window like 15m).

This completes remediation: you now have an OCI Monitoring alarm that detects and alerts on local authentication events via the OCI Console.

Using CLI

Below is a concise, CLI‑only way to remediate “OCI Monitoring Should Have Local Authentication Alarm Configured” by creating an alarm that fires when there are local console sign‑ins.

Assumptions (adjust as needed):

You want to alert on any local console sign‑in in a given compartment.

Metric namespace: oci_identity

Metric name: ConsoleSignins

Dimension for auth method: authType (value LOCAL for local auth)

1. Set common variables

# IDs to reuse
COMPARTMENT_OCID="<your_compartment_ocid>"
REGION="<your_region>"           # e.g. us-phoenix-1
ALARM_DISPLAY_NAME="Local Authentication Console Sign-ins Alarm"
ALARM_DESC="Alarm when any local authentication console sign-in occurs."
TOPIC_NAME="local-auth-alerts-topic"

2. Create an ONS topic for alerts

oci ons topic create \
  --name "$TOPIC_NAME" \
  --compartment-id "$COMPARTMENT_OCID" \
  --region "$REGION"

Note the ocid of the topic from the output (call it TOPIC_OCID).

SUBS_PROTOCOL="EMAIL"
SUBS_ENDPOINT="security-team@example.com"

oci ons subscription create \
  --topic-id "$TOPIC_OCID" \
  --protocol "$SUBS_PROTOCOL" \
  --endpoint "$SUBS_ENDPOINT" \
  --region "$REGION"

Confirm the subscription via email (if using email).

4. Confirm metric and dimensions (one‑time validation)

Run once to see actual metric/dimension names in your tenancy:

oci monitoring metric-data summarize-metrics-data \
  --compartment-id "$COMPARTMENT_OCID" \
  --namespace "oci_identity" \
  --query-text "ConsoleSignins[5m].sum()" \
  --region "$REGION"

Look in the response for:

name: ConsoleSignins
Dimensions, including something like authType (value LOCAL for local auth).
If the dimension name/value differs, update the query in step 5 accordingly.

5. Create the alarm for local authentication

Example: trigger when any local sign‑in occurs in a 5‑minute window.

TOPIC_OCID="<topic_ocid_from_step_2>"

oci monitoring alarm create \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$ALARM_DISPLAY_NAME" \
  --description "$ALARM_DESC" \
  --metric-compartment-id "$COMPARTMENT_OCID" \
  --namespace "oci_identity" \
  --severity "CRITICAL" \
  --is-enabled true \
  --query-text 'ConsoleSignins[5m]{authType="LOCAL"}.sum() > 0' \
  --destinations "[\"$TOPIC_OCID\"]" \
  --pending-duration "PT1M" \
  --region "$REGION"

Key parts:

ConsoleSignins[5m]{authType="LOCAL"}.sum() > 0
- Filters to local auth sign‑ins.
- Sums them over 5 minutes.
- Fires if more than 0 events occur.

Adjust:

pending-duration for how long the condition must hold (e.g. PT5M).
Add more filters (e.g., status="SUCCESS" or region).

6. Verify the alarm

List alarms:

oci monitoring alarm list \
  --compartment-id "$COMPARTMENT_OCID" \
  --region "$REGION"

Check alarm status and configuration:

ALARM_OCID="<alarm_ocid_from_list>"

oci monitoring alarm get \
  --alarm-id "$ALARM_OCID" \
  --region "$REGION"

Once this alarm exists and is enabled, the “OCI Monitoring Should Have Local Authentication Alarm Configured” requirement is typically satisfied, as you now have a monitoring alarm explicitly detecting local authentication events.

Using Python

Below is one practical way to meet the requirement “OCI Monitoring Should Have Local Authentication Alarm Configured” using Python:Idea:

Turn local authentication events into a custom metric (via Logging → Service Connector → Monitoring).
Create an alarm in OCI Monitoring that fires whenever the metric shows any local logins.
Do step 2 with Python.

1. Prerequisites

OCI Python SDK installed:
pip install oci
A working ~/.oci/config file (or equivalent config in code).
Permissions for:
- Logging
- Service Connector Hub
- Monitoring
- Notifications (if you want email/Slack/etc.)

2. Enable/Confirm Logging for Local Authentication

In OCI Console:
- Go to Identity & Security → Identity Domains (or IAM, depending on your tenancy type).
- Open your Identity Domain.
- Go to Security → Logs (or Audit Logs / Security Events Logs).
- Ensure SecurityEvents / Authentication (or similar) logs are enabled.
- These logs contain events for local authentication (local user passwords, etc.).

You need these logs as the source for your metric.

3. Create a Service Connector: Logs → Monitoring (Custom Metric)

You can do this via console (simpler) or via Terraform/SDK. Minimal console steps:

Go to Developer Services → Service Connector Hub → Service Connectors → Create Service Connector.
Source:
- Type: Logging
- Select the Log Group where your Security / Authentication / Local auth logs are emitted.
Target:
- Type: Monitoring
- Choose a Namespace, e.g. security_custom.
- Choose a Metric name, e.g. local_authentication_count.
Transformation / Filter:
- Add a log filter that only matches local authentication events.
  Example (pseudocode style filter – adapt to actual log field names):
  data.eventType = "LOCAL_AUTHENTICATION"
- In the metric mapping, set:
  - value: 1
  - dimensions: include things like userName, authMethod, etc. if available.
Save and activate the Service Connector.

Result: Every local authentication log produces +1 on metric:

Namespace: security_custom
Metric: local_authentication_count

4. Decide on Alarm Condition

Common requirement: alarm on any local auth in last X minutes. Example:

query:
  security_custom.local_authentication_count[5m].sum() > 0

This means: if at least 1 local auth in the last 5 minutes, trigger the alarm.

5. Python Script to Create the OCI Monitoring Alarm

Below is example code using the OCI Python SDK.What it does:

Uses a profile from ~/.oci/config (e.g. DEFAULT).
Creates an alarm on the metric from step 3.
Sends alarm notifications to an OCI Notifications topic.

import oci
from oci.monitoring import MonitoringClient
from oci.monitoring.models import (
    CreateAlarmDetails,
    AlarmBody,
    AlarmDimension,
    AlarmSuppression
)

# --- CONFIG SECTION (edit these values) ---

CONFIG_PROFILE = "DEFAULT"  # or whatever profile in ~/.oci/config
COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxxx"
# Notification topic for alarm (OCI Notifications)
TOPIC_OCID = "ocid1.onstopic.oc1..xxxxx"

# Monitoring metric info (must match your Service Connector config)
NAMESPACE = "security_custom"
METRIC_NAME = "local_authentication_count"

# --- END CONFIG SECTION ---

config = oci.config.from_file("~/.oci/config", CONFIG_PROFILE)
monitoring_client = MonitoringClient(config)

alarm_expression = (
    f"{NAMESPACE}.{METRIC_NAME}[5m].sum() > 0"
)

create_alarm_details = CreateAlarmDetails(
    display_name="Local Authentication Detected",
    compartment_id=COMPARTMENT_OCID,
    namespace=NAMESPACE,
    query=alarm_expression,
    severity="CRITICAL",  # or "ERROR", "WARNING", etc.
    destinations=[TOPIC_OCID],
    # The body displayed in Notifications
    body="Alarm triggered: Local authentication activity detected.",
    is_enabled=True,
    # Evaluate every minute; adjust as needed
    resolution="1m",
    # If you want to avoid repeated notifications, you can control repeat notifications:
    repeat_notification_duration="PT30M",  # ISO 8601, e.g. every 30 min
    # Docs: https://docs.oracle.com/en-us/iaas/tools/python/latest/api/monitoring/models/oci.monitoring.models.CreateAlarmDetails.html
)

response = monitoring_client.create_alarm(create_alarm_details)
print("Created alarm OCID:", response.data.id)

Notes

query format is:
namespace.metric_name[window].statistic() <operator> value
Window: [5m] = last 5 minutes.
Statistic: .sum() here. You can also use .count() or .max() depending on how you emit the metric.

6. Test

Perform a test local authentication (e.g., sign in as a local user).
Confirm:
- Log entry appears in the Security/Authentication logs.
- Service Connector sends data to Monitoring (you can view the metric under Monitoring → Metrics Explorer using security_custom namespace).
- The alarm triggers and sends a notification to the configured topic.

If you share the exact log shape (sample JSON for a local auth event), I can give you a more precise filter expression and metric mapping for the Service Connector.

Using Terraform

# This finding cannot be remediated directly on `oci_monitoring_alarm` alone,
# because Monitoring alarms in OCI can trigger only on METRICS, while
# "LocalAuthentication" is an audit/log event and is not exposed as a native metric.

# To alert on LocalAuthentication usage you must:
# 1. In OCI Logging / Audit, route LocalAuthentication events (from Audit or Identity)
#    through a Service Connector into a custom Monitoring metric.
# 2. THEN create an `oci_monitoring_alarm` on that custom metric, something like:

resource "oci_monitoring_alarm" "local_authentication_alarm" {
  compartment_id  = var.COMPartment_OCID   # replace with your compartment OCID
  display_name    = "LocalAuthentication Usage Alarm"
  is_enabled      = true
  namespace       = "custom_namespace"     # replace with the namespace used by your custom metric
  query           = "custom_namespace.custom_local_auth_metric[1m].sum() > 0"
  severity        = "CRITICAL"
  destinations    = [oci_ons_notification_topic.local_auth_topic.id]

  # optional tuning
  pending_duration = "PT5M"                # example: fire if condition holds for 5 minutes
  repeat_notification_duration = "PT1H"    # example: repeat at most once per hour
}

resource "oci_ons_notification_topic" "local_auth_topic" {
  compartment_id = var.COMPartment_OCID   # same compartment as above
  name           = "local-auth-alerts"
  description    = "Alerts for LocalAuthentication usage"
}

# You must first ensure that:
# - A Service Connector (or equivalent pipeline) is pushing a metric named
#   `custom_local_auth_metric` in namespace `custom_namespace` whenever a
#   LocalAuthentication event occurs.
# That Service Connector and log routing are configured in Logging/Service Connector Hub,
# not via `oci_monitoring_alarm`, and may need to be created via separate Terraform.

# Verification: after wiring the custom metric pipeline and this alarm, `terraform plan`
# should show creation of `oci_ons_notification_topic.local_auth_topic` and
# `oci_monitoring_alarm.local_authentication_alarm` with the desired query and no diffs
# on unrelated resources.

OCI Misconfigurations

OCI Monitoring Should Have Local Authentication Alarm Configured

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Open Monitoring → Alarms

2. Start Creating the Alarm

3. Select the Metric for Local Authentication

4. Define the Alarm Query / Condition

5. Configure Notifications

6. Set Alarm State Management

7. Review and Create

8. Test the Alarm

1. Set common variables

2. Create an ONS topic for alerts

4. Confirm metric and dimensions (one‑time validation)

5. Create the alarm for local authentication

6. Verify the alarm

1. Prerequisites

2. Enable/Confirm Logging for Local Authentication

3. Create a Service Connector: Logs → Monitoring (Custom Metric)

4. Decide on Alarm Condition

5. Python Script to Create the OCI Monitoring Alarm

Notes

6. Test

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Open Monitoring → Alarms

​2. Start Creating the Alarm

​3. Select the Metric for Local Authentication

​4. Define the Alarm Query / Condition

​5. Configure Notifications

​6. Set Alarm State Management

​7. Review and Create

​8. Test the Alarm

​1. Set common variables

​2. Create an ONS topic for alerts

​3. (Optional) Add a subscription (email, pager, etc.)

​4. Confirm metric and dimensions (one‑time validation)

​5. Create the alarm for local authentication

​6. Verify the alarm

​1. Prerequisites

​2. Enable/Confirm Logging for Local Authentication

​3. Create a Service Connector: Logs → Monitoring (Custom Metric)

​4. Decide on Alarm Condition

​5. Python Script to Create the OCI Monitoring Alarm

​Notes

​6. Test

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Open Monitoring → Alarms

2. Start Creating the Alarm

3. Select the Metric for Local Authentication

4. Define the Alarm Query / Condition

5. Configure Notifications

6. Set Alarm State Management

7. Review and Create

8. Test the Alarm

1. Set common variables

2. Create an ONS topic for alerts

3. (Optional) Add a subscription (email, pager, etc.)

4. Confirm metric and dimensions (one‑time validation)

5. Create the alarm for local authentication

6. Verify the alarm

1. Prerequisites

2. Enable/Confirm Logging for Local Authentication

3. Create a Service Connector: Logs → Monitoring (Custom Metric)

4. Decide on Alarm Condition

5. Python Script to Create the OCI Monitoring Alarm

Notes

6. Test