> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI Monitoring Should Have Local Authentication Alarm Configured

### More Info:

Alert on LocalAuthentication usage. Organizations using federated SSO should heavily scrutinize local logins, as they bypass enterprise identity controls and conditional access policies.

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* HIPAA
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are step‑by‑step instructions to configure a **Monitoring alarm in OCI Console** that alerts when **local authentication** is used (e.g., local IAM users logging into the Console).

        Because metric and dimension names can vary slightly by tenancy/region, I’ll show you how to *find* the right metric interactively and then wire it into an alarm.

        ***

        ### 1. Open Monitoring → Alarms

        1. Sign in to the **OCI Console**.
        2. In the left menu, go to:\
           **Observability & Management → Monitoring → Alarms**.
        3. Make sure you’re in the **correct region** and **compartment** (top-left selectors).

        ***

        ### 2. Start Creating the Alarm

        1. Click **Create alarm**.
        2. Enter:
           * **Alarm name**: e.g. `local-authentication-alarm`
           * **Alarm severity**: typically `Critical` or `Warning`.
           * **Alarm compartment**: your security/monitoring compartment.

        ***

        ### 3. Select the Metric for Local Authentication

        1. Under **Alarm body**, click **Select metric**.
        2. In the **Metric namespace** dropdown, choose the IAM/Authentication namespace (commonly something like):
           * `oci_iam_authentication`\
             or search for `iam`, `identity`, or `auth` in the namespace box.
        3. In the **Metric name** dropdown, look for a metric that records authentication attempts, e.g.:
           * `AuthenticationRequests`, `AuthenticationSuccess`, `AuthenticationFailures`\
             (the exact name may differ; you can see a preview graph when selected).
        4. Once a likely metric is selected, use the **Dimensions** panel to filter for **local authentication**. Look for dimensions such as:
           * `identityProviderType` or `authenticationMethod` = `LOCAL` or `LOCAL_USER`
           * or similar wording indicating “local” vs “federated/SAML”.
        5. Apply the filter. Confirm the metric graph now shows data only for local-auth events.

        If you don’t see any local events, try:

        * Removing all filters and then
        * Adding filters one-by-one while watching how the graph changes to locate the “local” dimension value.

        ***

        ### 4. Define the Alarm Query / Condition

        1. After metric selection and filters, OCI will build a **Monitoring Query Language** (MQL) expression for you.

        2. Typical pattern (example – yours will be auto-generated):

           ```text theme={null}
           oci_iam_authentication[5m]{identityProviderType="LOCAL"}.count() > 0
           ```

           or something similar generated by the console.

        3. Set:
           * **Interval** (e.g. `5 minutes`)
           * **Trigger rule**:
             * Condition: `>`
             * Threshold: `0`
             * Breaching duration: e.g. `1` interval.

        This means: “If any local authentication occurs in the last 5 minutes, fire the alarm.”

        ***

        ### 5. Configure Notifications

        1. Under **Notifications**, choose an existing **topic** or click **Create a topic** (this opens the Notifications service):
           * Add email addresses, Slack/HTTPS, PagerDuty, etc., as subscriptions for this topic.
        2. Back in the alarm form, select that **topic** as the **Destination**.
        3. Optionally, customize:
           * **Alarm message** (include “Local authentication detected”)
           * **Repeat notification** frequency.

        ***

        ### 6. Set Alarm State Management

        Configure:

        * **Auto-resolve**: enabled (so alarm returns to OK when condition clears).
        * **Suppression** (optional): e.g., suppress after firing to avoid notification storms.

        ***

        ### 7. Review and Create

        1. Review all details:
           * Correct **compartment + region**
           * Metric namespace/name
           * Filter for **local** authentication
           * Condition `> 0` over a short period
           * Notification topic configured
        2. Click **Create alarm**.

        ***

        ### 8. Test the Alarm

        1. Trigger a **local authentication** (sign in with a local IAM user) or wait for one to occur.
        2. Check:
           * **Monitoring → Alarms**: alarm state should change to **FIRING** when a local auth occurs.
           * Your **email/notification channel** receives the alert.

        If it doesn’t fire, adjust:

        * Metric dimensions (ensure you’re truly filtering for the LOCAL value),
        * Interval and threshold (maybe volume is low; try longer window like 15m).

        ***

        This completes remediation: you now have an OCI Monitoring alarm that detects and alerts on **local authentication** events via the OCI Console.
      </Accordion>

      <Accordion title="Using CLI">
        Below is a concise, CLI‑only way to remediate **“OCI Monitoring Should Have Local Authentication Alarm Configured”** by creating an alarm that fires when there are local console sign‑ins.

        > Assumptions (adjust as needed):
        >
        > * You want to alert on **any local console sign‑in** in a given compartment.
        > * Metric namespace: `oci_identity`
        > * Metric name: `ConsoleSignins`
        > * Dimension for auth method: `authType` (value `LOCAL` for local auth)

        ***

        ### 1. Set common variables

        ```bash theme={null}
        # IDs to reuse
        COMPARTMENT_OCID="<your_compartment_ocid>"
        REGION="<your_region>"           # e.g. us-phoenix-1
        ALARM_DISPLAY_NAME="Local Authentication Console Sign-ins Alarm"
        ALARM_DESC="Alarm when any local authentication console sign-in occurs."
        TOPIC_NAME="local-auth-alerts-topic"
        ```

        ***

        ### 2. Create an ONS topic for alerts

        ```bash theme={null}
        oci ons topic create \
          --name "$TOPIC_NAME" \
          --compartment-id "$COMPARTMENT_OCID" \
          --region "$REGION"
        ```

        Note the `ocid` of the topic from the output (call it `TOPIC_OCID`).

        ***

        ### 3. (Optional) Add a subscription (email, pager, etc.)

        ```bash theme={null}
        SUBS_PROTOCOL="EMAIL"
        SUBS_ENDPOINT="security-team@example.com"

        oci ons subscription create \
          --topic-id "$TOPIC_OCID" \
          --protocol "$SUBS_PROTOCOL" \
          --endpoint "$SUBS_ENDPOINT" \
          --region "$REGION"
        ```

        Confirm the subscription via email (if using email).

        ***

        ### 4. Confirm metric and dimensions (one‑time validation)

        Run once to see actual metric/dimension names in your tenancy:

        ```bash theme={null}
        oci monitoring metric-data summarize-metrics-data \
          --compartment-id "$COMPARTMENT_OCID" \
          --namespace "oci_identity" \
          --query-text "ConsoleSignins[5m].sum()" \
          --region "$REGION"
        ```

        Look in the response for:

        * `name`: `ConsoleSignins`
        * Dimensions, including something like `authType` (value `LOCAL` for local auth).\
          If the dimension name/value differs, update the query in step 5 accordingly.

        ***

        ### 5. Create the alarm for local authentication

        Example: trigger when **any** local sign‑in occurs in a 5‑minute window.

        ```bash theme={null}
        TOPIC_OCID="<topic_ocid_from_step_2>"

        oci monitoring alarm create \
          --compartment-id "$COMPARTMENT_OCID" \
          --display-name "$ALARM_DISPLAY_NAME" \
          --description "$ALARM_DESC" \
          --metric-compartment-id "$COMPARTMENT_OCID" \
          --namespace "oci_identity" \
          --severity "CRITICAL" \
          --is-enabled true \
          --query-text 'ConsoleSignins[5m]{authType="LOCAL"}.sum() > 0' \
          --destinations "[\"$TOPIC_OCID\"]" \
          --pending-duration "PT1M" \
          --region "$REGION"
        ```

        Key parts:

        * `ConsoleSignins[5m]{authType="LOCAL"}.sum() > 0`
          * Filters to local auth sign‑ins.
          * Sums them over 5 minutes.
          * Fires if more than 0 events occur.

        Adjust:

        * `pending-duration` for how long the condition must hold (e.g. `PT5M`).
        * Add more filters (e.g., `status="SUCCESS"` or region).

        ***

        ### 6. Verify the alarm

        List alarms:

        ```bash theme={null}
        oci monitoring alarm list \
          --compartment-id "$COMPARTMENT_OCID" \
          --region "$REGION"
        ```

        Check alarm status and configuration:

        ```bash theme={null}
        ALARM_OCID="<alarm_ocid_from_list>"

        oci monitoring alarm get \
          --alarm-id "$ALARM_OCID" \
          --region "$REGION"
        ```

        Once this alarm exists and is enabled, the “OCI Monitoring Should Have Local Authentication Alarm Configured” requirement is typically satisfied, as you now have a monitoring alarm explicitly detecting local authentication events.
      </Accordion>

      <Accordion title="Using Python">
        Below is one practical way to meet the requirement “OCI Monitoring Should Have Local Authentication Alarm Configured” using Python:

        **Idea:**

        1. Turn local authentication events into a **custom metric** (via Logging → Service Connector → Monitoring).
        2. Create an **alarm** in OCI Monitoring that fires whenever the metric shows any local logins.
        3. Do step 2 with Python.

        ***

        ## 1. Prerequisites

        * OCI Python SDK installed:
          ```bash theme={null}
          pip install oci
          ```
        * A working `~/.oci/config` file (or equivalent config in code).
        * Permissions for:
          * Logging
          * Service Connector Hub
          * Monitoring
          * Notifications (if you want email/Slack/etc.)

        ***

        ## 2. Enable/Confirm Logging for Local Authentication

        1. In OCI Console:
           * Go to **Identity & Security → Identity Domains** (or IAM, depending on your tenancy type).
           * Open your **Identity Domain**.
           * Go to **Security → Logs** (or **Audit Logs / Security Events Logs**).
           * Ensure **SecurityEvents / Authentication** (or similar) logs are **enabled**.
           * These logs contain events for **local authentication** (local user passwords, etc.).

        You need these logs as the source for your metric.

        ***

        ## 3. Create a Service Connector: Logs → Monitoring (Custom Metric)

        You can do this via console (simpler) or via Terraform/SDK. Minimal console steps:

        1. Go to **Developer Services → Service Connector Hub → Service Connectors → Create Service Connector**.
        2. **Source**:
           * Type: **Logging**
           * Select the Log Group where your **Security / Authentication / Local auth** logs are emitted.
        3. **Target**:
           * Type: **Monitoring**
           * Choose a **Namespace**, e.g. `security_custom`.
           * Choose a **Metric name**, e.g. `local_authentication_count`.
        4. **Transformation / Filter**:
           * Add a log filter that only matches **local authentication events**.\
             Example (pseudocode style filter – adapt to actual log field names):
             ```json theme={null}
             data.eventType = "LOCAL_AUTHENTICATION"
             ```
           * In the metric mapping, set:
             * `value`: `1`
             * `dimensions`: include things like `userName`, `authMethod`, etc. if available.
        5. Save and **activate** the Service Connector.

        Result: Every local authentication log produces +1 on metric:

        * Namespace: `security_custom`
        * Metric: `local_authentication_count`

        ***

        ## 4. Decide on Alarm Condition

        Common requirement: alarm on **any** local auth in last X minutes. Example:

        ```text theme={null}
        query:
          security_custom.local_authentication_count[5m].sum() > 0
        ```

        This means: if at least 1 local auth in the last 5 minutes, trigger the alarm.

        ***

        ## 5. Python Script to Create the OCI Monitoring Alarm

        Below is example code using the OCI Python SDK.

        **What it does:**

        * Uses a profile from `~/.oci/config` (e.g. `DEFAULT`).
        * Creates an alarm on the metric from step 3.
        * Sends alarm notifications to an OCI Notifications topic.

        ```python theme={null}
        import oci
        from oci.monitoring import MonitoringClient
        from oci.monitoring.models import (
            CreateAlarmDetails,
            AlarmBody,
            AlarmDimension,
            AlarmSuppression
        )

        # --- CONFIG SECTION (edit these values) ---

        CONFIG_PROFILE = "DEFAULT"  # or whatever profile in ~/.oci/config
        COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxxx"
        # Notification topic for alarm (OCI Notifications)
        TOPIC_OCID = "ocid1.onstopic.oc1..xxxxx"

        # Monitoring metric info (must match your Service Connector config)
        NAMESPACE = "security_custom"
        METRIC_NAME = "local_authentication_count"

        # --- END CONFIG SECTION ---

        config = oci.config.from_file("~/.oci/config", CONFIG_PROFILE)
        monitoring_client = MonitoringClient(config)

        alarm_expression = (
            f"{NAMESPACE}.{METRIC_NAME}[5m].sum() > 0"
        )

        create_alarm_details = CreateAlarmDetails(
            display_name="Local Authentication Detected",
            compartment_id=COMPARTMENT_OCID,
            namespace=NAMESPACE,
            query=alarm_expression,
            severity="CRITICAL",  # or "ERROR", "WARNING", etc.
            destinations=[TOPIC_OCID],
            # The body displayed in Notifications
            body="Alarm triggered: Local authentication activity detected.",
            is_enabled=True,
            # Evaluate every minute; adjust as needed
            resolution="1m",
            # If you want to avoid repeated notifications, you can control repeat notifications:
            repeat_notification_duration="PT30M",  # ISO 8601, e.g. every 30 min
            # Docs: https://docs.oracle.com/en-us/iaas/tools/python/latest/api/monitoring/models/oci.monitoring.models.CreateAlarmDetails.html
        )

        response = monitoring_client.create_alarm(create_alarm_details)
        print("Created alarm OCID:", response.data.id)
        ```

        ### Notes

        * `query` format is:\
          `namespace.metric_name[window].statistic() <operator> value`
        * Window: `[5m]` = last 5 minutes.
        * Statistic: `.sum()` here. You can also use `.count()` or `.max()` depending on how you emit the metric.

        ***

        ## 6. Test

        1. Perform a **test local authentication** (e.g., sign in as a local user).
        2. Confirm:
           * Log entry appears in the Security/Authentication logs.
           * Service Connector sends data to Monitoring (you can view the metric under **Monitoring → Metrics Explorer** using `security_custom` namespace).
           * The alarm triggers and sends a notification to the configured topic.

        ***

        If you share the exact log shape (sample JSON for a local auth event), I can give you a more precise filter expression and metric mapping for the Service Connector.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # This finding cannot be remediated directly on `oci_monitoring_alarm` alone,
        # because Monitoring alarms in OCI can trigger only on METRICS, while
        # "LocalAuthentication" is an audit/log event and is not exposed as a native metric.

        # To alert on LocalAuthentication usage you must:
        # 1. In OCI Logging / Audit, route LocalAuthentication events (from Audit or Identity)
        #    through a Service Connector into a custom Monitoring metric.
        # 2. THEN create an `oci_monitoring_alarm` on that custom metric, something like:

        resource "oci_monitoring_alarm" "local_authentication_alarm" {
          compartment_id  = var.COMPartment_OCID   # replace with your compartment OCID
          display_name    = "LocalAuthentication Usage Alarm"
          is_enabled      = true
          namespace       = "custom_namespace"     # replace with the namespace used by your custom metric
          query           = "custom_namespace.custom_local_auth_metric[1m].sum() > 0"
          severity        = "CRITICAL"
          destinations    = [oci_ons_notification_topic.local_auth_topic.id]

          # optional tuning
          pending_duration = "PT5M"                # example: fire if condition holds for 5 minutes
          repeat_notification_duration = "PT1H"    # example: repeat at most once per hour
        }

        resource "oci_ons_notification_topic" "local_auth_topic" {
          compartment_id = var.COMPartment_OCID   # same compartment as above
          name           = "local-auth-alerts"
          description    = "Alerts for LocalAuthentication usage"
        }

        # You must first ensure that:
        # - A Service Connector (or equivalent pipeline) is pushing a metric named
        #   `custom_local_auth_metric` in namespace `custom_namespace` whenever a
        #   LocalAuthentication event occurs.
        # That Service Connector and log routing are configured in Logging/Service Connector Hub,
        # not via `oci_monitoring_alarm`, and may need to be created via separate Terraform.

        # Verification: after wiring the custom metric pipeline and this alarm, `terraform plan`
        # should show creation of `oci_ons_notification_topic.local_auth_topic` and
        # `oci_monitoring_alarm.local_authentication_alarm` with the desired query and no diffs
        # on unrelated resources.
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>