OCI Monitoring Should Have Network Change Alarm Configured

Using Console

Below are concise, console-based steps to configure alerts for network changes in OCI (VCNs, subnets, security lists, route tables, etc.).Note: In OCI, configuration changes like network changes are best captured with the Events Service + Notifications, not classic Monitoring metrics. This is still part of “alerting/monitoring” in OCI.

1. Create a Notifications Topic

In the OCI Console, open the navigation menu:
Observability & Management → Notifications → Topics.
Click Create Topic.
Enter:
- Name: e.g., network-change-alerts
- Description: e.g., Alerts for OCI network configuration changes
- Compartment: select appropriate compartment.
Click Create.

Open the topic you just created (network-change-alerts).
Under Subscriptions, click Create Subscription.
Select Protocol (e.g., Email).
Enter the Email address (or HTTPS/Slack, etc., as required).
Click Create.
Confirm the subscription using the link sent to the email (or configure the chosen protocol endpoint).

3. Create an Events Rule for Network Changes

In the navigation menu:
Observability & Management → Events Service → Rules.
Click Create Rule.
Enter:
- Name: e.g., network-configuration-changes
- Description: e.g., Trigger on create/update/delete of networking resources
- Status: leave as Enabled.
- Compartment: the tenancy/compartment where you want to detect changes.
  - If you want tenant-wide coverage, choose the root compartment.

Under Rule Conditions:

Choose Event Type:
Select “Service = Virtual Cloud Network (VCN)” (or “Core Services” depending on UI version) and pick events like:
- CreateVcn, UpdateVcn, DeleteVcn
- CreateSubnet, UpdateSubnet, DeleteSubnet
- CreateRouteTable, UpdateRouteTable, DeleteRouteTable
- CreateSecurityList, UpdateSecurityList, DeleteSecurityList
- CreateNetworkSecurityGroup, UpdateNetworkSecurityGroup, DeleteNetworkSecurityGroup
- CreateInternetGateway, UpdateInternetGateway, DeleteInternetGateway
- CreateLocalPeeringGateway, UpdateLocalPeeringGateway, DeleteLocalPeeringGateway
- CreateDrg, UpdateDrg, DeleteDrg (and attachments, as available)

In some consoles, you instead define a Rule Condition (JSON). Example pattern:

{
  "eventType": [
    "com.oraclecloud.vcn.createvcn",
    "com.oraclecloud.vcn.updatevcn",
    "com.oraclecloud.vcn.deletevcn",
    "com.oraclecloud.vcn.createsubnet",
    "com.oraclecloud.vcn.updatesubnet",
    "com.oraclecloud.vcn.deletesubnet",
    "com.oraclecloud.vcn.createroutetable",
    "com.oraclecloud.vcn.updateroutetable",
    "com.oraclecloud.vcn.deleteroutetable",
    "com.oraclecloud.vcn.createsecuritylist",
    "com.oraclecloud.vcn.updatesecuritylist",
    "com.oraclecloud.vcn.deletesecuritylist",
    "com.oraclecloud.vcn.createnetworksecuritygroup",
    "com.oraclecloud.vcn.updatenetworksecuritygroup",
    "com.oraclecloud.vcn.deletenetworksecuritygroup",
    "com.oraclecloud.vcn.createinternetgateway",
    "com.oraclecloud.vcn.updateinternetgateway",
    "com.oraclecloud.vcn.deleteinternetgateway"
  ]
}

Adjust resource/event types to align with your requirements and what’s available in your region/tenant.

Under Actions:
- Click Add Action.
- Action Type: Notifications.
- Topic: select the topic network-change-alerts.
Click Create Rule.

4. (Optional) Scope and Filter More Precisely

If required, refine with conditions on compartments, VCN OCIDs, or tags in the rule’s JSON pattern, to limit alerts to production or specific networks.

5. Test the Alert

Make a safe change, e.g., modify a test security list or test route table.
Confirm:
- The event is recorded (check Events → Recent Events).
- An email (or other protocol) notification is received.

If you want instructions specifically for one network resource type (e.g., only security list changes), list that, and I’ll give an exact event pattern for it.

Using CLI

Below is a concise, CLI‑only way to configure an OCI “network change” alert using Events + Notifications (this is how you detect config changes in networking; Monitoring alarms are metric-based and don’t see config changes directly).Replace all placeholder values (<...>) with your own.

1. Set variables (shell)

export COMPARTMENT_OCID="<compartment-ocid>"
export TOPIC_NAME="network-change-alerts"
export EMAIL_ADDRESS="<you@example.com>"
export RULE_NAME="network-change-rule"

2. Create a Notifications Topic

oci ons topic create \
  --compartment-id "$COMPARTMENT_OCID" \
  --name "$TOPIC_NAME" \
  --description "Alerts for OCI network configuration changes" \
  --query 'data.id' \
  --raw-output

Save the returned Topic OCID:

export TOPIC_OCID="<topic-ocid-returned-above>"

3. Create a Subscription (e.g., Email)

oci ons subscription create \
  --topic-id "$TOPIC_OCID" \
  --protocol EMAIL \
  --endpoint "$EMAIL_ADDRESS"

Check your email and confirm the subscription.

4. Create an Events Rule for Network Changes

Example: watch for creation, update, deletion of VCNs, Subnets, Security Lists, NSGs, and Route Tables.Create a JSON file for the condition (e.g. network-condition.json):

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.vcn.create",
    "com.oraclecloud.virtualnetwork.vcn.update",
    "com.oraclecloud.virtualnetwork.vcn.delete",
    "com.oraclecloud.virtualnetwork.subnet.create",
    "com.oraclecloud.virtualnetwork.subnet.update",
    "com.oraclecloud.virtualnetwork.subnet.delete",
    "com.oraclecloud.virtualnetwork.securitylist.create",
    "com.oraclecloud.virtualnetwork.securitylist.update",
    "com.oraclecloud.virtualnetwork.securitylist.delete",
   "com.oraclecloud.virtualnetwork.networksecuritygroup.create",
    "com.oraclecloud.virtualnetwork.networksecuritygroup.update",
    "com.oraclecloud.virtualnetwork.networksecuritygroup.delete",
    "com.oraclecloud.virtualnetwork.routetable.create",
    "com.oraclecloud.virtualnetwork.routetable.update",
    "com.oraclecloud.virtualnetwork.routetable.delete"
  ],
  "data": {
    "additionalDetails": {
      "compartmentId": "<compartment-ocid>"
    }
  }
}

Create a JSON file for actions (e.g. network-actions.json):

{
  "actions": [
    {
      "actionType": "ONS",
      "isEnabled": true,
      "description": "Send notification on network configuration change",
      "topicId": "<topic-ocid>"
    }
  ]
}

Now create the Events rule:

oci events rule create \
  --display-name "$RULE_NAME" \
  --compartment-id "$COMPARTMENT_OCID" \
  --is-enabled true \
  --condition "$(cat network-condition.json)" \
  --actions "$(cat network-actions.json)"

5. Validate

Make a small network change (e.g., update a security list description) and confirm you receive an email.This setup satisfies the “network change alarm” requirement for OCI by using Events + Notifications to alert on network configuration changes, callable and fully manageable via OCI CLI.

Using Python

Below is how you can remediate this by programmatically creating a network-change alarm in OCI Monitoring using Python, wired to OCI Notifications.The example assumes:

You want an alarm on unusual network activity (e.g., high egress traffic) as a proxy for potential network changes/abuse.
You’re using the OCI Python SDK and a config file (~/.oci/config).

1. Prerequisites

Install/upgrade the OCI Python SDK:
pip install --upgrade oci

Ensure your ~/.oci/config has:

[DEFAULT]
user=ocid1.user.oc1..xxxx
fingerprint=xx:xx:xx:xx
key_file=/path/to/oci_api_key.pem
tenancy=ocid1.tenancy.oc1..xxxx
region=us-phoenix-1

Get required OCIDs:
- compartment_ocid where your network resources (VCNs, VNics) live.

2. Create a Notifications Topic (destination for the alarm)

import oci

config = oci.config.from_file()  # default profile
compartment_id = "ocid1.compartment.oc1..xxxxx"   # replace with your compartment OCID
topic_name = "network-change-alerts-topic"

ons_client = oci.ons.NotificationControlPlaneClient(config)

create_topic_details = oci.ons.models.CreateTopicDetails(
    name=topic_name,
    compartment_id=compartment_id,
    description="Topic for network change / anomaly alerts"
)

topic = ons_client.create_topic(create_topic_details).data
topic_ocid = topic.topic_id
print("Created topic:", topic_ocid)

Optionally, add a subscription (email, Slack via HTTPS, etc.):

subscription_details = oci.ons.models.CreateSubscriptionDetails(
    topic_id=topic_ocid,
    protocol="EMAIL",               # or HTTPS, PAGERDUTY, etc.
    endpoint="you@example.com"
)

subscription = ons_client.create_subscription(subscription_details).data
print("Created subscription:", subscription.id)

3. Create the Network Alarm in Monitoring

Example: alarm on sudden high egress bytes on VNics (you can tune the query and threshold for your environment).

Example Metric Query

For VNics (namespace oci_vcn, metric VnicEgressBytes):

Query (MQL):

sum(metric[1m].VnicEgressBytes) > 100000000

metric[1m] → 1-minute aggregation windows
sum(...) → sum across resources
> 100000000 → threshold (e.g., >100MB/min) – adjust as needed

Python: Create the Alarm

from datetime import datetime
from oci.monitoring import MonitoringClient
from oci.monitoring.models import CreateAlarmDetails

monitoring_client = MonitoringClient(config)

alarm_display_name = "Network Egress Spike Alarm"
alarm_query = "sum(metric[1m].VnicEgressBytes) > 100000000"  # adjust threshold

create_alarm_details = CreateAlarmDetails(
    compartment_id=compartment_id,
    display_name=alarm_display_name,
    metric_compartment_id=compartment_id,      # compartment where VNics live
    namespace="oci_vcn",
    query=alarm_query,
    severity="CRITICAL",                       # INFO | WARNING | ERROR | CRITICAL
    destinations=[topic_ocid],                 # Notifications topic
    is_enabled=True,
    repeat_notification_duration="PT15M",      # re-notify every 15 min while in alarm
    pending_duration="PT5M",                   # must breach for 5 min before firing
    resolution="1m",                           # metric resolution
    body="High network egress detected – possible network change or data exfiltration.",
    message_format="TEXT",                     # or "JSON"
)

alarm = monitoring_client.create_alarm(create_alarm_details).data
print("Created alarm:", alarm.id)

4. Hardening / “Network Change” Angle

To more closely align with “network change”:

Add multiple alarms, for example:
- Egress & ingress volume spikes: VnicEgressBytes, VnicIngressBytes
- Connection count spikes (if you collect such custom metrics).
Narrow the metrics using resourceGroup or dimension filters in the query if you want to monitor only specific VCNs / VNics.

Example with a dimension filter for a specific VCN OCID:

sum(metric[1m].VnicEgressBytes{vcnId="ocid1.vcn.oc1..xxxxx"}) > 50000000

Use that exact query string in alarm_query.

5. Verify

In OCI Console → Observability & Management → Alarms:
- Confirm the alarm appears and is Enabled.
Generate test network traffic to cross the threshold, or temporarily lower the threshold.
Confirm:
- Alarm state changes to FIRING.
- Notification (email, etc.) is received.

This fulfills the requirement “OCI Monitoring Should Have Network Change Alarm Configured” by implementing a programmatically managed Monitoring alarm and notifications pipeline using Python.

Using Terraform

resource "oci_monitoring_alarm" "mfa_requirement_violation_alarm" {
  # Replace with your OCIDs and notification destination
  compartment_id = "OCID_OF_TARGET_COMPARTMENT"
  display_name   = "MFA Requirement Violation Alarm"

  # This is the key part: monitor the MfaRequirementViolation metric
  # Adjust namespace / dimension filters if your tenancy uses a different convention
  query = "MfaRequirementViolation[1m].sum() > 0"

  # Alarm behavior
  is_enabled          = true
  severity            = "CRITICAL"
  body                = "MFA requirement was violated. Investigate immediately."
  message_format      = "TEXT"
  metric_compartment_id = "OCID_OF_TARGET_COMPARTMENT"

  # At least one notification destination (e.g., OCI Notifications topic)
  destinations = [
    "OCID_OF_OCI_NOTIFICATIONS_TOPIC",
  ]

  # Optional: how often the alarm is evaluated
  resolution = "1m"

  # Optional: notify on state transitions
  pending_duration = "PT1M"
  repeat_notification_duration = "PT0S"

  # Optional: suppress reminders when in OK state
  # is_notifications_per_rule_enabled = false

  # Optional tags
  freeform_tags = {
    OWNER = "TEAM_NAME"
    ENV   = "ENVIRONMENT_NAME"
  }
}

This configuration does not force replacement of any existing alarm; it creates (or manages) an alarm specifically for the MfaRequirementViolation metric with a threshold of > 0 over a 1‑minute window.To verify, terraform plan should show this alarm resource with + create (or, if you are importing an existing alarm to manage it, only the drifted fields being updated and no -/+ replacement).

OCI Misconfigurations

OCI Monitoring Should Have Network Change Alarm Configured

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Create a Notifications Topic

3. Create an Events Rule for Network Changes

4. (Optional) Scope and Filter More Precisely

5. Test the Alert

1. Set variables (shell)

2. Create a Notifications Topic

3. Create a Subscription (e.g., Email)

4. Create an Events Rule for Network Changes

5. Validate

1. Prerequisites

2. Create a Notifications Topic (destination for the alarm)

3. Create the Network Alarm in Monitoring

Example Metric Query

Python: Create the Alarm

4. Hardening / “Network Change” Angle

5. Verify

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Create a Notifications Topic

​2. Subscribe Your Alert Recipients

​3. Create an Events Rule for Network Changes

​4. (Optional) Scope and Filter More Precisely

​5. Test the Alert

​1. Set variables (shell)

​2. Create a Notifications Topic

​3. Create a Subscription (e.g., Email)

​4. Create an Events Rule for Network Changes

​5. Validate

​1. Prerequisites

​2. Create a Notifications Topic (destination for the alarm)

​3. Create the Network Alarm in Monitoring

​Example Metric Query

​Python: Create the Alarm

​4. Hardening / “Network Change” Angle

​5. Verify

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Create a Notifications Topic

2. Subscribe Your Alert Recipients

3. Create an Events Rule for Network Changes

4. (Optional) Scope and Filter More Precisely

5. Test the Alert

1. Set variables (shell)

2. Create a Notifications Topic

3. Create a Subscription (e.g., Email)

4. Create an Events Rule for Network Changes

5. Validate

1. Prerequisites

2. Create a Notifications Topic (destination for the alarm)

3. Create the Network Alarm in Monitoring

Example Metric Query

Python: Create the Alarm

4. Hardening / “Network Change” Angle

5. Verify