> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI Monitoring Should Have Network Change Alarm Configured

### More Info:

An alarm must exist for MfaRequirementViolation. This ensures security administrators are immediately notified if a user attempts to bypass Multi-Factor Authentication constraints.

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* HIPAA
* HITRUST CSF
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are concise, console-based steps to configure alerts for **network changes in OCI** (VCNs, subnets, security lists, route tables, etc.).

        **Note:** In OCI, *configuration changes* like network changes are best captured with the **Events Service + Notifications**, not classic Monitoring metrics. This is still part of “alerting/monitoring” in OCI.

        ***

        ## 1. Create a Notifications Topic

        1. In the OCI Console, open the navigation menu:\
           **Observability & Management → Notifications → Topics**.
        2. Click **Create Topic**.
        3. Enter:
           * **Name**: e.g., `network-change-alerts`
           * **Description**: e.g., `Alerts for OCI network configuration changes`
           * **Compartment**: select appropriate compartment.
        4. Click **Create**.

        ***

        ## 2. Subscribe Your Alert Recipients

        1. Open the topic you just created (`network-change-alerts`).
        2. Under **Subscriptions**, click **Create Subscription**.
        3. Select **Protocol** (e.g., `Email`).
        4. Enter the **Email address** (or HTTPS/Slack, etc., as required).
        5. Click **Create**.
        6. Confirm the subscription using the link sent to the email (or configure the chosen protocol endpoint).

        ***

        ## 3. Create an Events Rule for Network Changes

        1. In the navigation menu:\
           **Observability & Management → Events Service → Rules**.

        2. Click **Create Rule**.

        3. Enter:
           * **Name**: e.g., `network-configuration-changes`
           * **Description**: e.g., `Trigger on create/update/delete of networking resources`
           * **Status**: leave as **Enabled**.
           * **Compartment**: the tenancy/compartment where you want to detect changes.
             * If you want **tenant-wide** coverage, choose the root compartment.

        4. Under **Rule Conditions**:
           * Choose **Event Type**:\
             Select **“Service = Virtual Cloud Network (VCN)”** (or “Core Services” depending on UI version) and pick events like:
             * `CreateVcn`, `UpdateVcn`, `DeleteVcn`
             * `CreateSubnet`, `UpdateSubnet`, `DeleteSubnet`
             * `CreateRouteTable`, `UpdateRouteTable`, `DeleteRouteTable`
             * `CreateSecurityList`, `UpdateSecurityList`, `DeleteSecurityList`
             * `CreateNetworkSecurityGroup`, `UpdateNetworkSecurityGroup`, `DeleteNetworkSecurityGroup`
             * `CreateInternetGateway`, `UpdateInternetGateway`, `DeleteInternetGateway`
             * `CreateLocalPeeringGateway`, `UpdateLocalPeeringGateway`, `DeleteLocalPeeringGateway`
             * `CreateDrg`, `UpdateDrg`, `DeleteDrg` (and attachments, as available)

           * In some consoles, you instead define a **Rule Condition (JSON)**. Example pattern:

             ```json theme={null}
             {
               "eventType": [
                 "com.oraclecloud.vcn.createvcn",
                 "com.oraclecloud.vcn.updatevcn",
                 "com.oraclecloud.vcn.deletevcn",
                 "com.oraclecloud.vcn.createsubnet",
                 "com.oraclecloud.vcn.updatesubnet",
                 "com.oraclecloud.vcn.deletesubnet",
                 "com.oraclecloud.vcn.createroutetable",
                 "com.oraclecloud.vcn.updateroutetable",
                 "com.oraclecloud.vcn.deleteroutetable",
                 "com.oraclecloud.vcn.createsecuritylist",
                 "com.oraclecloud.vcn.updatesecuritylist",
                 "com.oraclecloud.vcn.deletesecuritylist",
                 "com.oraclecloud.vcn.createnetworksecuritygroup",
                 "com.oraclecloud.vcn.updatenetworksecuritygroup",
                 "com.oraclecloud.vcn.deletenetworksecuritygroup",
                 "com.oraclecloud.vcn.createinternetgateway",
                 "com.oraclecloud.vcn.updateinternetgateway",
                 "com.oraclecloud.vcn.deleteinternetgateway"
               ]
             }
             ```

           * Adjust resource/event types to align with your requirements and what’s available in your region/tenant.

        5. Under **Actions**:
           * Click **Add Action**.
           * **Action Type**: `Notifications`.
           * **Topic**: select the topic `network-change-alerts`.

        6. Click **Create Rule**.

        ***

        ## 4. (Optional) Scope and Filter More Precisely

        * If required, refine with **conditions on compartments**, **VCN OCIDs**, or **tags** in the rule’s JSON pattern, to limit alerts to production or specific networks.

        ***

        ## 5. Test the Alert

        1. Make a safe change, e.g., modify a **test security list** or **test route table**.
        2. Confirm:
           * The event is recorded (check **Events → Recent Events**).
           * An email (or other protocol) notification is received.

        ***

        If you want instructions specifically for one network resource type (e.g., only security list changes), list that, and I’ll give an exact event pattern for it.
      </Accordion>

      <Accordion title="Using CLI">
        Below is a concise, CLI‑only way to configure an OCI “network change” alert using Events + Notifications (this is how you detect config changes in networking; Monitoring alarms are metric-based and don’t see config changes directly).

        Replace all placeholder values (`<...>`) with your own.

        ***

        ### 1. Set variables (shell)

        ```bash theme={null}
        export COMPARTMENT_OCID="<compartment-ocid>"
        export TOPIC_NAME="network-change-alerts"
        export EMAIL_ADDRESS="<you@example.com>"
        export RULE_NAME="network-change-rule"
        ```

        ***

        ### 2. Create a Notifications Topic

        ```bash theme={null}
        oci ons topic create \
          --compartment-id "$COMPARTMENT_OCID" \
          --name "$TOPIC_NAME" \
          --description "Alerts for OCI network configuration changes" \
          --query 'data.id' \
          --raw-output
        ```

        Save the returned Topic OCID:

        ```bash theme={null}
        export TOPIC_OCID="<topic-ocid-returned-above>"
        ```

        ***

        ### 3. Create a Subscription (e.g., Email)

        ```bash theme={null}
        oci ons subscription create \
          --topic-id "$TOPIC_OCID" \
          --protocol EMAIL \
          --endpoint "$EMAIL_ADDRESS"
        ```

        Check your email and confirm the subscription.

        ***

        ### 4. Create an Events Rule for Network Changes

        Example: watch for creation, update, deletion of VCNs, Subnets, Security Lists, NSGs, and Route Tables.

        Create a JSON file for the condition (e.g. `network-condition.json`):

        ```json theme={null}
        {
          "eventType": [
            "com.oraclecloud.virtualnetwork.vcn.create",
            "com.oraclecloud.virtualnetwork.vcn.update",
            "com.oraclecloud.virtualnetwork.vcn.delete",
            "com.oraclecloud.virtualnetwork.subnet.create",
            "com.oraclecloud.virtualnetwork.subnet.update",
            "com.oraclecloud.virtualnetwork.subnet.delete",
            "com.oraclecloud.virtualnetwork.securitylist.create",
            "com.oraclecloud.virtualnetwork.securitylist.update",
            "com.oraclecloud.virtualnetwork.securitylist.delete",
           "com.oraclecloud.virtualnetwork.networksecuritygroup.create",
            "com.oraclecloud.virtualnetwork.networksecuritygroup.update",
            "com.oraclecloud.virtualnetwork.networksecuritygroup.delete",
            "com.oraclecloud.virtualnetwork.routetable.create",
            "com.oraclecloud.virtualnetwork.routetable.update",
            "com.oraclecloud.virtualnetwork.routetable.delete"
          ],
          "data": {
            "additionalDetails": {
              "compartmentId": "<compartment-ocid>"
            }
          }
        }
        ```

        Create a JSON file for actions (e.g. `network-actions.json`):

        ```json theme={null}
        {
          "actions": [
            {
              "actionType": "ONS",
              "isEnabled": true,
              "description": "Send notification on network configuration change",
              "topicId": "<topic-ocid>"
            }
          ]
        }
        ```

        Now create the Events rule:

        ```bash theme={null}
        oci events rule create \
          --display-name "$RULE_NAME" \
          --compartment-id "$COMPARTMENT_OCID" \
          --is-enabled true \
          --condition "$(cat network-condition.json)" \
          --actions "$(cat network-actions.json)"
        ```

        ***

        ### 5. Validate

        Make a small network change (e.g., update a security list description) and confirm you receive an email.

        This setup satisfies the “network change alarm” requirement for OCI by using Events + Notifications to alert on network configuration changes, callable and fully manageable via OCI CLI.
      </Accordion>

      <Accordion title="Using Python">
        Below is how you can remediate this by programmatically creating a **network-change alarm** in OCI Monitoring using Python, wired to OCI Notifications.

        The example assumes:

        * You want an alarm on unusual network activity (e.g., high egress traffic) as a proxy for potential network changes/abuse.
        * You’re using the OCI Python SDK and a config file (`~/.oci/config`).

        ***

        ## 1. Prerequisites

        1. Install/upgrade the OCI Python SDK:
           ```bash theme={null}
           pip install --upgrade oci
           ```

        2. Ensure your `~/.oci/config` has:
           ```ini theme={null}
           [DEFAULT]
           user=ocid1.user.oc1..xxxx
           fingerprint=xx:xx:xx:xx
           key_file=/path/to/oci_api_key.pem
           tenancy=ocid1.tenancy.oc1..xxxx
           region=us-phoenix-1
           ```

        3. Get required OCIDs:
           * `compartment_ocid` where your network resources (VCNs, VNics) live.

        ***

        ## 2. Create a Notifications Topic (destination for the alarm)

        ```python theme={null}
        import oci

        config = oci.config.from_file()  # default profile
        compartment_id = "ocid1.compartment.oc1..xxxxx"   # replace with your compartment OCID
        topic_name = "network-change-alerts-topic"

        ons_client = oci.ons.NotificationControlPlaneClient(config)

        create_topic_details = oci.ons.models.CreateTopicDetails(
            name=topic_name,
            compartment_id=compartment_id,
            description="Topic for network change / anomaly alerts"
        )

        topic = ons_client.create_topic(create_topic_details).data
        topic_ocid = topic.topic_id
        print("Created topic:", topic_ocid)
        ```

        Optionally, add a subscription (email, Slack via HTTPS, etc.):

        ```python theme={null}
        subscription_details = oci.ons.models.CreateSubscriptionDetails(
            topic_id=topic_ocid,
            protocol="EMAIL",               # or HTTPS, PAGERDUTY, etc.
            endpoint="you@example.com"
        )

        subscription = ons_client.create_subscription(subscription_details).data
        print("Created subscription:", subscription.id)
        ```

        ***

        ## 3. Create the Network Alarm in Monitoring

        Example: alarm on **sudden high egress bytes** on VNics (you can tune the query and threshold for your environment).

        ### Example Metric Query

        For VNics (namespace `oci_vcn`, metric `VnicEgressBytes`):

        ```text theme={null}
        Query (MQL):

        sum(metric[1m].VnicEgressBytes) > 100000000
        ```

        * `metric[1m]` → 1-minute aggregation windows
        * `sum(...)` → sum across resources
        * `> 100000000` → threshold (e.g., >100MB/min) – adjust as needed

        ### Python: Create the Alarm

        ```python theme={null}
        from datetime import datetime
        from oci.monitoring import MonitoringClient
        from oci.monitoring.models import CreateAlarmDetails

        monitoring_client = MonitoringClient(config)

        alarm_display_name = "Network Egress Spike Alarm"
        alarm_query = "sum(metric[1m].VnicEgressBytes) > 100000000"  # adjust threshold

        create_alarm_details = CreateAlarmDetails(
            compartment_id=compartment_id,
            display_name=alarm_display_name,
            metric_compartment_id=compartment_id,      # compartment where VNics live
            namespace="oci_vcn",
            query=alarm_query,
            severity="CRITICAL",                       # INFO | WARNING | ERROR | CRITICAL
            destinations=[topic_ocid],                 # Notifications topic
            is_enabled=True,
            repeat_notification_duration="PT15M",      # re-notify every 15 min while in alarm
            pending_duration="PT5M",                   # must breach for 5 min before firing
            resolution="1m",                           # metric resolution
            body="High network egress detected – possible network change or data exfiltration.",
            message_format="TEXT",                     # or "JSON"
        )

        alarm = monitoring_client.create_alarm(create_alarm_details).data
        print("Created alarm:", alarm.id)
        ```

        ***

        ## 4. Hardening / “Network Change” Angle

        To more closely align with “network change”:

        * Add **multiple alarms**, for example:
          * Egress & ingress volume spikes: `VnicEgressBytes`, `VnicIngressBytes`
          * Connection count spikes (if you collect such custom metrics).
        * Narrow the metrics using **resourceGroup** or **dimension filters** in the query if you want to monitor only specific VCNs / VNics.

        Example with a dimension filter for a specific VCN OCID:

        ```text theme={null}
        sum(metric[1m].VnicEgressBytes{vcnId="ocid1.vcn.oc1..xxxxx"}) > 50000000
        ```

        Use that exact query string in `alarm_query`.

        ***

        ## 5. Verify

        1. In OCI Console → **Observability & Management → Alarms**:
           * Confirm the alarm appears and is `Enabled`.
        2. Generate test network traffic to cross the threshold, or temporarily lower the threshold.
        3. Confirm:
           * Alarm state changes to `FIRING`.
           * Notification (email, etc.) is received.

        This fulfills the requirement “OCI Monitoring Should Have Network Change Alarm Configured” by implementing a programmatically managed Monitoring alarm and notifications pipeline using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "oci_monitoring_alarm" "mfa_requirement_violation_alarm" {
          # Replace with your OCIDs and notification destination
          compartment_id = "OCID_OF_TARGET_COMPARTMENT"
          display_name   = "MFA Requirement Violation Alarm"

          # This is the key part: monitor the MfaRequirementViolation metric
          # Adjust namespace / dimension filters if your tenancy uses a different convention
          query = "MfaRequirementViolation[1m].sum() > 0"

          # Alarm behavior
          is_enabled          = true
          severity            = "CRITICAL"
          body                = "MFA requirement was violated. Investigate immediately."
          message_format      = "TEXT"
          metric_compartment_id = "OCID_OF_TARGET_COMPARTMENT"

          # At least one notification destination (e.g., OCI Notifications topic)
          destinations = [
            "OCID_OF_OCI_NOTIFICATIONS_TOPIC",
          ]

          # Optional: how often the alarm is evaluated
          resolution = "1m"

          # Optional: notify on state transitions
          pending_duration = "PT1M"
          repeat_notification_duration = "PT0S"

          # Optional: suppress reminders when in OK state
          # is_notifications_per_rule_enabled = false

          # Optional tags
          freeform_tags = {
            OWNER = "TEAM_NAME"
            ENV   = "ENVIRONMENT_NAME"
          }
        }
        ```

        This configuration does not force replacement of any existing alarm; it creates (or manages) an alarm specifically for the `MfaRequirementViolation` metric with a threshold of `> 0` over a 1‑minute window.

        To verify, `terraform plan` should show this alarm resource with `+ create` (or, if you are importing an existing alarm to manage it, only the drifted fields being updated and no `-/+` replacement).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>