OCI Monitoring Should Have Password Spray Detection Alarm Configured

export COMPARTMENT_OCID="ocid1.compartment.oc1..xxxx"
export REGION="us-ashburn-1"
oci setup repair-file-permissions

oci cloud-guard cloud-guard-configuration update \
  --status ENABLED \
  --region $REGION

oci cloud-guard detector-recipe list \
  --compartment-id $COMPARTMENT_OCID \
  --all

export DETECTOR_RECIPE_OCID="ocid1.cloudguarddetectorrecipe.oc1..xxxx"

oci cloud-guard detector-recipe list-detector-rules \
  --detector-recipe-id $DETECTOR_RECIPE_OCID \
  --all \
  --output table

export PASSWORD_SPRAY_RULE_ID="ocid1.cloudguarddetectorrule.oc1..xxxx"

oci cloud-guard detector-recipe update-detector-rule \
  --detector-recipe-id $DETECTOR_RECIPE_OCID \
  --detector-rule-id $PASSWORD_SPRAY_RULE_ID \
  --detector-rule-details '{"isEnabled": true}'

oci ons topic create \
  --compartment-id $COMPARTMENT_OCID \
  --name "PasswordSprayAlarmTopic" \
  --description "Alert topic for Password Spray Cloud Guard problems" \
  --region $REGION

export TOPIC_OCID="ocid1.onstopic.oc1..xxxx"

oci ons subscription create \
  --topic-id $TOPIC_OCID \
  --protocol EMAIL \
  --endpoint "security-team@example.com" \
  --region $REGION

oci monitoring metric-data summarize-metrics-data \
  --compartment-id $COMPARTMENT_OCID \
  --query-text 'oci_cloud_guard, metric=problems_count[5m].sum()' \
  --namespace oci_cloud_guard \
  --region $REGION

oci monitoring alarm create \
  --compartment-id $COMPARTMENT_OCID \
  --display-name "Password Spray Detection Alarm" \
  --namespace "oci_cloud_guard" \
  --query-text 'oci_cloud_guard, metric=problems_count[5m].sum() > 0 {problemType = "PASSWORD_SPRAY"}' \
  --severity "CRITICAL" \
  --body "Password Spray detection triggered by Cloud Guard." \
  --destinations "[\"$TOPIC_OCID\"]" \
  --is-enabled true \
  --resolution "5m" \
  --pending-duration "PT0M" \
  --metric-compartment-id $COMPARTMENT_OCID \
  --metric-compartment-id-in-subtree true \
  --region $REGION

oci monitoring alarm list \
  --compartment-id $COMPARTMENT_OCID \
  --region $REGION \
  --display-name "Password Spray Detection Alarm"

import oci
import datetime

# Load OCI config
config = oci.config.from_file("~/.oci/config", "DEFAULT")
monitoring_client = oci.monitoring.MonitoringClient(config)

# Your target compartment OCID
COMPARTMENT_ID = "ocid1.compartment.oc1..xxxx"

def publish_password_spray_metric(value: float):
    """
    value > 0 means password spray detected in this interval.
    """
    now = datetime.datetime.utcnow().replace(tzinfo=datetime.timezone.utc)

    metric_data = oci.monitoring.models.MetricDataDetails(
        namespace="security_password_spray",
        resource_group=None,
        name="password_spray_detected",
        dimensions={"source": "audit-checker"},
        datapoints=[
            oci.monitoring.models.Datapoint(
                timestamp=now,
                value=value,
                count=1
            )
        ],
        metadata={}
    )

    post_details = oci.monitoring.models.PostMetricDataDetails(
        metric_data=[metric_data]
    )

    resp = monitoring_client.post_metric_data(
        post_metric_data_details=post_details,
        compartment_id=COMPARTMENT_ID
    )
    # Optionally check resp for failures

# Example usage after your detection logic:
password_spray_detected = True  # replace with real detection
if password_spray_detected:
    publish_password_spray_metric(1.0)
else:
    publish_password_spray_metric(0.0)

import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")
monitoring_client = oci.monitoring.MonitoringClient(config)

COMPARTMENT_ID = "ocid1.compartment.oc1..xxxx"

# Notification topic for alerts (e.g., email)
NOTIFICATION_TOPIC_OCID = "ocid1.onstopic.oc1..xxxx"

alarm_query = (
    "security_password_spray.metric[1m].sum() "
    "where metricName = 'password_spray_detected' "
    "and source = 'audit-checker'"
)

alarm_details = oci.monitoring.models.CreateAlarmDetails(
    display_name="Password Spray Detection Alarm",
    compartment_id=COMPARTMENT_ID,
    namespace="security_password_spray",
    query=alarm_query,
    severity="CRITICAL",  # or "ERROR", "WARN"
    destinations=[NOTIFICATION_TOPIC_OCID],
    is_enabled=True,
    # Condition: fire when sum over 5 min >= 1
    # This is encoded in the query's time window + evaluation,
    # or you can use `resolution` and `pending_duration`.
    # Typical pattern:
    pending_duration="PT0M",  # 0 minutes delay
    body="Password spray behavior detected.",
    metric_compartment_id=COMPARTMENT_ID,
    metric_compartment_id_in_subtree=False,
    repeat_notification_duration="PT15M"  # suppress repeated alerts for 15 min
)

response = monitoring_client.create_alarm(
    create_alarm_details=alarm_details
)
print("Alarm OCID:", response.data.id)

# This specific pattern-based detection (rapid failed logins immediately followed by a success)
# cannot be configured on oci_monitoring_alarm, because OCI Monitoring alarms operate on metrics
# and do not support event/log correlation in the way this check requires.

# You must instead build the detection on top of IAM / Audit / Identity Domain logs (e.g. via
# Logging Search / Logging Analytics or a Service Connector to custom metrics), then create an
# oci_monitoring_alarm on that derived metric. That log-query/correlation layer is not exposed
# as a Terraform argument on oci_monitoring_alarm today, so the finding cannot be fully fixed
# *on this resource type* from Terraform.

# Console outline (manual):
# 1. Identify the log source that records authentication attempts (Audit logs or identity domain logs).
# 2. In Logging / Logging Analytics, create a query that:
#    - counts multiple failed login attempts for a principal over a short period, and
#    - checks for a subsequent success for the same principal/IP in that window.
# 3. Either:
#    - create a Logging/Logging Analytics alert directly, or
#    - push the correlated result to a custom metric and then alarm on that metric.
# 4. If you do expose a custom metric called, for example, "PasswordSprayDetected" in namespace
#    "security_custom", *then* you can manage the Monitoring alarm itself in Terraform as below:

resource "oci_monitoring_alarm" "password_spray_alarm" {
  compartment_id       = "OCID_OF_COMPARTMENT"
  display_name         = "Password Spray Detection Alarm"
  is_enabled           = true
  severity             = "CRITICAL"
  # Namespace and metric name must match the custom metric emitted by your log/correlation pipeline
  namespace            = "security_custom"

  # Honour your required threshold; for example, alarm when >= 1 detection in 5 minutes
  query                = "PasswordSprayDetected[5m].sum() >= 1"

  destinations         = [
    "OCID_OF_ONS_TOPIC", # replace with an existing Notifications topic OCID
  ]

  pending_duration     = "PT1M"
  body                 = "Password spray or credential stuffing activity detected. Investigate immediately."
  resolution           = "5m"
  repeat_notification_duration = "PT30M"
}

# This Terraform only manages the alarm on a metric that already exists.
# The core detection logic (failed logins followed by success) must still be implemented
# in Logging / Logging Analytics or a log-to-metric pipeline outside this resource type.

# Verification:
# terraform plan should show:
# - 1 to add: oci_monitoring_alarm.password_spray_alarm