> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI Logging Audit Should Be Enabled

### More Info:

OCI Audit service should be enabled to capture all API calls and events. Audit logs are essential for security investigations, compliance reporting, and detecting unauthorized activity

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Startup Security Baseline
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* FedRAMP
* GDPR
* HIPAA
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* Reserve Bank of India (RBI) Cyber Security Framework
* Reserve Bank of India (RBI) Master Direction – Information Technology Framework
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are the exact console steps to enable **OCI Audit logs in Logging** (the usual remediation for “OCI Logging Audit Should Be Enabled” using the OCI Console):

        ***

        ### 1. Open Logging in the correct compartment

        1. Sign in to the **OCI Console**.
        2. At the top, select the correct **Region**.
        3. In the left menu, go to:\
           **Observability & Management → Logging → Log groups**.
        4. In the upper-left compartment selector, choose the **compartment** where you want to store the Audit logs (commonly the **root compartment** or a central logging compartment).

        ***

        ### 2. Create (or choose) a Log Group

        1. If you don’t already have a log group for audit logs, click **Create log group**.
        2. Enter:
           * **Name** (e.g., `audit-log-group`)
           * **Description** (optional)
           * Confirm the **Compartment**.
        3. Click **Create**.

        *(If you already have a log group, you can reuse it and skip creating a new one.)*

        ***

        ### 3. Enable the Audit service log

        1. In the same compartment, go to:\
           **Observability & Management → Logging → Logs**.
        2. Click **Enable service log**.
        3. Fill in:
           * **Compartment**: the compartment whose **Audit** events you want to log.
           * **Service**: select **Audit**.
           * **Resource**: choose **tenancy** or the specific resource scope (commonly the tenancy).
           * **Log category**: usually **Audit** (or the default shown).
           * **Log group**: select the log group created above (e.g., `audit-log-group`).
           * **Name**: e.g., `audit-log`.
        4. Confirm **State** is set to **Enabled**.
        5. Click **Enable log**.

        Audit events for that compartment/tenancy are now written into the selected log group.

        ***

        ### 4. (Optional) Send Audit logs to Monitoring / Alarms

        If “for Logging Monitoring” means you want alerts based on Audit logs:

        1. Create a **Service Connector**:\
           **Observability & Management → Service Connectors → Create service connector**.
           * **Source**: Logging
           * **Source log group**: the log group with your Audit log
           * (Optionally filter for specific log content)
           * **Target**: Logging or Streaming (then you can feed into Functions, custom processing, etc.).
        2. Create **Alarms** in **Monitoring → Alarms** using metrics/logs produced by your processing pipeline, as applicable to your architecture.

        For the basic “OCI Logging Audit Should Be Enabled” requirement, steps 1–3 are sufficient.
      </Accordion>

      <Accordion title="Using CLI">
        In OCI, Audit is always on, but “Logging Audit should be enabled” usually means:

        * Create a **Log Group**
        * Create an **Audit Log** in that Log Group using the **Logging** service\
          (all via OCI CLI).

        Below are step‑by‑step CLI commands.

        ***

        ### 0. Prerequisites

        * OCI CLI installed and configured (`~/.oci/config` with tenancy, user, key, region).
        * You have permission: `manage log-groups` and `manage logs` in the target compartment (often the root compartment).

        ***

        ### 1. Identify the Compartment

        Typically you enable Audit logging in the **root compartment** of the tenancy.

        If you already know the compartment OCID, skip to step 2.\
        Otherwise, list compartments:

        ```bash theme={null}
        oci iam compartment list \
          --all \
          --compartment-id-in-subtree true \
          --access-level ANY
        ```

        Find the compartment OCID you want to use (e.g., the root compartment).

        Assume:

        ```bash theme={null}
        COMPARTMENT_OCID="<your_compartment_ocid_here>"
        ```

        ***

        ### 2. Create a Log Group (if you don’t already have one)

        ```bash theme={null}
        LOG_GROUP_NAME="audit-log-group"
        LOG_GROUP_DESC="Log group for Audit logs"

        oci logging log-group create \
          --compartment-id "$COMPARTMENT_OCID" \
          --display-name "$LOG_GROUP_NAME" \
          --description "$LOG_GROUP_DESC" \
          --query "data.id" \
          --raw-output
        ```

        This outputs the Log Group OCID. Save it:

        ```bash theme={null}
        LOG_GROUP_OCID="<output_from_previous_command>"
        ```

        If you already have a log group, you can get its OCID with:

        ```bash theme={null}
        oci logging log-group list \
          --compartment-id "$COMPARTMENT_OCID"
        ```

        ***

        ### 3. Create an Audit Log in the Log Group

        Create a log that captures Audit service events:

        ```bash theme={null}
        LOG_NAME="audit-log"

        oci logging log create \
          --log-group-id "$LOG_GROUP_OCID" \
          --display-name "$LOG_NAME" \
          --log-type SERVICE \
          --is-enabled true \
          --configuration '{
            "source": {
              "category": "audit",
              "service": "audit",
              "resource": "audit"
            }
          }' \
          --query "data.id" \
          --raw-output
        ```

        This command:

        * `--log-type SERVICE` → tells Logging to collect from an OCI service.
        * `category: "audit"` and `service: "audit"` → specifically select Audit logs.
        * `--is-enabled true` → enables the log immediately.

        ***

        ### 4. Verify the Log Is Enabled

        ```bash theme={null}
        oci logging log get \
          --log-id "<log_ocid_from_previous_command>"
        ```

        Check that:

        * `"is-enabled": true`
        * `"logType": "SERVICE"`
        * `configuration.source.service` is `"audit"`
        * `configuration.source.category` is `"audit"`

        ***

        ### 5. (Optional) Enable Logs via Existing Log Group Only

        If you just want to ensure any existing Audit log is enabled:

        1. List logs in the log group:

           ```bash theme={null}
           oci logging log list \
             --log-group-id "$LOG_GROUP_OCID"
           ```

        2. For any Audit log you find, enable it:

           ```bash theme={null}
           oci logging log update \
             --log-id "<existing_audit_log_ocid>" \
             --is-enabled true
           ```

        ***

        These steps enable **OCI Logging for Audit events** via the OCI CLI, which satisfies “OCI Logging Audit Should Be Enabled” for monitoring and compliance.
      </Accordion>

      <Accordion title="Using Python">
        To enable **OCI Audit logs** (and similarly Monitoring service logs) via Python, you use the **OCI Python SDK** and the **LoggingManagementClient** to create a log in a log group.

        Below is a minimal, step‑by‑step approach.

        ***

        ## 1. Prerequisites

        1. Install OCI SDK:

        ```bash theme={null}
        pip install oci
        ```

        2. Ensure you have a valid OCI config file, usually at `~/.oci/config`, with:

        * Tenancy OCID
        * User OCID
        * Fingerprint
        * Private key path
        * Region

        3. IAM policies (attached to a group your user/API key belongs to), for example:

        ```text theme={null}
        Allow group <your_group> to manage log-groups in tenancy
        Allow group <your_group> to manage logs in tenancy
        Allow service loganalytics to use log-content in tenancy     # if you use Log Analytics
        ```

        ***

        ## 2. Enable Audit Logging in OCI Logging (Python)

        This creates (if needed) a log group and an **Audit** log in the root compartment.

        ```python theme={null}
        import oci

        # --- CONFIGURE AUTH & CLIENTS ---
        config = oci.config.from_file("~/.oci/config", "DEFAULT")
        tenancy_ocid = config["tenancy"]

        logging_client = oci.logging.LoggingManagementClient(config)

        # --- PARAMETERS YOU CAN ADJUST ---
        log_group_display_name = "Tenant-Audit-Logs"
        audit_log_display_name = "Audit-Log"

        # 1. Find or create a log group in the tenancy (root compartment)
        def get_or_create_log_group(compartment_id, display_name):
            # Check if log group already exists
            list_resp = logging_client.list_log_groups(
                compartment_id=compartment_id,
                display_name=display_name
            )
            if list_resp.data:
                return list_resp.data[0]

            # Create log group
            create_details = oci.logging.models.CreateLogGroupDetails(
                compartment_id=compartment_id,
                display_name=display_name,
                description="Log group for Audit logs"
            )
            create_resp = logging_client.create_log_group(create_details)
            return create_resp.data

        log_group = get_or_create_log_group(tenancy_ocid, log_group_display_name)

        # 2. Check if Audit log already exists
        def log_exists(log_group_id, display_name):
            logs = logging_client.list_logs(
                log_group_id=log_group_id,
                display_name=display_name
            ).data
            return logs[0] if logs else None

        existing_audit_log = log_exists(log_group.id, audit_log_display_name)
        if existing_audit_log:
            print(f"Audit log already enabled: {existing_audit_log.id}")
        else:
            # 3. Create Audit log
            create_log_details = oci.logging.models.CreateLogDetails(
                display_name=audit_log_display_name,
                log_type="SERVICE",
                is_enabled=True,
                # Audit source configuration
                configuration=oci.logging.models.Configuration(
                    source=oci.logging.models.ServiceLogsSource(
                        category="audit",            # Audit category
                        resource="audit",            # Resource type for Audit
                        service="audit"              # Service name for Audit
                    )
                ),
                retention_duration=30  # days, adjust as needed
            )

            resp = logging_client.create_log(
                log_group_id=log_group.id,
                create_log_details=create_log_details
            )
            print(f"Created Audit log: {resp.data.id}")
        ```

        This script:

        * Ensures a log group exists in the root compartment.
        * Creates an **enabled** Audit log that sends Audit events to the Logging service.

        ***

        ## 3. Enabling Monitoring Service Logs in the Same Way

        To remediate “OCI Logging Monitoring” (e.g., enabling logs for the Monitoring service), you create another SERVICE log in the same or a different log group, changing only the source details.

        Example:

        ```python theme={null}
        monitoring_log_display_name = "Monitoring-Write-Logs"

        existing_monitoring_log = log_exists(log_group.id, monitoring_log_display_name)
        if existing_monitoring_log:
            print(f"Monitoring log already enabled: {existing_monitoring_log.id}")
        else:
            create_monitoring_log_details = oci.logging.models.CreateLogDetails(
                display_name=monitoring_log_display_name,
                log_type="SERVICE",
                is_enabled=True,
                configuration=oci.logging.models.Configuration(
                    source=oci.logging.models.ServiceLogsSource(
                        # Check your tenancy's available categories with the SDK or Console;
                        # common ones for Monitoring are "read", "write", or "readwrite".
                        category="write",
                        resource="alarms",      # or relevant Monitoring resource
                        service="monitoring"
                    )
                ),
                retention_duration=30  # days
            )

            resp = logging_client.create_log(
                log_group_id=log_group.id,
                create_log_details=create_monitoring_log_details
            )
            print(f"Created Monitoring log: {resp.data.id}")
        ```

        ***

        ## 4. Applying Across Compartments (Optional)

        If your requirement is “Audit Logging must be enabled **everywhere**,” you can:

        1. Use `IdentityClient.list_compartments` with `compartment_id_in_subtree=True`.
        2. Loop through compartments and:
           * Create/find a log group per compartment.
           * Create an Audit log (and Monitoring log) in each.

        If you want that loop example as well, ask and I’ll provide a compact script for all compartments.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "oci_logging_log_group" "audit_log_group" {
          # Replace with your tenancy or target compartment OCID
          compartment_id = "OCID_OF_TARGET_COMPARTMENT"
          display_name   = "audit-log-group"
          description    = "Log group for Audit service logs"
        }

        resource "oci_logging_log" "audit_log" {
          log_group_id = oci_logging_log_group.audit_log_group.id
          display_name = "audit-log"

          # Enable Audit service logging
          is_enabled = true
          log_type   = "SERVICE"

          configuration {
            source {
              # Audit service as the source
              category    = "audit"
              resource    = "audit"
              service     = "audit"
              source_type = "OCISERVICE"
            }

            compartment_id = "OCID_OF_TARGET_COMPARTMENT" # same as above or a specific compartment for the logs
          }

          retention_duration = 30 # DAYS; adjust to your policy
        }
        ```

        Substitute:

        * `OCID_OF_TARGET_COMPARTMENT` with the OCID of the compartment where you want to store the audit logs.

        This change does not replace existing OCI resources; it only creates/updates logging resources to capture Audit events.

        To verify, `terraform plan` should show creation (or update) of:

        * `oci_logging_log_group.audit_log_group`
        * `oci_logging_log.audit_log` with `is_enabled = true`, `log_type = "SERVICE"`, and `service = "audit"`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>