> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI Logging Audit Service Should Be Actively Monitored

### More Info:

The OCI Audit service should be actively producing events. If audit is not enabled or has zero events, security-critical activities are not being recorded for investigation.

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* FedRAMP
* GDPR
* HIPAA
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* Reserve Bank of India (RBI) Cyber Security Framework
* Reserve Bank of India (RBI) Master Direction – Information Technology Framework
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Here’s how to actively monitor OCI Audit logs using **Logging search alerts and Notifications** in the OCI Console.

        ***

        ## 1. Confirm Audit Logs Are Being Collected

        1. Sign in to the **OCI Console**.
        2. Open the navigation menu → **Logging** → **Logs**.
        3. In the top-left compartment selector, choose your **root compartment (tenancy)**.
        4. Filter for **Service = Audit** or look for a log named **Audit** or **Audit Logs**.
           * If present and showing recent entries, Audit logging is active (Audit is usually always-on; you’re verifying visibility in Logging).

        ***

        ## 2. Create a Notification Topic & Subscription

        You will use OCI Notifications to receive alerts (email, Slack, etc.).

        1. Open the navigation menu → **Developer Services** → **Notifications** → **Topics**.
        2. Click **Create Topic**.
           * Name: e.g. `audit-alerts-topic`
           * Description: e.g. `Alerts for OCI Audit events`
           * Compartment: choose the compartment where you manage ops/security.
        3. Click **Create**.

        Add a subscription:

        4. On the topic details page, click **Create Subscription**.
        5. Choose protocol (e.g. **Email**).
        6. Enter destination (e.g. your security team’s email).
        7. Click **Create**.
        8. Go to your email and **confirm** the subscription (required before alerts are delivered).

        ***

        ## 3. Build a Logging Search for Audit Events

        1. Open the navigation menu → **Logging** → **Logs**.

        2. In the compartment selector, choose the compartment with your **Audit log** (often root).

        3. Click on the **Audit** log (the log resource, not a single entry).

        4. Click **Search** or **View Log** (depending on UI version).

        5. Use a filter query defining what you want to be alerted on. For example, to catch sensitive API calls:

           Example query:

           ```text theme={null}
           data.eventName in ("DELETE_INSTANCE", "TERMINATE_INSTANCE", "DELETE_BUCKET", "DELETE_COMPARE", "DELETE_VCN", "DELETE_SECURITY_LIST")
           ```

           Or to alert on any `ERROR`:

           ```text theme={null}
           data.responseStatus >= 400
           ```

        6. Run the query and verify it returns the events you care about.

        ***

        ## 4. Create a Logging Alert from the Search

        1. With the query loaded and validated, look for **Create Alert** or **Save as Alert** (typically near the search bar).
        2. Click **Create Alert** (wording may be “Create” → “Alert Rule” or similar).

        Configure the alert:

        3. **Name**: e.g. `High-Risk Audit API Calls Alert`.

        4. **Description**: e.g. `Triggers when destructive or high-risk Audit events happen`.

        5. **Compartment**: choose where you manage security/ops resources.

        6. **Query**: your tested logging query should already be populated.

        7. **Schedule**:
           * Choose how frequently to run (e.g. **Every 5 minutes** or **Every 15 minutes**).

        8. **Trigger condition**:
           * Example: “Trigger when count of matches **> 0**”.

        9. **Notifications**:
           * Select **Notifications Topic** and choose the topic you created: `audit-alerts-topic`.

        10. Save / Create the alert.

        ***

        ## 5. Test the Alert

        1. Perform a **non-destructive test action** that will generate a relevant Audit event (e.g. modify a test resource’s tag, or create/delete a small, non-critical resource, depending on your query).
        2. Wait for the schedule interval (e.g. 5–15 minutes).
        3. Confirm that:
           * The event shows up under **Logging → Audit log search**.
           * A notification email (or other protocol) is received.

        ***

        ## 6. Operationalize & Tune

        * Refine queries to:
          * Include only **critical services / compartments**.
          * Exclude **known-noisy operations**.
        * Create multiple alerts for different severities, e.g.:
          * Critical destructive actions.
          * IAM/Policy changes (`data.eventSource = "identity"`).
          * Unexpected regions or compartments.

        With this in place, your **OCI Audit Logging is actively monitored** via OCI Logging, scheduled searches, and Notifications, all configured from the OCI Console.
      </Accordion>

      <Accordion title="Using CLI">
        Below is a minimal, step‑by‑step way to ensure **OCI Audit logs are actively monitored** using **OCI CLI**:

        * enable (or confirm) Audit logs are going into OCI Logging
        * create a metric‑based alarm on those logs with OCI Monitoring

        Replace all `...` placeholders (compartment OCIDs, regions, etc.) with your values.

        ***

        ## 1. Prerequisites

        Make sure:

        * OCI CLI is configured:
          ```bash theme={null}
          oci setup config
          ```
        * You know:
          * **Tenancy OCID**: `ocid1.tenancy.oc1..xxxxx`
          * **Compartment OCID** for security/logging: `ocid1.compartment.oc1..xxxxx`
          * **Region**: e.g., `us-ashburn-1`

        You can set region at CLI level (recommended):

        ```bash theme={null}
        export OCI_CLI_REGION=us-ashburn-1
        ```

        ***

        ## 2. Ensure OCI Audit is sending logs to OCI Logging

        OCI **Audit** is always on, but you must **create a service log** for `audit` in Logging so you can monitor it.

        ### 2.1 Create (or identify) a Log Group for Audit

        ```bash theme={null}
        oci logging log-group create \
          --compartment-id ocid1.compartment.oc1..COMPARTMENT_OCID \
          --display-name "security-audit-log-group" \
          --description "Log group for Audit service logs"
        ```

        Save the returned `"id"` as `LOG_GROUP_OCID`.\
        Example:

        ```bash theme={null}
        LOG_GROUP_OCID="ocid1.loggroup.oc1..xxxx"
        ```

        (If you already have a log group, you can list and pick one:)

        ```bash theme={null}
        oci logging log-group list \
          --compartment-id ocid1.compartment.oc1..COMPARTMENT_OCID
        ```

        ### 2.2 Create a service log for Audit

        ```bash theme={null}
        oci logging log create \
          --log-group-id "$LOG_GROUP_OCID" \
          --display-name "audit-service-log" \
          --log-type SERVICE \
          --is-enabled true \
          --configuration '{
            "source": {
              "category": "audit",
              "service": "audit"
            },
            "compartmentId": "ocid1.tenancy.oc1..TENANCY_OCID"
          }'
        ```

        Save `"id"` as `AUDIT_LOG_OCID` (optional for later reference).

        ***

        ## 3. Create a Monitoring Alarm for Audit Logs

        Typical security control: alert if **no audit events** occur for a certain period (e.g., 1 hour) in a tenancy or key compartment.

        OCI exposes **metrics for logs** in namespace `oci_logging`. When you enabled the service log, you can now build alarms on those metrics.

        ### 3.1 Decide on alarm behavior

        Example:

        * Trigger if **no audit log entries** are written for 1 hour.
        * Evaluation period: `1h`
        * Severity: `CRITICAL`
        * Destination: an **ONS topic** (email/SNS endpoint).

        First, make (or reuse) an **ONS topic**:

        ```bash theme={null}
        oci ons topic create \
          --compartment-id ocid1.compartment.oc1..COMPARTMENT_OCID \
          --name "audit-monitoring-topic" \
          --description "Notifications for Audit logging monitoring"
        ```

        Save `"topic-id"` as `TOPIC_OCID`.

        Then subscribe your email (one time only):

        ```bash theme={null}
        oci ons subscription create \
          --topic-id "$TOPIC_OCID" \
          --protocol EMAIL \
          --endpoint you@example.com
        ```

        Confirm the subscription from your email.

        ### 3.2 Create the alarm

        We’ll use the **Logging metrics** to detect when the Audit service log is completely quiet. Metric name examples: `LogsVolume`, `LogsCount`.\
        Below is a generic example using `LogsCount` — adjust as needed if your tenancy uses different metric names or dimensions.

        **Alarm logic**: if `LogsCount` for our Audit log group in the last hour is `0`, raise an alarm.

        ```bash theme={null}
        oci monitoring alarm create \
          --compartment-id ocid1.compartment.oc1..COMPARTMENT_OCID \
          --display-name "audit-logs-quiet-too-long" \
          --is-enabled true \
          --severity CRITICAL \
          --namespace "oci_logging" \
          --query-text "LogsCount[1h]{logGroupId = \"$LOG_GROUP_OCID\"}.sum() < 1" \
          --destinations "[\"$TOPIC_OCID\"]" \
          --pending-duration "PT0M" \
          --resolution "1h" \
          --message-format PRETTY_JSON \
          --body "No audit log entries have been ingested into Logging for at least 1 hour. Check Audit/Logging pipeline immediately." \
          --repeat-notification-duration "PT0M"
        ```

        Notes:

        * `namespace "oci_logging"` is used for Logging metrics.
        * The exact metric name and dimensions (`LogsCount`, `logGroupId`) may vary; if necessary, list available metrics:

          ```bash theme={null}
          oci monitoring metric list \
            --compartment-id ocid1.compartment.oc1..COMPARTMENT_OCID \
            --namespace "oci_logging" \
            --group-by "name,dimensions"
          ```

        Update the alarm query if your metrics differ (for example, filter by `resourceDisplayName = "audit-service-log"` or by `sourceService = "audit"` if that dimension exists).

        ***

        ## 4. (Optional) Alarm for high audit volume

        You can also detect abnormal spikes (possible attack / misconfiguration). For example, alert if audit events > 10,000 in 5 minutes:

        ```bash theme={null}
        oci monitoring alarm create \
          --compartment-id ocid1.compartment.oc1..COMPARTMENT_OCID \
          --display-name "audit-logs-volume-spike" \
          --is-enabled true \
          --severity WARNING \
          --namespace "oci_logging" \
          --query-text "LogsCount[5m]{logGroupId = \"$LOG_GROUP_OCID\"}.sum() > 10000" \
          --destinations "[\"$TOPIC_OCID\"]" \
          --pending-duration "PT0M" \
          --resolution "5m" \
          --message-format PRETTY_JSON \
          --body "Audit log volume is unusually high in the past 5 minutes. Investigate potential security events or configuration issues." \
          --repeat-notification-duration "PT0M"
        ```

        ***

        ## 5. Verification

        1. List alarms:

           ```bash theme={null}
           oci monitoring alarm list \
             --compartment-id ocid1.compartment.oc1..COMPARTMENT_OCID
           ```

        2. Check their state:

           ```bash theme={null}
           oci monitoring alarm-status get \
             --alarm-id ocid1.alarm.oc1..ALARM_OCID
           ```

        3. Confirm you receive email from the ONS topic when alarm triggers (you can temporarily lower thresholds or query values to force a test).

        ***

        If you share the output of `oci monitoring metric list --namespace oci_logging` I can give you an exact `--query-text` tailored to your environment.
      </Accordion>

      <Accordion title="Using Python">
        Below is one straightforward way to “actively monitor” the OCI Audit Logging service using Python:

        * use the OCI Python SDK
        * create an **ONS notification topic** and subscription
        * create a **Monitoring Alarm** on Audit metrics (namespace `oci_audit`)

        That satisfies common “actively monitored” requirements for security/compliance.

        ***

        ## 0. Prerequisites

        1. Install OCI SDK:
           ```bash theme={null}
           pip install oci
           ```
        2. Configure `~/.oci/config` (or use instance principals) with:
           * tenancy
           * user
           * fingerprint
           * key\_file
           * region
           * profile name (e.g., `DEFAULT`)

        ***

        ## 1. Create a Notification Topic and Subscription (Email) via Python

        ```python theme={null}
        import oci

        # Use DEFAULT profile in ~/.oci/config; change if needed
        config = oci.config.from_file("~/.oci/config", "DEFAULT")

        # Replace with your compartment OCID and email
        COMPARTMENT_ID = "<your_compartment_ocid>"
        EMAIL_ADDRESS = "security-team@example.com"
        TOPIC_NAME = "audit-log-monitoring-topic"

        ons_client = oci.ons.NotificationControlPlaneClient(config)

        # 1. Create topic
        create_topic_details = oci.ons.models.CreateTopicDetails(
            name=TOPIC_NAME,
            compartment_id=COMPARTMENT_ID,
            description="Topic for OCI Audit Logging monitoring alerts"
        )

        topic = ons_client.create_topic(create_topic_details).data
        topic_ocid = topic.topic_id
        print("Created topic:", topic_ocid)

        # 2. Create email subscription
        create_sub_details = oci.ons.models.CreateSubscriptionDetails(
            compartment_id=COMPARTMENT_ID,
            protocol="EMAIL",
            endpoint=EMAIL_ADDRESS,
            topic_id=topic_ocid
        )

        subscription = ons_client.create_subscription(create_sub_details).data
        print("Created subscription:", subscription.id)
        print("IMPORTANT: Confirm the subscription from the email that OCI sends.")
        ```

        ***

        ## 2. Create an Alarm on Audit Metrics via Python

        You can monitor the Audit service using the metric namespace `oci_audit`.\
        Example: fire an alarm if the number of audit events suddenly spikes beyond a threshold.

        Below example:

        * Metric namespace: `oci_audit`
        * Metric: `audit.events.count`
        * Condition: `sum(audit.events.count) > 100` over a 5-minute window\
          (Tune this threshold to your environment.)
        * Sends notifications to the ONS topic created above.

        ```python theme={null}
        import oci
        from datetime import datetime

        config = oci.config.from_file("~/.oci/config", "DEFAULT")

        COMPARTMENT_ID = "<your_compartment_ocid>"
        TOPIC_OCID = "<topic_ocid_from_previous_step>"

        monitoring_client = oci.monitoring.MonitoringClient(config)

        # Monitoring query:
        #   sum(audit.events.count) [5m] > 100
        # Over last 5 minutes, if sum of audit events is more than 100, alarm triggers.
        #
        # You can further filter by dimensions (like compartment or target service)
        # with something like: {resourceId = "ocid1.tenancy.oc1..xxxxx"}

        alarm_query = 'sum(audit.events.count[5m]) > 100'

        from oci.monitoring.models import (
            CreateAlarmDetails,
            AlarmSuppression,
        )

        alarm_details = CreateAlarmDetails(
            display_name="Audit Events Spike Alarm",
            compartment_id=COMPARTMENT_ID,
            is_enabled=True,
            namespace="oci_audit",
            query=alarm_query,
            severity="CRITICAL",
            body="Audit Logging events count exceeded expected threshold.",
            destinations=[TOPIC_OCID],
            resolution="Check recent configuration/API actions and validate they are authorized.",
            message_format="TEXT",
            # Use "FIRING" for when threshold exceeded; could also add alarms for low volume/absence.
            pending_duration="PT1M",   # 1 minute pending before state change
            repeat_notification_duration="PT15M"  # repeat every 15 mins while firing
        )

        alarm = monitoring_client.create_alarm(alarm_details).data
        print("Created alarm:", alarm.id)
        ```

        ***

        ## 3. Optional: Alarm for “No Audit Logs Seen”

        To detect if the Audit service stops emitting events (e.g., misconfiguration, region issue), you can create an alarm on **absence** of data by using comparison to 0 with `evaluate_missing_data = "EVALUATE_AS_ZERO"` and a condition like:

        ```python theme={null}
        from oci.monitoring.models import CreateAlarmDetails

        alarm_query = 'sum(audit.events.count[15m]) < 1'

        alarm_details = CreateAlarmDetails(
            display_name="Audit Events Missing Alarm",
            compartment_id=COMPARTMENT_ID,
            is_enabled=True,
            namespace="oci_audit",
            query=alarm_query,
            severity="CRITICAL",
            body="No Audit events observed in the last 15 minutes.",
            destinations=[TOPIC_OCID],
            message_format="TEXT",
            pending_duration="PT5M",
            repeat_notification_duration="PT30M",
            evaluate_missing_data="EVALUATE_AS_ZERO"
        )

        alarm = monitoring_client.create_alarm(alarm_details).data
        print("Created missing-audit-events alarm:", alarm.id)
        ```

        ***

        ## 4. Validate

        1. In OCI Console:
           * Go to **Monitoring → Alarms**
           * Verify the alarms exist and are enabled.
        2. In **Notifications**:
           * Confirm subscription is `CONFIRMED`.
        3. Generate audit activity (e.g., create/delete small test resources) and ensure:
           * Audit metrics update (Monitoring → Metrics → `oci_audit`)
           * Alarms fire when thresholds are crossed and email is received.

        This configuration uses Python to put Monitoring and Notifications around the OCI Audit Logging service, which is typically what “OCI Logging Audit Service should be actively monitored” requires.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "oci_logging_audit_configuration" "audit_monitoring" {
          # Set this to the TENANCY OCID (root compartment) or the specific COMPARTMENT OCID
          compartment_id = "OCID_OF_TENANCY_OR_TARGET_COMPARTMENT"

          # Ensure the Audit service is actively producing events into OCI Logging
          is_enabled = true
        }
        ```

        Substitute:

        * `OCID_OF_TENANCY_OR_TARGET_COMPARTMENT` with the OCID where you want Audit logs configured (typically the tenancy/root compartment).

        This change updates the existing configuration in place and does not force resource replacement.

        Verification: `terraform plan` should show `is_enabled` changing from `false` (or unset) to `true` on `oci_logging_audit_configuration.audit_monitoring`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>