Tenancy audit log retention period is 365 days or greater

Check ID: audit_log_retention_period_365_days
Provider: Oracle Cloud (OCI)
Service: audit
Severity: MEDIUM
Categories: logging, forensics-ready
Resource type: Compartment

What this check verifies

OCI Audit configuration defines tenancy-wide log retention for audit events. The finding evaluates whether the retention period (days) is >= 365 and that an audit configuration exists, applying across all regions and compartments.

Risk

Insufficient audit retention or missing configuration shrinks the detection window and breaks accountability. Evidence for older actions may be unavailable, enabling attackers to evade detection, mask data exfiltration, and impede forensic reconstruction and compliance reporting.

Recommendation

Set audit retention to >= 365 days at the tenancy level and protect the setting with least privilege and separation of duties. Adopt defense in depth: export audit logs to centralized, immutable storage or a SIEM for extended retention, integrity, and continuous monitoring.

Remediation

CLI
Terraform
Dashboard steps

oci audit configuration update —compartment-id <tenancy-ocid> —retention-period-days 365

resource "oci_audit_configuration" "<example_resource_name>" {
  compartment_id        = var.tenancy_ocid
  retention_period_days = 365 # Critical: sets audit log retention to 365 days to pass the check
}

References

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = audit_log_retention_period_365_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Analytics Cloud instance restricts public access Block volume is encrypted with a Customer Managed Key (CMK)

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires