Event rule for Cloud Guard problems has notifications

Check ID: events_rule_cloudguard_problems
Provider: Oracle Cloud (OCI)
Service: events
Severity: HIGH
Categories: threat-detection
Resource type: EventRule

What this check verifies

OCI Events rules subscribe to Cloud Guard problem lifecycle events-com.oraclecloud.cloudguard.problemdetected, com.oraclecloud.cloudguard.problemdismissed, and com.oraclecloud.cloudguard.problemremediated-and include notification actions. When Cloud Guard sets a reporting region, rules are expected in that region.

Risk

Without notifications for Cloud Guard problems, incidents can go unseen, delaying response. Ongoing issues can erode confidentiality via data exfiltration, threaten integrity through unremediated changes, and impact availability by allowing attacks to persist. Silent failures of automated remediation may also go unnoticed.

Recommendation

Implement event-driven alerts for Cloud Guard problem lifecycle events and route them to trusted notification channels and your SOC/SIEM. Enforce least privilege on publish/subscribe, align rules with the reporting region, and use severity-based filtering to prioritize response within a defense-in-depth approach.

Remediation

CLI
Terraform
Dashboard steps

oci events rule create --compartment-id <example_resource_id> --display-name <example_resource_name> --is-enabled true --condition '{"eventType":["com.oraclecloud.cloudguard.problemdetected","com.oraclecloud.cloudguard.problemdismissed","com.oraclecloud.cloudguard.problemremediated"]}' --actions '{"actions":[{"actionType":"ONS","isEnabled":true,"topicId":"<example_resource_id>"}]}' --region <region>

resource "oci_events_rule" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"
  display_name   = "<example_resource_name>"
  is_enabled     = true

  # critical: monitor Cloud Guard problem events
  condition = jsonencode({
    eventType = [
      "com.oraclecloud.cloudguard.problemdetected",
      "com.oraclecloud.cloudguard.problemdismissed",
      "com.oraclecloud.cloudguard.problemremediated"
    ]
  })

  actions {
    actions {
      action_type = "ONS"
      is_enabled  = true
      topic_id    = "<example_resource_id>" # critical: send notifications to this topic
    }
  }
}

References

https://docs.oracle.com/en-us/iaas/cloud-guard/home.htm

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = events_rule_cloudguard_problems. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Tenancy has a notification topic with subscriptions Event rule for IAM group changes has notifications

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires