Event rule for OCI user sign-ins has notifications

Check ID: events_rule_local_user_authentication
Provider: Oracle Cloud (OCI)
Service: events
Severity: MEDIUM
Categories: threat-detection
Resource type: EventRule

What this check verifies

OCI Events rules targeting com.oraclecloud.identitysignon.interactivelogin are assessed for configured notification actions to monitor local user interactive sign-ins. Rules are compartment-scoped and can cover child compartments.

Risk

Without alerts on local sign-ins, account takeovers and brute-force attempts can go unnoticed. Attackers with local access can exfiltrate data (confidentiality), change configurations (integrity), and disrupt services (availability), delaying detection and response.

Recommendation

Create an Events rule for com.oraclecloud.identitysignon.interactivelogin with notification actions delivering real-time alerts to monitored channels or workflows. Integrate with a SIEM, tune filters to reduce noise, and apply least privilege and defense in depth to limit local account exposure.

Remediation

CLI
Terraform
Dashboard steps

oci events rule create --display-name <example_resource_name> --is-enabled true --condition '{"eventType":["com.oraclecloud.identitysignon.interactivelogin"]}' --compartment-id <example_resource_id> --actions '{"actions":[{"actionType":"ONS","isEnabled":true,"topicId":"<example_resource_id>"}]}'

resource "oci_events_rule" "example" {
  display_name   = "<example_resource_name>"
  is_enabled     = true
  compartment_id = "<example_resource_id>"

  # Critical: filter for local OCI user authentication events
  condition = jsonencode({ eventType = ["com.oraclecloud.identitysignon.interactivelogin"] })

  actions {
    actions {
      # Critical: ONS notification action to a topic
      action_type = "ONS"
      is_enabled  = true
      topic_id    = "<example_resource_id>"
    }
  }
}

References

https://docs.oracle.com/en-us/iaas/Content/Events/home.htm

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = events_rule_local_user_authentication. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Event rule for IdP group mapping changes has notifications Event rule for network gateway changes has notifications

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires