Event rule for NSG changes has notifications

Check ID: events_rule_network_security_group_changes
Provider: Oracle Cloud (OCI)
Service: events
Severity: MEDIUM
Categories: logging
Resource type: EventRule

What this check verifies

OCI Events rules targeting Network Security Group (NSG) changes are evaluated for notification actions. Monitored events: createnetworksecuritygroup, updatenetworksecuritygroup, deletenetworksecuritygroup, and changenetworksecuritygroupcompartment under com.oraclecloud.virtualnetwork.

Risk

Absent notifications for NSG changes enable silent policy drift.

Confidentiality: permissive edits can expose services and drive data exfiltration.
Integrity: attackers can reroute traffic or bypass micro-segmentation.
Availability: deletions/misconfigurations may isolate workloads or widen DDoS exposure.

Recommendation

Implement Events rules for NSG lifecycle changes with notification actions to a monitored topic/SIEM.

Include createnetworksecuritygroup, updatenetworksecuritygroup, deletenetworksecuritygroup, changenetworksecuritygroupcompartment
Enforce least privilege and separation of duties on NSG and Events admins
Regularly test and tune alerts

Remediation

CLI
Terraform
Dashboard steps

oci events rule create --compartment-id <compartment_ocid> --display-name <example_resource_name> --condition '{"eventType":["com.oraclecloud.virtualnetwork.changenetworksecuritygroupcompartment","com.oraclecloud.virtualnetwork.createnetworksecuritygroup","com.oraclecloud.virtualnetwork.deletenetworksecuritygroup","com.oraclecloud.virtualnetwork.updatenetworksecuritygroup"]}' --actions '{"actions":[{"actionType":"ONS","topicId":"<topic_ocid>"}]}'

resource "oci_events_rule" "example" {
  compartment_id = var.compartment_id
  display_name   = "<example_resource_name>"

  # Critical: Monitor NSG change events to satisfy the check
  condition = jsonencode({
    eventType = [
      "com.oraclecloud.virtualnetwork.changenetworksecuritygroupcompartment", # Required NSG event
      "com.oraclecloud.virtualnetwork.createnetworksecuritygroup",            # Required NSG event
      "com.oraclecloud.virtualnetwork.deletenetworksecuritygroup",            # Required NSG event
      "com.oraclecloud.virtualnetwork.updatenetworksecuritygroup"             # Required NSG event
    ]
  })

  actions {
    actions {
      action_type = "ONS"                 # Critical: Notification action required
      topic_id    = var.topic_id           # Sends notifications to this topic
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = events_rule_network_security_group_changes. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Event rule for network gateway changes has notifications Event rule for route table changes has notifications

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires