Check ID: events_rule_security_list_changes
Provider: Oracle Cloud (OCI)
Service: events
Severity: HIGH
Categories: logging
Resource type: EventRule
What this check verifies
OCI Events rules for VCN security lists monitor lifecycle changes-create, update, delete, and compartment moves-and include notification actions. The evaluation looks for rules that filter these events and confirms a configured notification target.
Risk
Without timely alerts on security list changes, unauthorized rule edits can expose subnets to the Internet, enabling scans, brute force, and lateral movement (confidentiality), permit traffic manipulation (integrity), or block ports causing outages (availability). Delayed detection widens blast radius.
Recommendation
Define Events rules for security list create/update/delete and route them to Notifications or automated responders. Enforce least privilege for network and Events admins, apply change control with logging, cover critical compartments/regions, and periodically test alerts for reliability.
CLI
Terraform
Dashboard steps
oci events rule create --compartment-id <example_resource_id> --display-name <example_resource_name> --condition '{"eventType":["com.oraclecloud.virtualnetwork.changesecuritylistcompartment","com.oraclecloud.virtualnetwork.createsecuritylist","com.oraclecloud.virtualnetwork.deletesecuritylist","com.oraclecloud.virtualnetwork.updatesecuritylist"]}' --actions '{"actions":[{"actionType":"ONS","topicId":"<example_resource_id>","isEnabled":true}]}'
resource "oci_events_rule" "<example_resource_name>" {
compartment_id = "<example_resource_id>"
display_name = "<example_resource_name>"
is_enabled = true
# Critical: monitor security list change event types required by the check
# This ensures the rule matches the specific VCN Security List events
condition = jsonencode({
eventType = [
"com.oraclecloud.virtualnetwork.changesecuritylistcompartment",
"com.oraclecloud.virtualnetwork.createsecuritylist",
"com.oraclecloud.virtualnetwork.deletesecuritylist",
"com.oraclecloud.virtualnetwork.updatesecuritylist"
]
})
actions {
actions {
action_type = "ONS" # Critical: add notification action
topic_id = "<example_resource_id>" # ONS topic OCID to send notifications
is_enabled = true # Ensure notifications are sent
}
}
}
- In OCI Console, go to Observability & Management > Events Service > Rules
- Click Create rule, set a name and compartment
- In Condition, set Event Type to include exactly:
- com.oraclecloud.virtualnetwork.changesecuritylistcompartment
- com.oraclecloud.virtualnetwork.createsecuritylist
- com.oraclecloud.virtualnetwork.deletesecuritylist
- com.oraclecloud.virtualnetwork.updatesecuritylist
- Click Add action, choose Notifications, select an existing topic
- Ensure the action is enabled and click Create
References
Where this check fires
This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = events_rule_security_list_changes. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Oracle Cloud (OCI) checks
