Back to Checks
oraclecloud

Event rule monitoring local OCI user authentication has notification actions configured

events_rule_local_user_authentication
Service: eventsSeverity: medium
OfficialBuilt-inVerified
Categories:threat-detection
Resource Type:EventRule

OCI Events rules targeting com.oraclecloud.identitysignon.interactivelogin are assessed for configured notification actions to monitor local user interactive sign-ins. Rules are compartment-scoped and can cover child compartments.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Without alerts on local sign-ins, account takeovers and brute-force attempts can go unnoticed. Attackers with local access can exfiltrate data (confidentiality), change configurations (integrity), and disrupt services (availability), delaying detection and response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks events_rule_local_user_authentication

Recommendation

Create an Events rule for com.oraclecloud.identitysignon.interactivelogin with notification actions delivering real-time alerts to monitored channels or workflows. Integrate with a SIEM, tune filters to reduce noise, and apply least privilege and defense in depth to limit local account exposure.

Remediation

CLI

oci events rule create --display-name <example_resource_name> --is-enabled true --condition '{"eventType":["com.oraclecloud.identitysignon.interactivelogin"]}' --compartment-id <example_resource_id> --actions '{"actions":[{"actionType":"ONS","isEnabled":true,"topicId":"<example_resource_id>"}]}'

Terraform

resource "oci_events_rule" "example" {
  display_name   = "<example_resource_name>"
  is_enabled     = true
  compartment_id = "<example_resource_id>"

  # Critical: filter for local OCI user authentication events
  condition = jsonencode({ eventType = ["com.oraclecloud.identitysignon.interactivelogin"] })

  actions {
    actions {
      # Critical: ONS notification action to a topic
      action_type = "ONS"
      is_enabled  = true
      topic_id    = "<example_resource_id>"
    }
  }
}

Other

1In the OCI Console, go to Application Integration > Events Service > Rules
2Click Create rule
3Set Name and select the target Compartment
4In Condition, set Event Type to: com.oraclecloud.identitysignon.interactivelogin
5Add Action: choose Notifications, select the Topic, and ensure it is Enabled
6Click Create

Check Code

"""Check Ensure a notification is configured for Local OCI User Authentication."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.events.events_client import events_client
from prowler.providers.oraclecloud.services.events.lib.helpers import (
    check_event_rule_has_notification_actions,
    filter_rules_by_event_types,
)


class events_rule_local_user_authentication(Check):
    """Check Ensure a notification is configured for Local OCI User Authentication."""

    def execute(self) -> Check_Report_OCI:
        """Execute the events_rule_local_user_authentication check."""
        findings = []

        # Required event type for user authentication
        required_event_types = ["com.oraclecloud.identitysignon.interactivelogin"]

        # Filter rules that monitor user authentication
        matching_rules = filter_rules_by_event_types(
            events_client.rules, required_event_types
        )

        # Create findings for each matching rule
        for rule, _ in matching_rules:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=rule,
                region=rule.region,
                resource_name=rule.name,
                resource_id=rule.id,
                compartment_id=rule.compartment_id,
            )

            # Check if the rule has notification actions
            if check_event_rule_has_notification_actions(rule):
                report.status = "PASS"
                report.status_extended = f"Event rule '{rule.name}' is configured to monitor local OCI user authentication with notifications."
            else:
                report.status = "FAIL"
                report.status_extended = f"Event rule '{rule.name}' monitors local OCI user authentication but does not have notification actions configured."

            findings.append(report)

        # If no matching rules found, create a single FAIL finding
        if not findings:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource={},
                region="global",
                resource_name="Local User Authentication Event Rule",
                resource_id=events_client.audited_tenancy,
                compartment_id=events_client.audited_tenancy,
            )
            report.status = "FAIL"
            report.status_extended = (
                "No event rules configured to monitor local OCI user authentication."
            )
            findings.append(report)

        return findings

References