Back to Checks
oraclecloud

Event rule monitoring network security group changes has notification actions configured

events_rule_network_security_group_changes
Service: eventsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:EventRule

OCI Events rules targeting Network Security Group (NSG) changes are evaluated for notification actions. Monitored events: createnetworksecuritygroup, updatenetworksecuritygroup, deletenetworksecuritygroup, and changenetworksecuritygroupcompartment under com.oraclecloud.virtualnetwork.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Absent notifications for NSG changes enable silent policy drift.

  • Confidentiality: permissive edits can expose services and drive data exfiltration.
  • Integrity: attackers can reroute traffic or bypass micro-segmentation.
  • Availability: deletions/misconfigurations may isolate workloads or widen DDoS exposure.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks events_rule_network_security_group_changes

Recommendation

Implement Events rules for NSG lifecycle changes with notification actions to a monitored topic/SIEM.

  • Include createnetworksecuritygroup, updatenetworksecuritygroup, deletenetworksecuritygroup, changenetworksecuritygroupcompartment
  • Enforce least privilege and separation of duties on NSG and Events admins
  • Regularly test and tune alerts

Remediation

CLI

oci events rule create --compartment-id <compartment_ocid> --display-name <example_resource_name> --condition '{"eventType":["com.oraclecloud.virtualnetwork.changenetworksecuritygroupcompartment","com.oraclecloud.virtualnetwork.createnetworksecuritygroup","com.oraclecloud.virtualnetwork.deletenetworksecuritygroup","com.oraclecloud.virtualnetwork.updatenetworksecuritygroup"]}' --actions '{"actions":[{"actionType":"ONS","topicId":"<topic_ocid>"}]}'

Terraform

resource "oci_events_rule" "example" {
  compartment_id = var.compartment_id
  display_name   = "<example_resource_name>"

  # Critical: Monitor NSG change events to satisfy the check
  condition = jsonencode({
    eventType = [
      "com.oraclecloud.virtualnetwork.changenetworksecuritygroupcompartment", # Required NSG event
      "com.oraclecloud.virtualnetwork.createnetworksecuritygroup",            # Required NSG event
      "com.oraclecloud.virtualnetwork.deletenetworksecuritygroup",            # Required NSG event
      "com.oraclecloud.virtualnetwork.updatenetworksecuritygroup"             # Required NSG event
    ]
  })

  actions {
    actions {
      action_type = "ONS"                 # Critical: Notification action required
      topic_id    = var.topic_id           # Sends notifications to this topic
    }
  }
}

Other

1In the OCI Console, go to Observability & Management > Events Service > Rules
2Click Create rule
3Set Display name and Compartment
4Under Conditions, add Event types:
5- com.oraclecloud.virtualnetwork.changenetworksecuritygroupcompartment
6- com.oraclecloud.virtualnetwork.createnetworksecuritygroup
7- com.oraclecloud.virtualnetwork.deletenetworksecuritygroup
8- com.oraclecloud.virtualnetwork.updatenetworksecuritygroup
9Under Actions, click Add action > Notifications, select Publish to topic, choose the ONS topic
10Click Create to save the rule

Check Code

"""Check Ensure a notification is configured for network security group changes."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.events.events_client import events_client
from prowler.providers.oraclecloud.services.events.lib.helpers import (
    check_event_rule_has_notification_actions,
    filter_rules_by_event_types,
)


class events_rule_network_security_group_changes(Check):
    """Check Ensure a notification is configured for network security group changes."""

    def execute(self) -> Check_Report_OCI:
        """Execute the events_rule_network_security_group_changes check."""
        findings = []

        # Required event types for network security group changes
        required_event_types = [
            "com.oraclecloud.virtualnetwork.changenetworksecuritygroupcompartment",
            "com.oraclecloud.virtualnetwork.createnetworksecuritygroup",
            "com.oraclecloud.virtualnetwork.deletenetworksecuritygroup",
            "com.oraclecloud.virtualnetwork.updatenetworksecuritygroup",
        ]

        # Filter rules that monitor network security group changes
        matching_rules = filter_rules_by_event_types(
            events_client.rules, required_event_types
        )

        # Create findings for each matching rule
        for rule, _ in matching_rules:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=rule,
                region=rule.region,
                resource_name=rule.name,
                resource_id=rule.id,
                compartment_id=rule.compartment_id,
            )

            # Check if the rule has notification actions
            if check_event_rule_has_notification_actions(rule):
                report.status = "PASS"
                report.status_extended = f"Event rule '{rule.name}' is configured to monitor network security group changes with notifications."
            else:
                report.status = "FAIL"
                report.status_extended = f"Event rule '{rule.name}' monitors network security group changes but does not have notification actions configured."

            findings.append(report)

        # If no matching rules found, create a single FAIL finding
        if not findings:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource={},
                region="global",
                resource_name="Network Security Group Changes Event Rule",
                resource_id=events_client.audited_tenancy,
                compartment_id=events_client.audited_tenancy,
            )
            report.status = "FAIL"
            report.status_extended = (
                "No event rules configured to monitor network security group changes."
            )
            findings.append(report)

        return findings

References