Back to Checks
oraclecloud

Event rule monitoring security list changes has notification actions configured

events_rule_security_list_changes
Service: eventsSeverity: high
OfficialBuilt-inVerified
Categories:logging
Resource Type:EventRule

OCI Events rules for VCN security lists monitor lifecycle changes-create, update, delete, and compartment moves-and include notification actions. The evaluation looks for rules that filter these events and confirms a configured notification target.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Without timely alerts on security list changes, unauthorized rule edits can expose subnets to the Internet, enabling scans, brute force, and lateral movement (confidentiality), permit traffic manipulation (integrity), or block ports causing outages (availability). Delayed detection widens blast radius.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks events_rule_security_list_changes

Recommendation

Define Events rules for security list create/update/delete and route them to Notifications or automated responders. Enforce least privilege for network and Events admins, apply change control with logging, cover critical compartments/regions, and periodically test alerts for reliability.

Remediation

CLI

oci events rule create --compartment-id <example_resource_id> --display-name <example_resource_name> --condition '{"eventType":["com.oraclecloud.virtualnetwork.changesecuritylistcompartment","com.oraclecloud.virtualnetwork.createsecuritylist","com.oraclecloud.virtualnetwork.deletesecuritylist","com.oraclecloud.virtualnetwork.updatesecuritylist"]}' --actions '{"actions":[{"actionType":"ONS","topicId":"<example_resource_id>","isEnabled":true}]}'

Terraform

resource "oci_events_rule" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"
  display_name   = "<example_resource_name>"
  is_enabled     = true

  # Critical: monitor security list change event types required by the check
  # This ensures the rule matches the specific VCN Security List events
  condition = jsonencode({
    eventType = [
      "com.oraclecloud.virtualnetwork.changesecuritylistcompartment",
      "com.oraclecloud.virtualnetwork.createsecuritylist",
      "com.oraclecloud.virtualnetwork.deletesecuritylist",
      "com.oraclecloud.virtualnetwork.updatesecuritylist"
    ]
  })

  actions {
    actions {
      action_type = "ONS"                 # Critical: add notification action
      topic_id    = "<example_resource_id>" # ONS topic OCID to send notifications
      is_enabled  = true                   # Ensure notifications are sent
    }
  }
}

Other

1In OCI Console, go to Observability & Management > Events Service > Rules
2Click Create rule, set a name and compartment
3In Condition, set Event Type to include exactly:
4- com.oraclecloud.virtualnetwork.changesecuritylistcompartment
5- com.oraclecloud.virtualnetwork.createsecuritylist
6- com.oraclecloud.virtualnetwork.deletesecuritylist
7- com.oraclecloud.virtualnetwork.updatesecuritylist
8Click Add action, choose Notifications, select an existing topic
9Ensure the action is enabled and click Create

Check Code

"""Check Ensure a notification is configured for security list changes."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.events.events_client import events_client
from prowler.providers.oraclecloud.services.events.lib.helpers import (
    check_event_rule_has_notification_actions,
    filter_rules_by_event_types,
)


class events_rule_security_list_changes(Check):
    """Check Ensure a notification is configured for security list changes."""

    def execute(self) -> Check_Report_OCI:
        """Execute the events_rule_security_list_changes check."""
        findings = []

        # Required event types for security list changes
        required_event_types = [
            "com.oraclecloud.virtualnetwork.changesecuritylistcompartment",
            "com.oraclecloud.virtualnetwork.createsecuritylist",
            "com.oraclecloud.virtualnetwork.deletesecuritylist",
            "com.oraclecloud.virtualnetwork.updatesecuritylist",
        ]

        # Filter rules that monitor security list changes
        matching_rules = filter_rules_by_event_types(
            events_client.rules, required_event_types
        )

        # Create findings for each matching rule
        for rule, _ in matching_rules:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=rule,
                region=rule.region,
                resource_name=rule.name,
                resource_id=rule.id,
                compartment_id=rule.compartment_id,
            )

            # Check if the rule has notification actions
            if check_event_rule_has_notification_actions(rule):
                report.status = "PASS"
                report.status_extended = f"Event rule '{rule.name}' is configured to monitor security list changes with notifications."
            else:
                report.status = "FAIL"
                report.status_extended = f"Event rule '{rule.name}' monitors security list changes but does not have notification actions configured."

            findings.append(report)

        # If no matching rules found, create a single FAIL finding
        if not findings:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource={},
                region="global",
                resource_name="Security List Changes Event Rule",
                resource_id=events_client.audited_tenancy,
                compartment_id=events_client.audited_tenancy,
            )
            report.status = "FAIL"
            report.status_extended = (
                "No event rules configured to monitor security list changes."
            )
            findings.append(report)

        return findings

References