Checks

Oracle Analytics Cloud endpoints are evaluated for network exposure. Public endpoints must use restricted allowlists of specific IPs/CIDRs; presence of 0.0.0.0/0 or no allowed sources indicates unrestricted access. Instances using a VCN/private endpoint or public endpoints limited to specific sources align with the intended exposure model.

OCI Audit configuration defines tenancy-wide log retention for audit events. The finding evaluates whether the retention period (days) is >= 365 and that an audit configuration exists, applying across all regions and compartments.

OCI block volumes use Customer-Managed Keys (CMK) from Vault for at-rest encryption instead of Oracle-managed keys.

Identifies whether a block volume has a customer-managed key associated for its encryption.

Boot volumes use customer-managed keys (CMEK) when a Vault key is assigned (kms_key_id present), rather than default Oracle-managed encryption.

OCI Cloud Guard status in the tenancy's root compartment is evaluated, expecting ENABLED to indicate the service is active for organization-wide detection and response.

OCI compute instances are evaluated for in-transit encryption on paravirtualized block or boot volume attachments, confirming that data exchanged between the instance and attached volumes is encrypted during transfer.

OCI compute instance metadata service is configured so legacy IMDS v1 endpoints are disabled, requiring session-authorized IMDS v2 requests for metadata access

OCI compute instances have UEFI Secure Boot enabled so the platform firmware loads only trusted, signed bootloaders, kernels, and drivers at startup.

OCI Autonomous Database (shared) network exposure is evaluated: instances are treated as restricted when using a VCN private endpoint or when ACLs allow only specified IPs/VCNs. It identifies configurations with no ACL and no VCN, or ACLs permitting 0.0.0.0/0.

OCI Notifications is evaluated for the existence of at least one topic that has one or more subscriptions.

The focus is on whether subscribed endpoints are present to receive Events and monitoring alerts.

OCI Events rules subscribe to Cloud Guard problem lifecycle events-com.oraclecloud.cloudguard.problemdetected, com.oraclecloud.cloudguard.problemdismissed, and com.oraclecloud.cloudguard.problemremediated-and include notification actions. When Cloud Guard sets a reporting region, rules are expected in that region.

OCI Events rules monitor IAM group lifecycle events (creategroup, updategroup, deletegroup) and include notification actions to generate alerts when these changes occur.

OCI Events rules configured to capture IAM policy create, update, and delete events (com.oraclecloud.identitycontrolplane.createpolicy, com.oraclecloud.identitycontrolplane.updatepolicy, com.oraclecloud.identitycontrolplane.deletepolicy) and include a notification action.

OCI Events rules monitor IAM identity provider creation, update, and deletion and include a notification action. The evaluation identifies rules that filter these events and route matching activity to a notification destination.

OCI Events rules monitor IdP group mapping changes with notification actions for com.oraclecloud.identitycontrolplane.addidpgroupmapping, com.oraclecloud.identitycontrolplane.removeidpgroupmapping, and com.oraclecloud.identitycontrolplane.updateidpgroupmapping.

OCI Events rules targeting com.oraclecloud.identitysignon.interactivelogin are assessed for configured notification actions to monitor local user interactive sign-ins. Rules are compartment-scoped and can cover child compartments.

OCI Events rules monitor network gateway lifecycle and attachment changes (DRG, Internet, NAT, Service, and Local Peering gateways) and include notification actions so changes generate alerts.

The evaluation looks for rules filtered to these events and confirms they trigger notifications.

OCI Events rules targeting Network Security Group (NSG) changes are evaluated for notification actions. Monitored events: createnetworksecuritygroup, updatenetworksecuritygroup, deletenetworksecuritygroup, and changenetworksecuritygroupcompartment under com.oraclecloud.virtualnetwork.

OCI Events rules for VCN route tables monitor lifecycle and compartment changes and include notification actions.

The evaluation looks for rules that capture create, update, delete, and changeCompartment events for route tables and send notifications.

OCI Events rules for VCN security lists monitor lifecycle changes-create, update, delete, and compartment moves-and include notification actions. The evaluation looks for rules that filter these events and confirms a configured notification target.

OCI Events rules targeting IAM user changes (e.g., com.oraclecloud.identitycontrolplane.createuser and related update/delete/state events) are assessed for attached notification actions.

The finding indicates which rules listen for these events and whether they are configured to emit alerts.

OCI Events rules exist to capture VCN lifecycle changes (create, update, delete) via event types com.oraclecloud.virtualnetwork.createvcn, com.oraclecloud.virtualnetwork.updatevcn, com.oraclecloud.virtualnetwork.deletevcn, and include notification actions.

OCI File Storage file systems use Customer-Managed Keys (CMEK) for encryption when a KMS key is associated, instead of the default Oracle-managed encryption.

OCI IAM policies granting manage/use on groups or users in the tenancy are evaluated for a condition that excludes the Administrators group, such as target.group.name != 'Administrators'.

Policies missing this restriction are identified.