OracleCloudInfrastructureEventCollector

Collects audit log events from Oracle Cloud Infrastructure resources.

Analytics & SIEM · Oracle Cloud Infrastructure (OCI)

Details

ID	`OracleCloudInfrastructureEventCollector`
Provider	Oracle
Category	Analytics & SIEM
From Version	6.10.0
Docker Image	`demisto/oci:1.0.0.10133006`
Supported Modules	XSIAM

README

This integration fetches audit log events from an Oracle Cloud Infrastructure resources.
Audit log events can be used for security audits, to track usage of and changes to Oracle Cloud Infrastructure resources, and to help ensure compliance with standards or regulations.

Required Permissions

Required Permissions for collecting audit logs
Required IAM policy for collecting audit logs
Oracle Cloud Infrastructure Audit API Endpoints (available Regions)

Configure Oracle Cloud Infrastructure Event Collector in Cortex

OCI Related Parameters

Oracle Cloud Infrastructure SDKs and CLI require basic configuration information, which is achieved by using configuration parameters either with a configuration file or a runtime defined configuration dictionary. This integration uses the runtime defined configuration dictionary.
More about OCI configuration here.

Parameter	Description	Required
Tenancy OCID	OCID of your tenancy. To get the value, see Required Keys and OCIDs.	True
User OCID	OCID of the user calling the API. To get the value, see Required Keys and OCIDs. Example: ocid1.user.oc1..	True
API Key Fingerprint	Fingerprint for the public key that was added to this user. To get the value, see Required Keys and OCIDs.	True
Private Key	Private Key for authentication. Important: The key pair must be in PEM format. For instructions on generating a key pair in PEM format, see Required Keys and OCIDs.	True
API Private Key Type	The type of the private key. The possible values are: PKCS#1 and PKCS#8. The default value is PKCS#8. A link explaining the difference between the 2 types see link	False
Region	An Oracle Cloud Infrastructure region. See Regions and Availability Domains. Example: us-ashburn-1	True
Compartment OCID	An Oracle Cloud Identifier compartment. The default value is the Tenancy OCID parameter. See Finding the OCID of a Compartment.	False
Events types to fetch	The type of the events to fetch. Default value is ‘Audit’.	True
Search log query	Query corresponding to the search operation.	False
First fetch time	First fetch time (< number > < time unit >, e.g., 12 hours, 1 day, 3 months). Default is 3 days. This parameter is relevant for ‘Audit’ events only.	False
Trust any certificate (not secure)	Use SSL secure connection or ‘None’.	False
User system proxy settings	Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration.	False

Commands

You can execute the following command from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

oracle-cloud-infrastructure-get-events

Manual command to fetch and display events.

Base Command

oracle-cloud-infrastructure-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to true in order to create events, otherwise the command will only display them. Default is false.	True

Configuration parameters

tenancy_ocid — Tenancy OCID (required)
user_ocid — User OCID (required)
credentials — API Key Fingerprint (required)
private_key_type — API Private Key Type
region — Region (required)
compartment_id — Compartment OCID
isFetchEvents — Fetch Events
eventFetchInterval — Events Fetch Interval
first_fetch — First fetch time
max_fetch — Maximum number of events to fetch per type.
event_types_to_fetch — Event types to fetch (required)
search_log_query — Search log query
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

oracle-cloud-infrastructure-get-events
Manual command to fetch and display events.

Source

OracleCloudInfrastructureEventCollector.py OracleCloudInfrastructureEventCollector_test.py OracleCloudInfrastructureEventCollector.yml OracleCloudInfrastructureEventCollector_description.md

Download History Raw

category: Analytics & SIEM
provider: Oracle
sectionorder:
- Connect
- Collect
commonfields:
  id: OracleCloudInfrastructureEventCollector
  version: -1
configuration:
- display: Tenancy OCID
  name: tenancy_ocid
  required: true
  type: 0
  section: Connect
- display: User OCID
  name: user_ocid
  required: true
  type: 0
  section: Connect
- display: API Key Fingerprint
  displaypassword: API Private Key
  name: credentials
  required: true
  type: 9
  section: Connect
- display: API Private Key Type
  name: private_key_type
  options:
  - PKCS#1
  - PKCS#8
  type: 15
  section: Connect
  required: false
  advanced: true
  defaultvalue: PKCS#8
  additionalinfo: The default value is PKCS#8. For more information about the difference between the 2 types follow the link https://stackoverflow.com/questions/48958304/pkcs1-and-pkcs8-format-for-rsa-private-key
- display: Region
  name: region
  additionalinfo: Must be one the available regions for Oracle Cloud Infrastructure. For more information see the integration's description.
  required: true
  type: 0
  section: Connect
- display: Compartment OCID
  name: compartment_id
  additionalinfo: The default value is the Tenancy OCID parameter. In case a Compartment ID is given, it will override the default value. To get the value see the link https://docs.oracle.com/en-us/iaas/Content/GSG/Tasks/contactingsupport_topic-Locating_Oracle_Cloud_Infrastructure_IDs.htm#Finding_the_OCID_of_a_Compartment
  advanced: true
  required: false
  type: 0
  section: Connect
- display: Fetch Events
  defaultvalue: 'false'
  name: isFetchEvents
  type: 8
  required: false
  section: Collect
- display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  required: false
  section: Collect
  defaultvalue: '1'
- display: First fetch time
  additionalinfo: This parameter is relevant for 'Audit' events only.
  defaultvalue: 3 days
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Maximum number of events to fetch per type.
  name: max_fetch
  type: 0
  defaultvalue: 1000
  section: Collect
  required: false
- display: Event types to fetch
  name: event_types_to_fetch
  additionalinfo: The type of the events to fetch. Default value is 'Audit'.
  type: 16
  options:
  - Audit
  - Search Logs
  defaultvalue: Audit
  section: Collect
  required: true
- display: Search log query
  additionalinfo: Query corresponding to the search operation.
  name: search_log_query
  type: 0
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: Collects audit log events from Oracle Cloud Infrastructure resources.
display: Oracle Cloud Infrastructure Event Collector
name: OracleCloudInfrastructureEventCollector
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to true in order to create events, otherwise the command will only display them. Default is false.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    description: Manual command to fetch and display events.
    name: oracle-cloud-infrastructure-get-events
  dockerimage: demisto/oci:1.0.0.10133006
  isfetchevents: true
  script: '-'
  subtype: python3
  type: python
marketplaces:
- marketplacev2
- platform
fromversion: 6.10.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam