OracleCloudInfrastructureEventCollector

Collects audit log events from Oracle Cloud Infrastructure resources.

Analytics & SIEM · Oracle Cloud Infrastructure (OCI)

Details

IDOracleCloudInfrastructureEventCollector
ProviderOracle
CategoryAnalytics & SIEM
From Version6.10.0
Docker Imagedemisto/oci:1.0.0.10133006
Supported ModulesXSIAM

README

This integration fetches audit log events from an Oracle Cloud Infrastructure resources.
Audit log events can be used for security audits, to track usage of and changes to Oracle Cloud Infrastructure resources, and to help ensure compliance with standards or regulations.

Required Permissions

Required Permissions for collecting audit logs
Required IAM policy for collecting audit logs
Oracle Cloud Infrastructure Audit API Endpoints (available Regions)

Configure Oracle Cloud Infrastructure Event Collector in Cortex

OCI Related Parameters

Oracle Cloud Infrastructure SDKs and CLI require basic configuration information, which is achieved by using configuration parameters either with a configuration file or a runtime defined configuration dictionary. This integration uses the runtime defined configuration dictionary.
More about OCI configuration here.

Parameter Description Required
Tenancy OCID OCID of your tenancy. To get the value, see Required Keys and OCIDs. True
User OCID OCID of the user calling the API. To get the value, see Required Keys and OCIDs.
Example: ocid1.user.oc1..		 True
API Key Fingerprint Fingerprint for the public key that was added to this user. To get the value, see Required Keys and OCIDs. True
Private Key Private Key for authentication.
Important: The key pair must be in PEM format. For instructions on generating a key pair in PEM format, see Required Keys and OCIDs.		 True
API Private Key Type The type of the private key. The possible values are: PKCS#1 and PKCS#8. The default value is PKCS#8. A link explaining the difference between the 2 types see link False
Region An Oracle Cloud Infrastructure region. See Regions and Availability Domains.
Example: us-ashburn-1		 True
Compartment OCID An Oracle Cloud Identifier compartment. The default value is the Tenancy OCID parameter. See Finding the OCID of a Compartment. False
Events types to fetch The type of the events to fetch. Default value is ‘Audit’. True
Search log query Query corresponding to the search operation. False
First fetch time First fetch time (< number > < time unit >, e.g., 12 hours, 1 day, 3 months). Default is 3 days. This parameter is relevant for ‘Audit’ events only. False
Trust any certificate (not secure) Use SSL secure connection or ‘None’. False
User system proxy settings Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration. False

Commands

You can execute the following command from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

oracle-cloud-infrastructure-get-events

Manual command to fetch and display events.

Base Command

oracle-cloud-infrastructure-get-events

Input

Argument Name Description Required
should_push_events Set this argument to true in order to create events, otherwise the command will only display them. Default is false. True

Configuration parameters

  • tenancy_ocid — Tenancy OCID (required)
  • user_ocid — User OCID (required)
  • credentials — API Key Fingerprint (required)
  • private_key_type — API Private Key Type
  • region — Region (required)
  • compartment_id — Compartment OCID
  • isFetchEvents — Fetch Events
  • eventFetchInterval — Events Fetch Interval
  • first_fetch — First fetch time
  • max_fetch — Maximum number of events to fetch per type.
  • event_types_to_fetch — Event types to fetch (required)
  • search_log_query — Search log query
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (1)

  • oracle-cloud-infrastructure-get-events

    Manual command to fetch and display events.

Source

OracleCloudInfrastructureEventCollector.py OracleCloudInfrastructureEventCollector_test.py OracleCloudInfrastructureEventCollector.yml OracleCloudInfrastructureEventCollector_description.md
Download History Raw 
#### OCI Related Parameters
Oracle Cloud Infrastructure SDKs and CLI require basic configuration information, which is achieved by using configuration parameters either with a configuration file or a runtime defined configuration dictionary. This integration uses the runtime defined configuration dictionary.
Read more about OCI configuration [here](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/sdkconfig.htm).

| **Parameter**                                                           | **Description**                                                                           |
|-------------------------------------------------------------------------|-------------------------------------------------------------------------------------------|
| Tenancy OCID                                                              | OCID of your tenancy. To get the value, see [Required Keys and OCIDs](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm#Required_Keys_and_OCIDs). <br>   Example: ocid1.tenancy.oc1..<unique_ID>                                              | 
| User OCID                                                       | OCID of the user calling the API. To get the value, see [Required Keys and OCIDs](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm#Required_Keys_and_OCIDs). <br> Example: ocid1.user.oc1..<unique_ID> | 
| API Key Fingerprint                                                                   | Fingerprint for the public key that was added to this user. To get the value, see [Required Keys and OCIDs](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm#Required_Keys_and_OCIDs).                                                                  | 
| Private Key                                                                 | Private Key for authentication. <br> Important: The key pair must be in PEM format. For instructions on generating a key pair in PEM format, see [Required Keys and OCIDs](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/apisigningkey.htm#Required_Keys_and_OCIDs).                                                                       | 
| Region                                               | An Oracle Cloud Infrastructure region. See [Regions and Availability Domains](https://docs.oracle.com/en-us/iaas/Content/General/Concepts/regions.htm#top). <br> Example: us-ashburn-1          | True         |

#### API References

[Oracle Cloud Infrastructure Audit Logs API documentation](https://docs.oracle.com/en-us/iaas/Content/Logging/Concepts/audit_logs.htm)

[Oracle Cloud Infrastructure SearchLogsDetails API documentation](https://docs.oracle.com/en-us/iaas/api/#/en/logging-search/20190909/datatypes/SearchLogsDetails)

<br>
[Oracle Cloud Infrastructure Audit API Endpoints (available Regions)](https://docs.oracle.com/en-us/iaas/api/#/en/audit/20190901)