category: Analytics & SIEM
provider: Oracle
sectionorder:
- Connect
- Collect
commonfields:
  id: OracleCloudInfrastructureEventCollector
  version: -1
configuration:
- display: Tenancy OCID
  name: tenancy_ocid
  required: true
  type: 0
  section: Connect
- display: User OCID
  name: user_ocid
  required: true
  type: 0
  section: Connect
- display: API Key Fingerprint
  displaypassword: API Private Key
  name: credentials
  required: true
  type: 9
  section: Connect
- display: API Private Key Type
  name: private_key_type
  options:
  - PKCS#1
  - PKCS#8
  type: 15
  section: Connect
  required: false
  advanced: true
  defaultvalue: PKCS#8
  additionalinfo: The default value is PKCS#8. For more information about the difference between the 2 types follow the link https://stackoverflow.com/questions/48958304/pkcs1-and-pkcs8-format-for-rsa-private-key
- display: Region
  name: region
  additionalinfo: Must be one the available regions for Oracle Cloud Infrastructure. For more information see the integration's description.
  required: true
  type: 0
  section: Connect
- display: Compartment OCID
  name: compartment_id
  additionalinfo: The default value is the Tenancy OCID parameter. In case a Compartment ID is given, it will override the default value. To get the value see the link https://docs.oracle.com/en-us/iaas/Content/GSG/Tasks/contactingsupport_topic-Locating_Oracle_Cloud_Infrastructure_IDs.htm#Finding_the_OCID_of_a_Compartment
  advanced: true
  required: false
  type: 0
  section: Connect
- display: Fetch Events
  defaultvalue: 'false'
  name: isFetchEvents
  type: 8
  required: false
  section: Collect
- display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  required: false
  section: Collect
  defaultvalue: '1'
- display: First fetch time
  additionalinfo: This parameter is relevant for 'Audit' events only.
  defaultvalue: 3 days
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Maximum number of events to fetch per type.
  name: max_fetch
  type: 0
  defaultvalue: 1000
  section: Collect
  required: false
- display: Event types to fetch
  name: event_types_to_fetch
  additionalinfo: The type of the events to fetch. Default value is 'Audit'.
  type: 16
  options:
  - Audit
  - Search Logs
  defaultvalue: Audit
  section: Collect
  required: true
- display: Search log query
  additionalinfo: Query corresponding to the search operation.
  name: search_log_query
  type: 0
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: Collects audit log events from Oracle Cloud Infrastructure resources.
display: Oracle Cloud Infrastructure Event Collector
name: OracleCloudInfrastructureEventCollector
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to true in order to create events, otherwise the command will only display them. Default is false.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    description: Manual command to fetch and display events.
    name: oracle-cloud-infrastructure-get-events
  dockerimage: demisto/oci:1.0.0.10133006
  isfetchevents: true
  script: '-'
  subtype: python3
  type: python
marketplaces:
- marketplacev2
- platform
fromversion: 6.10.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam