Implementing OCI Logging Analytics for Proactive Incident Detection

Oracle Cloud Infrastructure (OCI) Logging Analytics is a powerful service that helps organizations aggregate, analyze, and act on log data from across their OCI resources. In this guide, we’ll walk through setting up Logging Analytics to detect and alert on suspicious activities, using Terraform for automation and a real-world example for context.

Step 1: Enable OCI Logging Analytics

1. Navigate to the OCI Console:
   Go to Observability & Management > Logging Analytics.

2. Create a Log Group:

oci logging-analytics log-group create \
  --compartment-id <your-compartment-ocid> \
  --display-name "Security-Logs" \
  --description "Logs for security monitoring"

Step 2: Ingest Logs from OCI Audit Service
Configure the OCI Audit service to forward logs to Logging Analytics:

Create a Service Connector:

resource "oci_sch_service_connector" "audit_to_la" {
  compartment_id = var.compartment_ocid
  display_name  = "Audit-to-Logging-Analytics"
  source {
    kind = "logging"
    log_sources {
      compartment_id = var.tenant_ocid
      log_group_id   = oci_logging_log_group.audit_logs.id
    }
  }
  target {
    kind = "loggingAnalytics"
    log_group_id = oci_logging_analytics_log_group.security_logs.id
  }
}

Step 3: Create Custom Detection Rules

Example: Detect repeated failed login attempts (brute-force attacks).

1. Use OCI Query Language (OCIQL):

SELECT * 
FROM AuditLogs 
WHERE eventName = 'Login' AND action = 'FAIL' 
GROUP BY actorName 
HAVING COUNT(*) > 5

1. Set Up Alerts:
   Configure an OCI Notification topic to trigger emails or PagerDuty alerts when the rule matches.

Step 4: Visualize with Dashboards

Create a dashboard to monitor security events:

• Metrics: Failed logins, API calls from unusual IPs.

Enjoy
Osama