Security monitoring, logging, and compliance
This domain tests whether you can detect, investigate, and retain security-relevant activity across OCI. It covers Audit, Logging, Service Connector Hub, Events, Notifications, Cloud Guard, Security Zones, Vulnerability Scanning, and compliance posture.
Core rules
- OCI Audit records API calls against resources and is retained for 90 days by default. For longer retention, export or stream audit records to Object Storage or Streaming through Service Connector Hub.
- Logging organizes logs into log groups. You can enable service logs, audit logs, and custom logs, then search them. Agent configurations collect host logs and metrics.
- Service Connector Hub moves data from a source such as Logging or Audit to a destination such as Object Storage, Streaming, Functions, Notifications, or Monitoring. It is the standard bridge for long-term retention and automated response.
- Events react to resource state changes; Notifications delivers messages. Use them for near-real-time alerts, not for historical forensics.
- Cloud Guard monitors targets with detector recipes and can trigger responder recipes. Problems represent detected posture or threat issues; a responder can act, but detection alone does not remediate.
- Security Zones enforce maximum-security policy in a compartment; Vulnerability Scanning Service scans hosts and containers; Data Safe assesses database security. Compliance programs and CIS benchmarks provide control mappings.
Worked example
Audit must be retained for one year. Audit's built-in 90-day window is insufficient. Create an Object Storage bucket with a lifecycle policy, then a Service Connector Hub connector from the Audit source to that bucket. Reasoning: the connector continuously copies audit records; the bucket lifecycle policy controls cost and retention. Do not rely on the Logging console's default retention, and do not assume Cloud Guard stores raw audit history; it reports problems.
Traps
Assuming Audit keeps logs indefinitely; enabling a log but never creating a connector for retention; using Events as a log archive; treating Cloud Guard problems as automatic fixes; and applying a Security Zone to an existing compartment without checking unsupported services.