Oracle VSS is a free service, that should be used by all OCI customers if they don’t have any implementation of Vulnerability Management in their tenancy. To start using the service you first need to create the proper IAM Policy that will allow the service to interact with OCI Compute…

If you plan to create your own Security Operation Center using open-source solutions, one of the best Threat Detection and Monitoring, threat hunting, enterprise security monitoring, and log management is Security Onion. In this guide I will show you how to manually install Security Onion, and how to add an…

Last week Oracle announced the General Availability of VTAP in OCI. Oracle now has a VTAP service in your VCNs - Oracle Cloud Infrastructure Release Notes Today, Oracle launches the Virtual Testing Access Point (VTAP) service in OCI. VTAP functionality, sometimes referred…docs.oracle.com Using OCI documentation I have mirrored the traffic from my fresh Honeypot instance to my previously created Security Onion Instance.

One of the features of the logging service is the ability to collect logs directly from the running instance using the existing Oracle Cloud Agent. The only thing you need to do is to enable the Custom Agent Plug-in and create an Agent Configuration. Custom Logs Diagnostic information from custom…

If you want to get the logs from OCI Content and management, at this point the only way to do it is by using Rest API’s. This 2 links are very useful to achieve this: REST API for Activity Log — All REST Endpoints (oracle.com) Integrate with Oracle Content Management…

In my previous blog I have shown how you can enable Custom Logs in OCI using Logging Service. In this blog I will show you how to send these Custom Logs to OCI Logging Analytics and prepare for Threat Hunting using Windows Event ID. After the Custom logs were enabled…

Recently Oracle lunched a new Recipe called Insight. With this service you will be able to leverage the OCI logging service Search Options and also the advanced Threat detection Engine from Cloud Guard. Getting Started with Data Sources (oracle.com) In this blog entry I will try to showcase how easy…

Logs are important because if they are properly configured , they can provide information that usually can be missed. For Windows Instances, beside the normal Events, Sysmon is my preferred solution to enrich the Windows logs, but this will be part of a different blog entry. One of the blogs…

On my previous blog entry, I have shown how to leverage AuditD data in OCI Logging service. Now I will use the OCI Logging Service search option to create some MITRE ATT&CK Searches that will be used by Cloud Guard Insight Rules. From this rule mapping and the Attack Rules…

Today, one of my colleagues asked me if I know this application from OCI Marketplace: Oracle Cloud Infrastructure Edit descriptioncloud.oracle.com Until today, I was using the manual steps, but it looks like that Oracle created a solution here too: Secure and monitor Oracle Identity Cloud Service You can leverage the new Logging Analytics Service with other Oracle Cloud Infrastructure (OCI) services to obtain…docs.oracle.com

This blog is a very short one, as it’s main purpose is to install Sysmon and add additional monitoring events and variable to my OCI Logging Lab. To do this I followed the sysmon page entry, and worked like a charm: Download Sysmon (or entire Sysinternals suite) Download your chosen configuration (You can start with Sysmon Modular as it already has some MITRE ATT&CK techniques) Save as config.xml in c:\windows, or run the PowerShell command:

If you haven’t enabled OCI Logging Analytics yet in your tenancy, then now it’s time to do it. You will have a 10GB log ingestion free of charge, that you can use for fast troubleshooting of the ingested logs. As always the first step is to create the proper policies…

In my previous blog entries, I have described how to install Sysmon and how to get the Windows Events directly to Logging Analytics using OCI Management Agent. Now you are able to get the main windows events channels in Logging Analytics. …

In my previous blog I have showcased how easy is to install Security Onion in OCI. How to install Security Onion on OCI If you plan to create your own Security Operation Center using open-source solutions, one of the best Threat Detection…learnoci.cloud Now, I will prepare a step-by-step guide in how to add the OCI metrics into Security Onion Grafana Module. Some useful links I have used to prepare this:

One of the main advantages of running Oracle Databases in OCI, besides the automation, performance and advance functions, is also that you get Data Safe free of charge. As a short resume, Oracle Data Safe is a unified control center for your Oracle databases which helps you understand the sensitivity…

This is a short guide on how to collect logs from an Oracle Linux Instance, by installing the OCI Management Agent. This works for any Red Hat compatible kernel running on OCI, On-Premise or any cloud provider. Prequisites for this can be seen here: Perform Prerequisites for Deploying Management Agents…