cloud Guard (SPM management)

Lab Objective

Configure OCI Cloud Guard for Security Posture Management, create a monitored target, review detector rules, identify a security problem, and process the problem using an appropriate remediation action. What is OCI Cloud Guard? OCI Cloud Guard is a cloud-native security service that continuously monitors OCI resources and activities to identify security weaknesses, misconfigurations, and potentially risky activity. It provides a centralized view of the security posture of OCI resources and can recommend or automate corrective actions.

What is Security Posture Management? Security Posture Management focuses on continuously checking the cloud environment against security best practices and identifying configurations that could introduce risk.

For example:

Publicly accessible resource Weak IAM configuration Missing MFA Insecure network configuration Risky user activity Cloud Guard can detect these conditions and generate security problems.

Important Cloud Guard Components

1. Target

A Target defines the scope of resources that Cloud Guard monitors.

For example:

Root Compartment
      |
      +-- Production
      |
      +-- Development
      |
      +-- Security

You can configure Cloud Guard to monitor the root compartment and its child compartments or a more limited scope.

2. Detector Recipe

A detector recipe contains rules that Cloud Guard uses to identify security problems.

There are Oracle-managed and user-managed recipes.

Examples include rules for:

Public resources IAM/MFA issues Network configuration Object Storage exposure Suspicious activity 3. Problem

When a detector identifies a security issue, Cloud Guard creates a Problem.

Example:

Detector Rule
     ↓
Public Object Storage Bucket detected
     ↓
Cloud Guard Problem
     ↓
Risk information + affected resource

4. Responder Recipe

A responder defines what action Cloud Guard can take when a problem is detected.

Responses can include:

Notification Corrective/remediation action Automatic response User-confirmed response Oracle notes that responder activity is logged as OCI Audit events.