Repository navigation
Lab: 70 Vulnerability scanning
Implement OCI Vulnerability Scanning to identify security vulnerabilities, missing OS patches, exposed ports, and configuration weaknesses across multiple OCI Compute instances.
This lab demonstrates how to configure IAM policies, create a scan recipe, configure a target, review scan reports, and plan remediation.
OCI Vulnerability Scanning Service (VSS) is a managed security service that scans supported Compute instances and Container Registry images for potential vulnerabilities.
“OCI Vulnerability Scanning is a managed security service that continuously scans Compute instances and container images for known vulnerabilities, missing patches, open ports, configuration weaknesses and CIS benchmark violations. We configure a scan recipe, associate it with a target containing one or multiple VMs, and review the generated findings by risk level with remediation guidance. However, it has platform and coverage limitations, so it should complement—not replace—other security and compliance toolsOCI Vulnerability Scanning Service (VSS) is a managed security service that scans supported Compute instances and Container Registry images for potential vulnerabilities.
Key capabilities:
- Detect known OS and application vulnerabilities.
- Identify missing security updates and patches.
- Detect open ports on Compute instances.
- Assess supported CIS security benchmarks.
- Generate vulnerability reports with risk levels and remediation information.
- Integrate with OCI Cloud Guard for centralized security visibility.
OCI Tenancy
|
v
IAM Policies
|
v
Vulnerability Scanning Service
|
v
Scan Recipe
(What to scan and how often)
|
v
Scan Target
(Which VMs to scan)
|
v
OCI Compute Instances
| | |
v v v
VM-01 VM-02 VM-03
|
v
Security Scan and Analysis
|
v
Scanning Reports
|
v
Critical / High / Medium / Low Findings
|
v
Patch, Remediate and Validate
Important concepts:
- IAM Policy: Defines permissions for administrators and the scanning service.
- Scan Recipe: Defines the scanning configuration and schedule.
- Scan Target: Identifies the Compute instances to scan.
- Scan Report: Contains the findings for an individual instance.
- Remediation: Fixes identified vulnerabilities and verifies the results.
Before starting the lab, ensure you have:
- An active OCI tenancy and access to the OCI Console.
- One or more supported Compute instances.
- Appropriate IAM permissions to manage Vulnerability Scanning resources.
- Supported operating system images and Oracle Cloud Agent compatibility for agent-based scanning.
- A Service Gateway and suitable route rule for instances in private subnets or without public IP addresses when required.
- Permission to review scanning reports.
OCI Vulnerability Scanning requires permissions for both the user managing the service and the service itself.
For example, to allow a group named SecurityAdmins to manage Vulnerability Scanning resources in a compartment named CloudSecurity, create this policy:
Allow group SecurityAdmins to manage vss-family in compartment CloudSecurity
Replace the group and compartment names with your actual OCI configuration.
The Vulnerability Scanning service needs permission to deploy the Oracle Cloud Agent and read the required Compute and VNIC information.
Example for a dedicated compartment:
Allow service vulnerability-scanning-service to manage instances in compartment CloudSecurity
Allow service vulnerability-scanning-service to read compartments in compartment CloudSecurity
Allow service vulnerability-scanning-service to read vnics in compartment CloudSecurity
Allow service vulnerability-scanning-service to read vnic-attachments in compartment CloudSecurity
To updated for root level use tanancy instead of root.
Allow group SecurityAdmins to manage vss-family in tenancy
Allow service vulnerability-scanning-service to manage instances in tenancy
Allow service vulnerability-scanning-service to read compartments in tenancy
Allow service vulnerability-scanning-service to read vnics in tenancy
Allow service vulnerability-scanning-service to read vnic-attachments in tenancy
Policy placement: Create policies in the appropriate policy compartment. Use the tenancy root when the permissions must apply across the tenancy; otherwise, scope them to the required compartments.
If VNICs are located in a different compartment from the instances, grant the necessary VNIC permissions in that compartment as well.
These are example statements, not a universal policy set. Verify the required permissions against your recipe type and target configuration before implementation.
Official reference: https://docs.oracle.com/en-us/iaas/Content/scanning/using/required-iam-policy-host-scan.htm
- Sign in to the OCI Console.
- Open the navigation menu.
- Navigate to Identity & Security → Scanning.
- Open the scan recipes section.
The available page labels may vary slightly with OCI Console updates.
Navigate to the Compute/Hosts scan recipes section and select Create Scan Recipe.
Configure the following:
| Setting | Example |
|---|---|
| Recipe name | VM-Security-Scan-Recipe |
| Resource type | Compute |
| Agent-based scanning | Enable as required |
| Port scanning | Enable as required |
| CIS benchmark scanning | Configure as supported |
| Scan schedule | Daily or weekly |
| Compartment | CloudSecurity |
Choose the scan settings appropriate for your environment.
Agent-based scanning: Can identify OS vulnerabilities, supported security configuration issues, open ports on attached VNICs, and supported third-party application vulnerabilities.
Network port scanning: Checks public IP addresses for open ports. An open-port finding does not automatically mean the port is reachable from the public Internet.
Save the recipe after reviewing the configuration.
Official reference: https://docs.oracle.com/en-us/iaas/Content/scanning/using/create-host-recipe.htm
A target determines which Compute instances will be scanned using the selected recipe.
- Navigate to Scanning → Targets.
- Open the Compute/Hosts tab.
- Select Create Target.
- Enter the target name:
Production-VM-Scan-Target. - Select the scan recipe created in Step 3.
- Select the target compartment.
- Choose either:
- All Compute instances in the selected compartment and its subcompartments.
- Specific Compute instances.
- Review the configuration and create the target.
Enterprise tip: If you need to scan multiple VMs, selecting all instances in the appropriate compartment can reduce manual work. A target created at the tenancy root can cover all Compute instances in the tenancy, subject to the service configuration and permissions.
Official reference: https://docs.oracle.com/en-us/iaas/Content/scanning/using/create-host-target.htm
After creating the target, allow time for the initial scan to complete.
Navigate to:
Identity & Security → Scanning → Scanning Reports → Hosts
Select the relevant compartment and inspect the available reports.
Review:
- Instance name and scan status.
- Vulnerability identifiers, including CVEs where available.
- Severity or risk level.
- Missing security patches.
- Open ports.
- Supported CIS benchmark findings.
- Remediation information.
OCI generally makes results available within about 15 minutes, but the initial scan can take up to 24 hours.
Note: OCI creates a separate host-scan report for each Compute instance in the target. Vulnerability reports can also summarize a particular vulnerability across affected resources.
Official reference: https://docs.oracle.com/en-us/iaas/Content/scanning/using/host-scan-reports.htm
Prioritize findings based on severity, business impact, exposure, and available remediation guidance.
| Severity | Recommended action |
|---|---|
| Critical | Investigate and remediate immediately according to incident policy. |
| High | Prioritize remediation and assess exposure. |
| Medium | Schedule remediation based on risk. |
| Low / Minor | Review and resolve according to the security baseline. |
Suppose three Compute instances produce these findings:
| VM | Finding | Action |
|---|---|---|
APP-VM-01 |
Critical package vulnerability | Verify the affected package and apply the appropriate security fix. |
WEB-VM-02 |
Unexpected open port | Validate business requirements and restrict access if unnecessary. |
DB-VM-03 |
CIS benchmark failure | Review the failed recommendation and apply an approved configuration change. |
After remediation:
- Verify the patch or configuration change.
- Confirm the application remains healthy.
- Allow the next scan to complete.
- Review the latest report to verify the finding is resolved.
Important: Vulnerability Scanning identifies potential problems; it does not automatically patch every finding. Apply changes through your approved patch-management and change-control process.
For instances in private subnets or without public IP addresses, verify that the VCN has the required Service Gateway and route rule for Oracle services when required.
Check:
- Service Gateway is available for the relevant Oracle services.
- The subnet route table has the appropriate route.
- IAM permissions allow the required scanning operations.
- The instance uses a supported image and agent configuration.
Do not expose a private VM to the Internet solely to enable vulnerability scanning.
Official reference: https://docs.oracle.com/en-us/iaas/Content/scanning/using/create-host-target.htm
- Supported platforms: Scanning is intended for supported Compute images and Container Registry images; unsupported or end-of-support images may not receive full coverage.
- Windows coverage: Windows scanning uses NVD data but does not include OVAL or CIS benchmark data, so it should not be the sole mechanism for Windows security assurance.
- Not a penetration test: The service does not replace penetration testing or a comprehensive application security assessment.
- Open ports require analysis: A reported open port is not proof that it is publicly reachable or necessarily unsafe.
- Possible false positives or gaps: Results can be incomplete or inaccurate for unsupported operating systems and some package configurations.
- PCI compliance: OCI Vulnerability Scanning is not a PCI-compliant scanner.
- No automatic remediation guarantee: Findings must be investigated and fixed using an appropriate remediation process.
Official reference: https://docs.oracle.com/en-us/iaas/Content/scanning/using/overview.htm
| Problem | What to check |
|---|---|
| Cannot create a recipe or target | Confirm IAM permissions and the selected compartment. |
| Agent-based scan does not work | Check required service policies, supported image and Oracle Cloud Agent compatibility. |
| Private VM is not scanned as expected | Verify Service Gateway, route rules and required permissions. |
| No reports appear | Confirm that the target exists, the recipe is associated, and sufficient time has elapsed. |
| Unexpected port finding | Validate the listening service, security rules, NSGs and actual network reachability. |
| Finding remains after patching | Verify the installed package/version, patch status and latest scan result. |
- IAM policies reviewed and configured.
- Compute scan recipe created.
- Required scan settings enabled.
- Scan target created for one or multiple VMs.
- Private-subnet connectivity verified where applicable.
- Initial scan completed.
- Host reports reviewed.
- Findings prioritized by severity.
- Remediation performed through change control.
- Latest scan results checked after remediation.
OCI Vulnerability Scanning = Discover → Assess → Prioritize → Remediate → Validate
The service helps Cloud Administrators improve security visibility across multiple Compute instances by identifying known vulnerabilities, open ports, and supported configuration weaknesses from a centralized OCI Console.
Key takeaway: Create the recipe to define what to scan, create the target to select the VMs, review the findings, and verify remediation with a subsequent scan.
1. Create a req policy:
2.Go to Identity & Security > Scanning > Scanning Recipes.
3.Scan Target
4.Scanning Reports
