chore(oraclecloud): enhance metadata for audit service (#9221)

Co-authored-by: Sergio Garcia <hello@mistercloudsec.com>

prowler/CHANGELOG.md

@@ -46,6 +46,8 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Update AWS CodeArtifact service metadata to new format [(#8850)](https://github.com/prowler-cloud/prowler/pull/8850)
 - Rename OCI provider to oraclecloud with oci alias [(#9126)](https://github.com/prowler-cloud/prowler/pull/9126)
 - Remove unnecessary tests for M365_PowerShell module [(#9204)](https://github.com/prowler-cloud/prowler/pull/9204)
+- Update oraclecloud audit service metadata to new format [(#9221)](https://github.com/prowler-cloud/prowler/pull/9221)
+
 
 ---
 

prowler/providers/oraclecloud/services/audit/audit_log_retention_period_365_days/audit_log_retention_period_365_days.metadata.json

@@ -1,35 +1,35 @@
 {
   "Provider": "oraclecloud",
   "CheckID": "audit_log_retention_period_365_days",
-  "CheckTitle": "Ensure audit log retention period is set to 365 days or greater",
-  "CheckType": [
-    "Software and Configuration Checks",
-    "Industry and Regulatory Standards",
-    "CIS OCI Foundations Benchmark"
-  ],
+  "CheckTitle": "Tenancy audit log retention period is 365 days or greater",
+  "CheckType": [],
   "ServiceName": "audit",
   "SubServiceName": "",
-  "ResourceIdTemplate": "oci:audit:configuration",
+  "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "OciAudit",
-  "Description": "Ensure audit log retention period is set to 365 days or greater",
-  "Risk": "Inadequate audit logging increases risk of undetected security incidents.",
-  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Audit/Tasks/settingretentionperiod.htm",
+  "ResourceType": "Compartment",
+  "Description": "**OCI Audit configuration** defines tenancy-wide log retention for audit events. The finding evaluates whether the retention period (days) is `>= 365` and that an audit configuration exists, *applying across all regions and compartments*.",
+  "Risk": "**Insufficient audit retention** or missing configuration shrinks the **detection window** and breaks **accountability**.\n\nEvidence for older actions may be unavailable, enabling attackers to evade detection, mask **data exfiltration**, and impede **forensic reconstruction** and compliance reporting.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.oracle.com/en-us/iaas/Content/Audit/Tasks/settingretentionperiod.htm",
+    "https://docs.oracle.com/en-us/iaas/tools/terraform-provider-oci/4.88.1/docs/r/audit_configuration.html"
+  ],
   "Remediation": {
     "Code": {
       "CLI": "oci audit configuration update --compartment-id <tenancy-ocid> --retention-period-days 365",
       "NativeIaC": "",
-      "Other": "1. Navigate to Governance > Audit\n2. Click Configuration\n3. Set retention period to 365 days or greater\n4. Save changes",
-      "Terraform": "resource \"oci_audit_configuration\" \"example\" {\n  compartment_id = var.tenancy_ocid\n  retention_period_days = 365\n}"
+      "Other": "1. Open the OCI Console and go to Governance & Administration > Audit\n2. Click Configuration\n3. Set Retention period (days) to 365\n4. Click Save",
+      "Terraform": "```hcl\nresource \"oci_audit_configuration\" \"<example_resource_name>\" {\n  compartment_id        = var.tenancy_ocid\n  retention_period_days = 365 # Critical: sets audit log retention to 365 days to pass the check\n}\n```"
     },
     "Recommendation": {
-      "Text": "Ensure audit log retention period is set to 365 days or greater",
-      "Url": "https://hub.prowler.com/check/oci/audit_log_retention_period_365_days"
+      "Text": "Set audit retention to `>= 365` days at the tenancy level and protect the setting with **least privilege** and **separation of duties**.\n\nAdopt **defense in depth**: export audit logs to centralized, immutable storage or a SIEM for extended retention, integrity, and continuous monitoring.",
+      "Url": "https://hub.prowler.com/check/audit_log_retention_period_365_days"
     }
   },
   "Categories": [
     "logging",
-    "security-configuration"
+    "forensics-ready"
   ],
   "DependsOn": [],
   "RelatedTo": [],