diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 5482eb105c..f8ccc27f58 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -46,6 +46,8 @@ All notable changes to the **Prowler SDK** are documented in this file. - Update AWS CodeArtifact service metadata to new format [(#8850)](https://github.com/prowler-cloud/prowler/pull/8850) - Rename OCI provider to oraclecloud with oci alias [(#9126)](https://github.com/prowler-cloud/prowler/pull/9126) - Remove unnecessary tests for M365_PowerShell module [(#9204)](https://github.com/prowler-cloud/prowler/pull/9204) +- Update oraclecloud audit service metadata to new format [(#9221)](https://github.com/prowler-cloud/prowler/pull/9221) + --- diff --git a/prowler/providers/oraclecloud/services/audit/audit_log_retention_period_365_days/audit_log_retention_period_365_days.metadata.json b/prowler/providers/oraclecloud/services/audit/audit_log_retention_period_365_days/audit_log_retention_period_365_days.metadata.json index c31bcbdd02..9f394fbcbc 100644 --- a/prowler/providers/oraclecloud/services/audit/audit_log_retention_period_365_days/audit_log_retention_period_365_days.metadata.json +++ b/prowler/providers/oraclecloud/services/audit/audit_log_retention_period_365_days/audit_log_retention_period_365_days.metadata.json @@ -1,35 +1,35 @@ { "Provider": "oraclecloud", "CheckID": "audit_log_retention_period_365_days", - "CheckTitle": "Ensure audit log retention period is set to 365 days or greater", - "CheckType": [ - "Software and Configuration Checks", - "Industry and Regulatory Standards", - "CIS OCI Foundations Benchmark" - ], + "CheckTitle": "Tenancy audit log retention period is 365 days or greater", + "CheckType": [], "ServiceName": "audit", "SubServiceName": "", - "ResourceIdTemplate": "oci:audit:configuration", + "ResourceIdTemplate": "", "Severity": "medium", - "ResourceType": "OciAudit", - "Description": "Ensure audit log retention period is set to 365 days or greater", - "Risk": "Inadequate audit logging increases risk of undetected security incidents.", - "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Audit/Tasks/settingretentionperiod.htm", + "ResourceType": "Compartment", + "Description": "**OCI Audit configuration** defines tenancy-wide log retention for audit events. The finding evaluates whether the retention period (days) is `>= 365` and that an audit configuration exists, *applying across all regions and compartments*.", + "Risk": "**Insufficient audit retention** or missing configuration shrinks the **detection window** and breaks **accountability**.\n\nEvidence for older actions may be unavailable, enabling attackers to evade detection, mask **data exfiltration**, and impede **forensic reconstruction** and compliance reporting.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.oracle.com/en-us/iaas/Content/Audit/Tasks/settingretentionperiod.htm", + "https://docs.oracle.com/en-us/iaas/tools/terraform-provider-oci/4.88.1/docs/r/audit_configuration.html" + ], "Remediation": { "Code": { "CLI": "oci audit configuration update --compartment-id --retention-period-days 365", "NativeIaC": "", - "Other": "1. Navigate to Governance > Audit\n2. Click Configuration\n3. Set retention period to 365 days or greater\n4. Save changes", - "Terraform": "resource \"oci_audit_configuration\" \"example\" {\n compartment_id = var.tenancy_ocid\n retention_period_days = 365\n}" + "Other": "1. Open the OCI Console and go to Governance & Administration > Audit\n2. Click Configuration\n3. Set Retention period (days) to 365\n4. Click Save", + "Terraform": "```hcl\nresource \"oci_audit_configuration\" \"\" {\n compartment_id = var.tenancy_ocid\n retention_period_days = 365 # Critical: sets audit log retention to 365 days to pass the check\n}\n```" }, "Recommendation": { - "Text": "Ensure audit log retention period is set to 365 days or greater", - "Url": "https://hub.prowler.com/check/oci/audit_log_retention_period_365_days" + "Text": "Set audit retention to `>= 365` days at the tenancy level and protect the setting with **least privilege** and **separation of duties**.\n\nAdopt **defense in depth**: export audit logs to centralized, immutable storage or a SIEM for extended retention, integrity, and continuous monitoring.", + "Url": "https://hub.prowler.com/check/audit_log_retention_period_365_days" } }, "Categories": [ "logging", - "security-configuration" + "forensics-ready" ], "DependsOn": [], "RelatedTo": [],