TMA-ORACLE-SAAS-3.1
Ensure Fusion Applications Login, Logout and Session Events are Captured, Exported, and Forwarded to Central Logging
Description
Capture all user authentication lifecycle events (successful and failed logins, logouts, session creation/termination, token refresh, and session invalidation) from Fusion Applications and ensure these events are exported to OCI Audit/Logging and forwarded to your centralized SIEM or log repository for retention ... Authentication lifecycle events are fundamental telemetry for detecting account compromise, brute-force attacks, anomalous logins (time/location), and unauthorized session reuse. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
In the OCI Console 1. Verify Audit records (OCI Audit) capture high-level tenancy and console events. For Fusion application session details, verify the tenant's Fusion Audit export pipeline is configured, Confirm Fusion's audit export is sending events to OCI Logging or to Object Storage. 2. In OCI Logging (or Object Storage), search for recent Fusion session events (examples: SignInSuccess, SignInFailure, SignOut, SessionCreated). Use query filters for eventName, principal, sourceIp, and eventTime. 3.
How it is fixed
Fix method: Guidance or infrastructure patch
1.Configure export Export audit events to OCI Logging (or to Object Storage + Streaming). If using Oracle's documented methods (REST API / Audit export), configure the export schedule and confirm delivery. 2.Establish ingestion pipeline: Create or verify the Service Connector Hub (OCI Logging → Streaming → SIEM) or object-storage-based ingestion.
Properties
- Operating systems
- Any
- Tags
- oracle-saaslogging
- Reference
- CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 3.1 Ensure Fusion Applications Login, Logout and Session Events are Captured, Exported, and Forwarded to Central Logging