TMA-ORACLE-SAAS-3.1
Ensure Fusion Applications Login, Logout and Session Events are Captured, Exported, and Forwarded to Central Logging
Descripción
Capture all user authentication lifecycle events (successful and failed logins, logouts, session creation/termination, token refresh, and session invalidation) from Fusion Applications and ensure these events are exported to OCI Audit/Logging and forwarded to your centralized SIEM or log repository for retention ... Authentication lifecycle events are fundamental telemetry for detecting account compromise, brute-force attacks, anomalous logins (time/location), and unauthorized session reuse. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.
Cómo se verifica
Método de auditoría: Revisión manual
Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.
In the OCI Console 1. Verify Audit records (OCI Audit) capture high-level tenancy and console events. For Fusion application session details, verify the tenant's Fusion Audit export pipeline is configured, Confirm Fusion's audit export is sending events to OCI Logging or to Object Storage. 2. In OCI Logging (or Object Storage), search for recent Fusion session events (examples: SignInSuccess, SignInFailure, SignOut, SessionCreated). Use query filters for eventName, principal, sourceIp, and eventTime. 3.
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
1.Configure export Export audit events to OCI Logging (or to Object Storage + Streaming). If using Oracle's documented methods (REST API / Audit export), configure the export schedule and confirm delivery. 2.Establish ingestion pipeline: Create or verify the Service Connector Hub (OCI Logging → Streaming → SIEM) or object-storage-based ingestion.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- oracle-saaslogging
- Referencia
- CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 3.1 Ensure Fusion Applications Login, Logout and Session Events are Captured, Exported, and Forwarded to Central Logging