TMA-ORACLE-SAAS-3.1
Ensure Fusion Applications Login, Logout and Session Events are Captured, Exported, and Forwarded to Central Logging
Description
Capture all user authentication lifecycle events (successful and failed logins, logouts, session creation/termination, token refresh, and session invalidation) from Fusion Applications and ensure these events are exported to OCI Audit/Logging and forwarded to your centralized SIEM or log repository for retention ... Authentication lifecycle events are fundamental telemetry for detecting account compromise, brute-force attacks, anomalous logins (time/location), and unauthorized session reuse. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.
Méthode de vérification
Méthode d'audit: Revue manuelle
Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.
In the OCI Console 1. Verify Audit records (OCI Audit) capture high-level tenancy and console events. For Fusion application session details, verify the tenant's Fusion Audit export pipeline is configured, Confirm Fusion's audit export is sending events to OCI Logging or to Object Storage. 2. In OCI Logging (or Object Storage), search for recent Fusion session events (examples: SignInSuccess, SignInFailure, SignOut, SessionCreated). Use query filters for eventName, principal, sourceIp, and eventTime. 3.
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
1.Configure export Export audit events to OCI Logging (or to Object Storage + Streaming). If using Oracle's documented methods (REST API / Audit export), configure the export schedule and confirm delivery. 2.Establish ingestion pipeline: Create or verify the Service Connector Hub (OCI Logging → Streaming → SIEM) or object-storage-based ingestion.
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- oracle-saaslogging
- Référence
- CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 3.1 Ensure Fusion Applications Login, Logout and Session Events are Captured, Exported, and Forwarded to Central Logging