Ensure Fusion Applications Login, Logout and Session Events are Captured, Exported, and Forwarded to Central Logging

中级别 2人工审核oracle-saas

说明

Capture all user authentication lifecycle events (successful and failed logins, logouts, session creation/termination, token refresh, and session invalidation) from Fusion Applications and ensure these events are exported to OCI Audit/Logging and forwarded to your centralized SIEM or log repository for retention ... Authentication lifecycle events are fundamental telemetry for detecting account compromise, brute-force attacks, anomalous logins (time/location), and unauthorized session reuse. Reported as a manual review item: these Fusion/EPM/OCI IAM settings are reviewed in the Oracle SaaS and OCI consoles or reports.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

In the OCI Console 1. Verify Audit records (OCI Audit) capture high-level tenancy and console events. For Fusion application session details, verify the tenant's Fusion Audit export pipeline is configured, Confirm Fusion's audit export is sending events to OCI Logging or to Object Storage. 2. In OCI Logging (or Object Storage), search for recent Fusion session events (examples: SignInSuccess, SignInFailure, SignOut, SessionCreated). Use query filters for eventName, principal, sourceIp, and eventTime. 3.

修复方式

修复方法: 操作指南或基础设施补丁

1.Configure export Export audit events to OCI Logging (or to Object Storage + Streaming). If using Oracle's documented methods (REST API / Audit export), configure the export schedule and confirm delivery. 2.Establish ingestion pipeline: Create or verify the Service Connector Hub (OCI Logging → Streaming → SIEM) or object-storage-based ingestion.

属性

操作系统: 任意
标签: oracle-saaslogging
参考: CIS Oracle SaaS Cloud Applications Benchmark v1.0.0 - 3.1 Ensure Fusion Applications Login, Logout and Session Events are Captured, Exported, and Forwarded to Central Logging