{"id":975,"date":"2026-04-17T08:31:05","date_gmt":"2026-04-17T08:31:05","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-guard-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security-identity-and-compliance\/"},"modified":"2026-04-17T08:31:05","modified_gmt":"2026-04-17T08:31:05","slug":"oracle-cloud-guard-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security-identity-and-compliance","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-guard-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security-identity-and-compliance\/","title":{"rendered":"Oracle Cloud Guard Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Security, Identity, and Compliance"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Security, Identity, and Compliance<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p>Oracle Cloud <strong>Cloud Guard<\/strong> is Oracle Cloud Infrastructure (OCI) security posture management and threat detection service that continuously checks your OCI resources for risky configurations and suspicious activity, then helps you prioritize and respond.<\/p>\n\n\n\n<p>In simple terms: <strong>Cloud Guard watches your OCI tenancy for security issues<\/strong>, turns what it finds into actionable \u201cproblems,\u201d and can notify people (or automate responses) so issues don\u2019t linger unnoticed.<\/p>\n\n\n\n<p>Technically, Cloud Guard ingests signals from OCI (configuration metadata, audit\/activity telemetry, and service events depending on the detector), evaluates them using <strong>detector recipes<\/strong>, correlates findings into <strong>problems<\/strong> with risk levels, and can optionally trigger <strong>responder recipes<\/strong> (for notifications and remediation actions) scoped to <strong>targets<\/strong> (compartments and regions you choose).<\/p>\n\n\n\n<p>The problem it solves is the gap between \u201cwe deployed in the cloud\u201d and \u201cwe continuously know if it\u2019s still secure.\u201d As teams scale compartments, networking, identity policies, keys, and data services, misconfigurations and risky changes become inevitable. Cloud Guard provides continuous, centralized visibility and a workflow for detection, triage, and response across Oracle Cloud.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Cloud Guard?<\/h2>\n\n\n\n<p><strong>Official purpose (OCI):<\/strong> Cloud Guard helps you <strong>identify security weaknesses<\/strong> in your OCI tenancy and <strong>detect suspicious activity<\/strong>, providing recommended actions and optional automated responses.<br\/>\nVerify the most current product statement and supported detectors\/responders in the official documentation:<br\/>\nhttps:\/\/docs.oracle.com\/en-us\/iaas\/cloud-guard\/home.htm<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Core capabilities<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Continuous security posture monitoring<\/strong> for OCI resources (misconfiguration and risky settings).<\/li>\n<li><strong>Threat\/activity detection<\/strong> based on telemetry and audit-like signals (depending on detector type).<\/li>\n<li><strong>Centralized findings (\u201cproblems\u201d)<\/strong> with severity\/risk levels and context about impacted resources.<\/li>\n<li><strong>Recipes<\/strong> (detector and responder) to standardize what is detected and how your organization responds.<\/li>\n<li><strong>Targets<\/strong> to define <em>where<\/em> Cloud Guard monitors (which compartments, and which regions are enabled).<\/li>\n<li><strong>Integrations<\/strong> to send events to operational tooling (for example, OCI Events + Notifications).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Major components (common terms you will see in OCI Console)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Cloud Guard (service)<\/strong>: The overall capability in OCI Security, Identity, and Compliance.<\/li>\n<li><strong>Reporting region<\/strong>: The region where Cloud Guard stores\/aggregates its reporting data for the tenancy. (Confirm behavior in docs for your tenancy design.)<\/li>\n<li><strong>Targets<\/strong>: Scopes for monitoring (commonly compartments).<\/li>\n<li><strong>Detector recipes<\/strong>: Collections of detector rules (configuration and activity detectors).<\/li>\n<li><strong>Responder recipes<\/strong>: Collections of responder rules (notify and\/or remediate depending on rule\/action).<\/li>\n<li><strong>Managed lists<\/strong>: Allowlists\/denylists used by some detectors to reduce false positives and align with policy.<\/li>\n<li><strong>Problems<\/strong>: Aggregated and prioritized issues created from detector findings.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Service type and scope<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Service type:<\/strong> Managed OCI security service (control-plane service) accessed through the OCI Console, API, and typically OCI Events\/Notifications for downstream automation.<\/li>\n<li><strong>Scope:<\/strong> <strong>Tenancy-aware<\/strong>, with monitoring defined by <strong>targets<\/strong> (compartment-based) and enabled <strong>regions<\/strong>.<\/li>\n<li><strong>Regional vs global:<\/strong> Cloud Guard has a <strong>reporting region<\/strong> concept and can be <strong>enabled in one or more regions<\/strong>. In practice, you plan it as a tenancy-wide security service with region-specific enablement and centralized reporting.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How it fits into the Oracle Cloud ecosystem<\/h3>\n\n\n\n<p>Cloud Guard is a foundational layer in Oracle Cloud <strong>Security, Identity, and Compliance<\/strong>:\n&#8211; Works alongside <strong>IAM<\/strong> (policies, users, groups, dynamic groups), <strong>Audit<\/strong>, and <strong>Logging<\/strong> to provide visibility.\n&#8211; Complements <strong>preventive<\/strong> controls like <strong>Security Zones<\/strong> (where applicable) by providing <strong>detective<\/strong> and <strong>responsive<\/strong> controls.\n&#8211; Integrates with <strong>OCI Events<\/strong>, <strong>Notifications<\/strong>, and (optionally) automation services (for example, Functions) to operationalize security response.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Cloud Guard?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Reduce breach likelihood and impact<\/strong> by finding high-risk exposures (for example, overly permissive network access) before they\u2019re exploited.<\/li>\n<li><strong>Centralize security visibility<\/strong> across many compartments\/projects and teams.<\/li>\n<li><strong>Improve audit readiness<\/strong> by demonstrating ongoing security monitoring and remediation workflows.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Continuous detection<\/strong> across OCI services without building a custom scanner pipeline.<\/li>\n<li><strong>Standardized security policy as recipes<\/strong> that can be cloned and tailored to your environment.<\/li>\n<li><strong>Correlation into \u201cproblems\u201d<\/strong> so you triage fewer, higher-signal issues instead of raw logs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Integrates with incident workflows<\/strong> via Events\/Notifications (email, paging, ticket creation via downstream automation).<\/li>\n<li><strong>Supports compartment-based ownership<\/strong>: platform security can define standards; app teams can remediate in their compartments.<\/li>\n<li><strong>Baseline + customization<\/strong>: start with Oracle-provided recipes, then tune as you learn.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Helps enforce internal policies such as:<\/li>\n<li>\u201cNo internet-exposed administrative ports\u201d<\/li>\n<li>\u201cNo public object storage where prohibited\u201d<\/li>\n<li>\u201cNo risky identity changes without review\u201d<\/li>\n<li>Provides evidence of \u201cdetective controls\u201d expected by many frameworks.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Guard is managed by Oracle; you don\u2019t scale scanners, databases, or correlation engines yourself.<\/li>\n<li>Designed for multi-compartment tenancies and ongoing change.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose it<\/h3>\n\n\n\n<p>Choose Cloud Guard when:\n&#8211; You run production workloads on OCI and need <strong>continuous posture monitoring<\/strong>.\n&#8211; You have multiple teams\/compartments and want centralized governance with distributed remediation.\n&#8211; You want to operationalize OCI security findings into alerting and response.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose it (or not rely on it alone)<\/h3>\n\n\n\n<p>Cloud Guard is not a replacement for:\n&#8211; A full <strong>SIEM<\/strong> (log retention, advanced correlation across all sources, long-term forensic search).\n&#8211; Endpoint detection and response (EDR) on compute instances.\n&#8211; Application security testing (SAST\/DAST), container runtime security, or third-party CSPM across multiple clouds.<\/p>\n\n\n\n<p>If you need deep log analytics, long retention, and cross-cloud correlation, pair Cloud Guard with a SIEM or OCI logging analytics approach (verify current Oracle offerings for your use case).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Cloud Guard used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Financial services<\/strong>: strong governance and evidence of monitoring.<\/li>\n<li><strong>Healthcare<\/strong>: continuous detection and compartment-level separation.<\/li>\n<li><strong>Government\/public sector<\/strong>: centralized security controls and multi-project oversight.<\/li>\n<li><strong>Retail\/e-commerce<\/strong>: fast-changing environments with a need to detect risky exposure quickly.<\/li>\n<li><strong>SaaS providers<\/strong>: multi-environment compartment structures (dev\/stage\/prod) and standardized security baselines.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Security engineering \/ cloud security teams<\/li>\n<li>Platform engineering teams (landing zone owners)<\/li>\n<li>DevOps\/SRE teams (on-call incident response)<\/li>\n<li>Compliance and risk teams (reporting, control evidence)<\/li>\n<li>Application teams (compartment owners\/remediators)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Internet-facing apps (load balancers, compute, API gateways)<\/li>\n<li>Data platforms (databases, object storage, analytics services)<\/li>\n<li>Shared platform services (networking hubs, IAM patterns)<\/li>\n<li>High-change CI\/CD environments where misconfigurations can slip in<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Multi-compartment landing zone<\/strong> with shared networking and centralized logging<\/li>\n<li><strong>Multi-region<\/strong> deployments with centralized security operations<\/li>\n<li><strong>Hub-and-spoke VCN<\/strong> patterns where network exposure is a key risk area<\/li>\n<li><strong>Least-privilege IAM<\/strong> implementations where identity drift is monitored<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Real-world deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Production:<\/strong> Always recommended; tune detectors and alerting to avoid noise.<\/li>\n<li><strong>Dev\/test:<\/strong> Useful for catching insecure defaults early, but avoid excessive alerting fatigue\u2014consider lighter recipes or separate targets.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic Cloud Guard use cases. Exact detector\/responder availability can change by region and service updates\u2014verify in official docs for your tenancy.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Internet-exposed administrative ports<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Security lists\/NSGs allow SSH\/RDP from <code>0.0.0.0\/0<\/code>.<\/li>\n<li><strong>Why Cloud Guard fits:<\/strong> Detects risky network exposure and raises a prioritized problem.<\/li>\n<li><strong>Scenario:<\/strong> A developer opens SSH temporarily; Cloud Guard flags it so it\u2019s corrected quickly.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Public or overly permissive object storage access<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Buckets\/objects are exposed more broadly than policy allows.<\/li>\n<li><strong>Why Cloud Guard fits:<\/strong> Detects posture issues on storage resources.<\/li>\n<li><strong>Scenario:<\/strong> A team shares artifacts publicly by mistake; Cloud Guard surfaces it for immediate remediation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Risky IAM changes and privilege escalation patterns<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Excessive permissions granted, new admin users\/groups, overly broad policies.<\/li>\n<li><strong>Why Cloud Guard fits:<\/strong> Activity\/configuration detectors can identify dangerous identity changes.<\/li>\n<li><strong>Scenario:<\/strong> A policy is updated to allow broad \u201cmanage all-resources\u201d in tenancy; Cloud Guard alerts security.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Drift from security baselines across compartments<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Different teams configure services inconsistently.<\/li>\n<li><strong>Why Cloud Guard fits:<\/strong> Targets + standardized recipes provide consistent monitoring everywhere.<\/li>\n<li><strong>Scenario:<\/strong> One compartment enables risky network settings; Cloud Guard catches drift.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Centralized alerting for OCI security findings<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Security teams need one place to see issues and notify on-call.<\/li>\n<li><strong>Why Cloud Guard fits:<\/strong> Problems are centralized; OCI Events can route alerts to Notifications.<\/li>\n<li><strong>Scenario:<\/strong> New high-risk problem triggers an Events rule that emails the SOC distribution list.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Automated response for well-understood issues (with guardrails)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Common misconfigurations recur (for example, accidental exposure).<\/li>\n<li><strong>Why Cloud Guard fits:<\/strong> Responder recipes can trigger actions (where supported) or notifications for human-in-the-loop.<\/li>\n<li><strong>Scenario:<\/strong> High-confidence exposure findings trigger auto-notify and create a ticket; optional auto-remediation is enabled only after testing.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Multi-region security posture monitoring<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Workloads run across multiple OCI regions; security needs consistent coverage.<\/li>\n<li><strong>Why Cloud Guard fits:<\/strong> Enable Cloud Guard in multiple regions and use targets for consistent monitoring.<\/li>\n<li><strong>Scenario:<\/strong> Production runs in two regions; Cloud Guard monitors both under the same governance model.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) M&amp;A or multi-business-unit tenancy governance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Different business units share a tenancy with many compartments.<\/li>\n<li><strong>Why Cloud Guard fits:<\/strong> Targets allow separate scopes with tailored recipes per unit.<\/li>\n<li><strong>Scenario:<\/strong> BU1 needs stricter rules than BU2; Cloud Guard recipes are customized per target.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Control evidence for compliance programs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Auditors require evidence of continuous monitoring and response.<\/li>\n<li><strong>Why Cloud Guard fits:<\/strong> Problems and remediation history support detective control narratives.<\/li>\n<li><strong>Scenario:<\/strong> Compliance asks for proof that risky exposures are detected and tracked to remediation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Reduce false positives using managed lists<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Approved exceptions exist (for example, specific IP allowlists).<\/li>\n<li><strong>Why Cloud Guard fits:<\/strong> Managed lists support tuning detectors to reduce noise.<\/li>\n<li><strong>Scenario:<\/strong> A corporate IP range is allowed to reach admin ports; Cloud Guard uses a managed list so it doesn\u2019t alert.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">11) Security operations triage with context and prioritization<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Raw events lack context; analysts need impacted resources and suggested fixes.<\/li>\n<li><strong>Why Cloud Guard fits:<\/strong> Problems include resource context and recommendations.<\/li>\n<li><strong>Scenario:<\/strong> Analyst sees \u201cCritical\u201d problem tied to a specific subnet\/security list and routes it to the owning team.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">12) Detect changes that break organizational policies<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Policies like \u201cno public IPs on production instances\u201d are violated.<\/li>\n<li><strong>Why Cloud Guard fits:<\/strong> Posture detectors can surface these violations as problems.<\/li>\n<li><strong>Scenario:<\/strong> A prod instance is launched with a public IP; Cloud Guard flags it and the team removes it.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<p>Cloud Guard evolves; always confirm the most current feature set and supported detectors\/responders in the official docs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6.1 Targets (scope of monitoring)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Defines which compartments\/resources Cloud Guard monitors, typically per target.<\/li>\n<li><strong>Why it matters:<\/strong> Prevents \u201call or nothing\u201d monitoring; supports separation by environment\/team.<\/li>\n<li><strong>Practical benefit:<\/strong> You can apply stricter rules to production and lighter rules to development.<\/li>\n<li><strong>Caveats:<\/strong> Targets depend on correct compartment design and region enablement.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.2 Detector recipes (what to detect)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> A detector recipe is a set of detector rules\u2014commonly including <strong>configuration<\/strong> and <strong>activity<\/strong> detectors.<\/li>\n<li><strong>Why it matters:<\/strong> Standardizes security monitoring to match policy and risk appetite.<\/li>\n<li><strong>Practical benefit:<\/strong> Start with Oracle-managed defaults, then clone\/tune for your needs.<\/li>\n<li><strong>Caveats:<\/strong> Over-customization can create noise; cloned recipes may not automatically inherit Oracle updates\u2014verify recipe update behavior in docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.3 Responder recipes (how to respond)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> A responder recipe defines responder rules that can notify or take actions when problems occur (depending on rule support).<\/li>\n<li><strong>Why it matters:<\/strong> Detection without response is slow; responders turn findings into operational outcomes.<\/li>\n<li><strong>Practical benefit:<\/strong> Immediate notifications to the right team; optional remediation where appropriate.<\/li>\n<li><strong>Caveats:<\/strong> Automated remediation requires careful permissions and change control. Some responders may require additional IAM permissions and integration setup.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.4 Problems (prioritized security issues)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Cloud Guard aggregates findings into \u201cproblems\u201d with risk\/severity and impacted resources.<\/li>\n<li><strong>Why it matters:<\/strong> Helps teams focus on the most important issues first.<\/li>\n<li><strong>Practical benefit:<\/strong> A small number of actionable items rather than many low-level events.<\/li>\n<li><strong>Caveats:<\/strong> Not every problem implies an active attack; interpret within context and validate.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.5 Managed lists (tuning and policy alignment)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Stores lists (for example, approved IPs, CIDRs, or other values) used by some detectors for allow\/deny logic.<\/li>\n<li><strong>Why it matters:<\/strong> Reduces false positives and aligns detections with business-approved exceptions.<\/li>\n<li><strong>Practical benefit:<\/strong> \u201cApproved admin IP ranges\u201d can be centrally managed and referenced.<\/li>\n<li><strong>Caveats:<\/strong> Managed lists must be governed\u2014overly broad allowlists can hide real risk.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.6 Central reporting region concept<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Stores Cloud Guard reporting data in a chosen region for the tenancy.<\/li>\n<li><strong>Why it matters:<\/strong> Supports centralized operations and consistent reporting.<\/li>\n<li><strong>Practical benefit:<\/strong> Security teams can work from one reporting view.<\/li>\n<li><strong>Caveats:<\/strong> Reporting region selection has operational implications; verify how changes are handled in current docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.7 Integration with OCI Events and Notifications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Cloud Guard can emit events (for example, when a problem is created\/updated), which you can route via OCI Events to Notifications and other targets.<\/li>\n<li><strong>Why it matters:<\/strong> Enables real-time alerting and automation.<\/li>\n<li><strong>Practical benefit:<\/strong> Email\/SMS\/pager alerts, ticket creation, or automation hooks.<\/li>\n<li><strong>Caveats:<\/strong> Events\/Notifications have their own quotas and costs (usually small), and you must design alert routing to avoid spam.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.8 Console workflows for triage and remediation guidance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Provides UI pages for targets, problems, and details including affected resources and recommendations.<\/li>\n<li><strong>Why it matters:<\/strong> Makes Cloud Guard usable for both security teams and resource owners.<\/li>\n<li><strong>Practical benefit:<\/strong> Faster triage and clearer ownership.<\/li>\n<li><strong>Caveats:<\/strong> For large tenancies, process and tagging strategy matter to avoid operational overload.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level architecture<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Enable Cloud Guard<\/strong> and choose a <strong>reporting region<\/strong>.<\/li>\n<li><strong>Enable Cloud Guard in desired regions<\/strong> (depending on OCI behavior and your deployment footprint).<\/li>\n<li>Create one or more <strong>targets<\/strong> (commonly compartments).<\/li>\n<li>Attach <strong>detector recipes<\/strong> and <strong>responder recipes<\/strong> to targets.<\/li>\n<li>Cloud Guard evaluates resource configurations and activity signals and creates <strong>problems<\/strong>.<\/li>\n<li>Problems can be:\n   &#8211; viewed and managed in the Cloud Guard console\n   &#8211; routed as events to <strong>OCI Events<\/strong> for automation and notifications<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Data\/control flow<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane:<\/strong> You configure Cloud Guard (targets, recipes, managed lists) via Console\/API.<\/li>\n<li><strong>Detection plane:<\/strong> Cloud Guard evaluates posture\/activity signals for resources within the target scope.<\/li>\n<li><strong>Response plane:<\/strong> Responder rules may generate notifications and\/or actions (depending on responder capabilities and granted permissions).<\/li>\n<li><strong>Operations plane:<\/strong> Events\/Notifications route problem lifecycle events to teams and systems.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related OCI services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>IAM:<\/strong> Access control to configure Cloud Guard; responder permissions; compartment-level scoping.<\/li>\n<li><strong>Events:<\/strong> Route Cloud Guard events for automation.<\/li>\n<li><strong>Notifications:<\/strong> Deliver alerts to email\/SMS\/HTTPS endpoints (depending on configured subscriptions).<\/li>\n<li><strong>Audit \/ Logging:<\/strong> Helpful for investigating what changed and when (Cloud Guard is not a replacement for full audit review).<\/li>\n<li><strong>Functions (optional):<\/strong> For custom automation (for example, create a ticket, post to chat, or enforce a policy).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services<\/h3>\n\n\n\n<p>Cloud Guard relies on OCI\u2019s underlying resource inventory and telemetry sources. The exact dependencies vary by detector type and resource. Treat Cloud Guard as a service that <strong>observes<\/strong> OCI resources and signals; you still need:\n&#8211; well-structured <strong>compartments<\/strong>\n&#8211; consistent <strong>tagging<\/strong>\n&#8211; clear <strong>ownership<\/strong> and remediation workflows<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Human\/admin access to Cloud Guard is controlled by <strong>OCI IAM policies<\/strong>.<\/li>\n<li>Automated response actions (if used) require that Cloud Guard (as a service) has permissions to act. OCI often guides you through required policies when enabling\/configuring\u2014use those guided steps and validate them against official docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Guard itself is a managed OCI control-plane service; you don\u2019t place it in a VCN.<\/li>\n<li>Your integrations (Events, Notifications, Functions) are also managed services. If you push notifications to external HTTPS endpoints, that endpoint\u2019s network controls are your responsibility.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>OCI Audit<\/strong> to monitor who changed Cloud Guard configuration and who modified underlying resources.<\/li>\n<li>Use <strong>OCI Events<\/strong> to standardize alert routing.<\/li>\n<li>Define ownership by compartment and enforce it with tags and IAM boundaries.<\/li>\n<li>Use a runbook for problem triage: validate \u2192 classify \u2192 assign \u2192 remediate \u2192 verify closure.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Simple architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  R[OCI Resources\\n(VCN, IAM, Storage, Compute, etc.)] --&gt; CG[Cloud Guard\\nDetectors + Recipes]\n  CG --&gt; P[Problems\\nRisk\/Severity + Context]\n  P --&gt; E[OCI Events Rule]\n  E --&gt; N[OCI Notifications Topic]\n  N --&gt; SOC[Email\/SMS\/HTTPS to SOC\/On-call]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Production-style architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph Tenancy[OCI Tenancy]\n    subgraph Regions[Multiple OCI Regions Enabled]\n      A1[Compartment: Prod]\n      A2[Compartment: Dev]\n      A3[Compartment: Shared Services]\n    end\n\n    CG[Cloud Guard\\nReporting Region + Problem Store]\n    T1[Target: Prod Compartments\\nDetector + Responder Recipes]\n    T2[Target: Dev Compartments\\nTuned Recipes]\n    ML[Managed Lists\\n(Approved CIDRs, Exceptions)]\n\n    A1 --&gt; CG\n    A2 --&gt; CG\n    A3 --&gt; CG\n    ML --&gt; T1\n    ML --&gt; T2\n    T1 --&gt; CG\n    T2 --&gt; CG\n\n    CG --&gt; EV[OCI Events]\n    EV --&gt; NT[OCI Notifications]\n    EV --&gt; FN[OCI Functions\\n(Optional Automation)]\n    FN --&gt; ITSM[Ticketing\/ChatOps\\n(External)]\n    NT --&gt; SOC[Security Operations\\nEmail\/On-call]\n  end\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Tenancy and account requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An active <strong>Oracle Cloud (OCI) tenancy<\/strong>.<\/li>\n<li>A user with permissions to:<\/li>\n<li>enable\/configure Cloud Guard (often requires tenancy-level permissions)<\/li>\n<li>create compartments (optional, for lab isolation)<\/li>\n<li>create networking resources (VCN\/security list) for generating a test finding<\/li>\n<li>create Events rules and Notifications topics\/subscriptions (for alert routing)<\/li>\n<\/ul>\n\n\n\n<p>For a first lab, using a user in the <strong>Administrators<\/strong> group (or equivalent) is the simplest approach. For production, design least-privilege policies (verify policy statements in official IAM docs).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM roles<\/h3>\n\n\n\n<p>You will typically need permissions to manage Cloud Guard and integrate with Events\/Notifications. Examples of policy patterns exist in OCI docs\u2014verify the exact policy grammar and resource-types here:\n&#8211; IAM documentation: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/home.htm\n&#8211; Cloud Guard documentation: https:\/\/docs.oracle.com\/en-us\/iaas\/cloud-guard\/home.htm<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Billing requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Guard is commonly listed as <strong>no additional charge<\/strong> (Always Free) in OCI, but you must still have:<\/li>\n<li>a valid OCI account<\/li>\n<li>paid resources (if you create compute, load balancers, etc.)<\/li>\n<\/ul>\n\n\n\n<p>Even if Cloud Guard is free, integrated services (Notifications, Functions, Logging, etc.) may have usage-based costs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Tools needed<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI Console access (web browser).<\/li>\n<li>Optional: OCI CLI (helpful for scripting and verification).<br\/>\n  OCI CLI docs: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/API\/SDKDocs\/cliinstall.htm<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Guard is available in many OCI commercial regions, but always <strong>verify service availability<\/strong> for your region:\n  https:\/\/www.oracle.com\/cloud\/data-regions\/<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Guard, Events, and Notifications have service limits and quotas.<\/li>\n<li>For a lab, defaults are usually sufficient.<\/li>\n<li>For production, validate quotas early and request increases as needed.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services (for this tutorial)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI <strong>Events<\/strong> and <strong>Notifications<\/strong> (for alerting)<\/li>\n<li>Basic networking resources (VCN\/security list) to generate a detectable posture issue<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Current pricing model (Cloud Guard)<\/h3>\n\n\n\n<p>Cloud Guard is generally positioned as <strong>no additional cost<\/strong> in OCI (often categorized as an Always Free security service). Because pricing and eligibility can change by region and contract type, confirm on the official Oracle pricing pages:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI price list (Security category): https:\/\/www.oracle.com\/cloud\/price-list\/<\/li>\n<li>OCI Cost Estimator: https:\/\/www.oracle.com\/cloud\/costestimator.html<\/li>\n<li>Cloud Guard documentation: https:\/\/docs.oracle.com\/en-us\/iaas\/cloud-guard\/home.htm<\/li>\n<\/ul>\n\n\n\n<p>If the price list indicates \u201cFree,\u201d it typically means:\n&#8211; No direct per-event\/per-resource Cloud Guard charge\n&#8211; You still pay for any underlying services used to respond, store logs, or run automation<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions (what you may still pay for)<\/h3>\n\n\n\n<p>Even with Cloud Guard itself being free, you may incur costs from:\n&#8211; <strong>OCI Notifications<\/strong>: message delivery and subscriptions (check pricing; usually low but not always zero).\n&#8211; <strong>OCI Events<\/strong>: typically low cost, but confirm.\n&#8211; <strong>OCI Functions<\/strong> (optional): invocations and compute duration.\n&#8211; <strong>Logging \/ Logging Analytics<\/strong> (optional): ingest, storage, and query costs.\n&#8211; <strong>Object Storage<\/strong> (optional): storing evidence snapshots or exports.\n&#8211; <strong>Data egress<\/strong>: if you push findings to external tools (SIEM, ITSM) outside OCI.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cost drivers<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Number of <strong>problem events<\/strong> routed to Notifications (volume can spike in large tenancies).<\/li>\n<li>Whether you trigger <strong>automation<\/strong> (Functions) on every problem or only high severity.<\/li>\n<li>Log retention and analytics if you ship Cloud Guard events and audit logs to a centralized log platform.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden or indirect costs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Operational cost<\/strong>: on-call load from noisy alerting if recipes aren\u2019t tuned.<\/li>\n<li><strong>Automation mistakes<\/strong>: overly aggressive responders can create outages; costs appear as downtime, not as a bill line item.<\/li>\n<li><strong>Cross-region operations<\/strong>: enabling multiple regions increases operational scope; investigate data residency requirements.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network\/data transfer implications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Sending notifications to external HTTPS endpoints can create outbound traffic (usually small).<\/li>\n<li>Exporting logs or integrating with external SIEM may increase egress depending on volume.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start with <strong>notify-only<\/strong> responders and tune before enabling auto-remediation.<\/li>\n<li>Route only <strong>high\/critical<\/strong> problems to paging\/on-call; send lower severities to ticket\/email.<\/li>\n<li>Use <strong>managed lists<\/strong> to reduce recurring known-good alerts.<\/li>\n<li>Implement <strong>deduplication<\/strong> in downstream tooling (tickets\/chatops).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate<\/h3>\n\n\n\n<p>A typical starter setup can be near-zero incremental cost if:\n&#8211; Cloud Guard is free in your region\/tenancy type (verify)\n&#8211; You only use email-based Notifications sparingly\n&#8211; You don\u2019t run Functions or heavy logging analytics<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations<\/h3>\n\n\n\n<p>In production, budget for:\n&#8211; Notifications\/event routing at scale (volume-based)\n&#8211; A centralized logging\/SIEM pipeline (often the largest cost)\n&#8211; Engineering time to tune recipes, build runbooks, and maintain automation safely<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Enable <strong>Cloud Guard<\/strong> in Oracle Cloud, create a scoped <strong>target<\/strong>, route <strong>problem events<\/strong> to <strong>Notifications<\/strong> using <strong>OCI Events<\/strong>, generate a low-risk test misconfiguration (internet-exposed SSH in a security list), then remediate and confirm the problem lifecycle.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:\n1. Create a dedicated compartment for the lab.\n2. Enable Cloud Guard and confirm your reporting region.\n3. Create a Cloud Guard target for the lab compartment using default recipes.\n4. Create a Notifications topic + email subscription.\n5. Create an Events rule that triggers on Cloud Guard problem events and publishes to Notifications.\n6. Create a VCN security list rule that allows SSH from the internet.\n7. Verify Cloud Guard creates a problem, then fix the rule and observe the problem update\/closure.\n8. Clean up resources.<\/p>\n\n\n\n<p>This lab is designed to be <strong>safe and low-cost<\/strong> (VCNs and security lists do not incur typical compute costs). Detection timing can vary; allow time for Cloud Guard to evaluate and generate problems.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Create a dedicated compartment (recommended)<\/h3>\n\n\n\n<p><strong>Why:<\/strong> Keeps the lab isolated and cleanup simple.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the OCI Console, open the navigation menu.<\/li>\n<li>Go to <strong>Identity &amp; Security \u2192 Compartments<\/strong>.<\/li>\n<li>Click <strong>Create Compartment<\/strong>.<\/li>\n<li>Name: <code>cloud-guard-lab<\/code><\/li>\n<li>Description: <code>Cloud Guard hands-on lab<\/code><\/li>\n<li>Parent compartment: your root compartment (or a training parent)<\/li>\n<li>Click <strong>Create Compartment<\/strong>.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> A new compartment named <code>cloud-guard-lab<\/code> exists and is active.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Confirm it appears in the compartments list and can be selected from the compartment picker.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Enable Cloud Guard (choose reporting region carefully)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the OCI Console, go to <strong>Identity &amp; Security \u2192 Cloud Guard<\/strong> (location may vary slightly by console layout).<\/li>\n<li>If Cloud Guard is not enabled yet, you will see an <strong>Enable Cloud Guard<\/strong> action.<\/li>\n<li>Follow the enablement wizard:\n   &#8211; Select a <strong>reporting region<\/strong> (often your home region).<br\/>\n   &#8211; Review any prompts to create required policies. If the wizard offers to create policies automatically, use it and then review created policies afterward.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; Cloud Guard becomes enabled.\n&#8211; A reporting region is set for Cloud Guard.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; You can open Cloud Guard pages (Targets\/Problems) without an \u201cEnable\u201d prompt.\n&#8211; Cloud Guard status shows enabled.<\/p>\n\n\n\n<p><strong>Notes:<\/strong>\n&#8211; The reporting region affects where Cloud Guard stores\/aggregates findings data. If you have data residency requirements, validate this with your governance team and the official docs.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Enable Cloud Guard in the region(s) you will use<\/h3>\n\n\n\n<p>Cloud Guard typically needs to be enabled for the regions where your targets\u2019 resources exist.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In Cloud Guard settings (or overview), locate region enablement options.<\/li>\n<li>Ensure the region where you will create the VCN (your current region) is enabled for Cloud Guard.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; Cloud Guard is enabled for the region you\u2019ll use for the lab.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Cloud Guard shows the region as enabled (exact UI text may vary).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Create a Cloud Guard target for the lab compartment<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In <strong>Cloud Guard<\/strong>, go to <strong>Targets<\/strong>.<\/li>\n<li>Click <strong>Create Target<\/strong>.<\/li>\n<li>\n<p>Configure:\n   &#8211; <strong>Name:<\/strong> <code>cloud-guard-lab-target<\/code>\n   &#8211; <strong>Compartment:<\/strong> choose a compartment where the target object will live (often root or a security compartment); follow your org model.\n   &#8211; <strong>Target compartment(s):<\/strong> select <code>cloud-guard-lab<\/code> as the compartment to monitor.\n   &#8211; <strong>Detector recipe:<\/strong> choose the default Oracle-managed recipe (or the default recommended one).\n   &#8211; <strong>Responder recipe:<\/strong> choose the default Oracle-managed responder recipe (we\u2019ll use Events+Notifications for alerting in this lab).<\/p>\n<\/li>\n<li>\n<p>Create the target.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; A target exists and is in an active state, monitoring the lab compartment.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; The target shows in the Targets list.\n&#8211; Target details show detector and responder recipes attached.<\/p>\n\n\n\n<p><strong>Tip (operations):<\/strong>\n&#8211; In production, you typically create separate targets for <code>prod<\/code>, <code>nonprod<\/code>, and <code>shared<\/code> with different recipe strictness.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Create a Notifications topic and email subscription<\/h3>\n\n\n\n<p>You\u2019ll route problem events to an email address.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>Developer Services \u2192 Notifications<\/strong> (service name may appear simply as <strong>Notifications<\/strong>).<\/li>\n<li>Select the <code>cloud-guard-lab<\/code> compartment (or your preferred compartment for shared topics).<\/li>\n<li>Click <strong>Create Topic<\/strong>:\n   &#8211; Name: <code>cloud-guard-problems-topic<\/code><\/li>\n<li>\n<p>Open the topic and click <strong>Create Subscription<\/strong>:\n   &#8211; Protocol: <code>Email<\/code>\n   &#8211; Email: your email address (must be reachable)<\/p>\n<\/li>\n<li>\n<p>Confirm the subscription by clicking the confirmation link sent to your email.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; A topic exists and the email subscription is confirmed.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Subscription status becomes <strong>Confirmed<\/strong>.<\/p>\n\n\n\n<p><strong>Cost note:<\/strong>\n&#8211; Email notifications are generally low cost, but confirm pricing for Notifications in your region.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Create an Events rule to publish Cloud Guard problem events to Notifications<\/h3>\n\n\n\n<p>Cloud Guard emits events that OCI Events can match and route.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>Observability &amp; Management \u2192 Events Service \u2192 Rules<\/strong> (often shown as <strong>Events<\/strong>).<\/li>\n<li>Ensure you are in the compartment where you want to create the rule (commonly the same as your Notifications topic).<\/li>\n<li>Click <strong>Create Rule<\/strong>.<\/li>\n<li>Configure:\n   &#8211; <strong>Display name:<\/strong> <code>cloud-guard-problem-events-to-email<\/code>\n   &#8211; <strong>Description:<\/strong> <code>Send Cloud Guard problem events to Notifications topic<\/code>\n   &#8211; <strong>Condition:<\/strong> <ul>\n<li>Choose <strong>Event Type<\/strong> related to <strong>Cloud Guard<\/strong> and <strong>Problems<\/strong> (for example, \u201cProblem created\/updated\u201d). The exact event type names can vary\u2014select the ones matching \u201cproblem created\u201d at minimum.<\/li>\n<li>If the UI supports additional filtering (such as severity), add it later after initial validation.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Actions:<\/strong> <ul>\n<li>Action type: <strong>Notifications<\/strong><\/li>\n<li>Topic: <code>cloud-guard-problems-topic<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<ol class=\"wp-block-list\" start=\"5\">\n<li>Create the rule.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; An Events rule exists and is active, routing Cloud Guard problem events to your Notifications topic.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; The rule appears in the list and shows as enabled.<\/p>\n\n\n\n<p><strong>Important:<\/strong><br\/>\nEvent type names and schemas can change; verify Cloud Guard\u2019s supported event types in official docs:\n&#8211; Events documentation: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Events\/home.htm<br\/>\n&#8211; Cloud Guard documentation: https:\/\/docs.oracle.com\/en-us\/iaas\/cloud-guard\/home.htm<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Generate a test posture issue (open SSH to the internet)<\/h3>\n\n\n\n<p>You will create a minimal network resource that is commonly detected as risky: inbound SSH from anywhere.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>Networking \u2192 Virtual Cloud Networks<\/strong>.<\/li>\n<li>Select compartment: <code>cloud-guard-lab<\/code>.<\/li>\n<li>Click <strong>Create VCN<\/strong> and choose <strong>VCN with Internet Connectivity<\/strong> (wizard).<\/li>\n<li>Use defaults (or name it <code>cloud-guard-lab-vcn<\/code>) and create.<\/li>\n<\/ol>\n\n\n\n<p>Now modify a security list to allow SSH from the internet:<\/p>\n\n\n\n<ol class=\"wp-block-list\" start=\"5\">\n<li>In the created VCN, go to <strong>Security Lists<\/strong>.<\/li>\n<li>Open the security list associated with the public subnet (or default security list, depending on wizard output).<\/li>\n<li>\n<p>Add an <strong>Ingress Rule<\/strong>:\n   &#8211; Source CIDR: <code>0.0.0.0\/0<\/code>\n   &#8211; IP protocol: TCP\n   &#8211; Destination port range: <code>22<\/code>\n   &#8211; Description: <code>LAB: open SSH from anywhere<\/code><\/p>\n<\/li>\n<li>\n<p>Save the rule.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; A security list rule exists allowing inbound SSH from anywhere.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; The ingress rule appears in the security list rules list.<\/p>\n\n\n\n<p><strong>Safety note:<\/strong><br\/>\nDo not attach this security list to any production subnet or instance. In this lab compartment, we are intentionally creating a misconfiguration to validate Cloud Guard detection.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8: Wait for Cloud Guard to detect and create a problem<\/h3>\n\n\n\n<p>Cloud Guard detections are not always instantaneous.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Return to <strong>Cloud Guard \u2192 Problems<\/strong>.<\/li>\n<li>Filter by compartment (if supported) to <code>cloud-guard-lab<\/code>, or search for networking-related problems.<\/li>\n<li>Wait and refresh periodically.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; A new problem appears related to risky network exposure (wording depends on detector rules).\n&#8211; Severity\/risk is assigned (for example, medium\/high).<\/p>\n\n\n\n<p><strong>Verification steps:<\/strong>\n&#8211; Open the problem details:\n  &#8211; Identify the affected resource (security list \/ subnet \/ VCN component).\n  &#8211; Read recommendation text and any links provided.\n&#8211; Confirm that your Events rule triggers a Notification:\n  &#8211; Check your email for a message from OCI Notifications containing event details.<\/p>\n\n\n\n<p><strong>If no problem appears after a reasonable wait:<\/strong>\n&#8211; Confirm the target includes the correct compartment.\n&#8211; Confirm Cloud Guard is enabled in the region where the VCN exists.\n&#8211; Confirm the security list rule was actually saved.\n&#8211; Some detectors may require additional telemetry; verify detector coverage in official docs.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 9: Remediate the issue and confirm the problem lifecycle updates<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go back to <strong>Networking \u2192 VCN \u2192 Security Lists<\/strong>.<\/li>\n<li>Edit the ingress rule you created and change:\n   &#8211; Source CIDR from <code>0.0.0.0\/0<\/code> to a restricted IP (for example, your corporate NAT IP) <strong>or<\/strong> remove the rule entirely.<\/li>\n<li>Save changes.<\/li>\n<\/ol>\n\n\n\n<p>Now verify Cloud Guard updates the issue:\n4. In <strong>Cloud Guard \u2192 Problems<\/strong>, find the problem again and observe status changes over time.<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; The problem eventually updates (for example, resolved\/closed) or decreases risk after remediation.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Problem detail page shows updated timestamps\/state.\n&#8211; You may receive an additional event\/notification depending on your Events rule configuration (created vs updated).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Use this checklist:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>[ ] Cloud Guard is enabled and has a reporting region set.<\/li>\n<li>[ ] Cloud Guard is enabled in the region where the lab VCN exists.<\/li>\n<li>[ ] A target monitors the <code>cloud-guard-lab<\/code> compartment.<\/li>\n<li>[ ] Notifications topic + confirmed email subscription exist.<\/li>\n<li>[ ] Events rule routes Cloud Guard problem events to the topic.<\/li>\n<li>[ ] A deliberate risky security list rule triggers a Cloud Guard problem.<\/li>\n<li>[ ] Fixing the rule results in problem update\/closure after some time.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: \u201cI can\u2019t enable Cloud Guard\u201d \/ missing permissions<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use a tenancy admin for the lab or add IAM policies to allow Cloud Guard administration.<\/li>\n<li>Review the enablement wizard prompts; OCI often provides guided policy creation.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: No events are reaching Notifications<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Confirm Events rule condition uses the correct <strong>Cloud Guard problem<\/strong> event type.<\/li>\n<li>Confirm the rule is enabled and in the correct compartment.<\/li>\n<li>Confirm subscription is <strong>Confirmed<\/strong>.<\/li>\n<li>Verify Notifications service limits\/quotas and check for delivery failures.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: No problem is detected<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Confirm the target scope includes the compartment where the VCN exists.<\/li>\n<li>Confirm the region is enabled for Cloud Guard monitoring.<\/li>\n<li>Allow more time; detection can be periodic.<\/li>\n<li>Confirm the security list rule truly allows <code>0.0.0.0\/0<\/code> to TCP 22.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Issue: Too many alerts<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Route only high\/critical severities to email\/paging.<\/li>\n<li>Use managed lists for approved exceptions.<\/li>\n<li>Tune recipes (clone and adjust) rather than disabling Cloud Guard.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To avoid ongoing noise and to keep tenancy tidy:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Remove the insecure security list rule<\/strong> (if not already removed).<\/li>\n<li>Delete the <strong>VCN<\/strong> created for the lab (this deletes related subnets\/gateways if created by wizard).<\/li>\n<li>Disable or delete the <strong>Events rule<\/strong> <code>cloud-guard-problem-events-to-email<\/code>.<\/li>\n<li>Delete the <strong>Notifications subscription<\/strong> and <strong>topic<\/strong> (optional).<\/li>\n<li>Delete the <strong>Cloud Guard target<\/strong> created for the lab (optional, if you only needed it for testing).<\/li>\n<li>Delete the <strong>compartment<\/strong> <code>cloud-guard-lab<\/code> (must be empty first).<\/li>\n<\/ol>\n\n\n\n<p>If Cloud Guard is enabled for your tenancy, you typically keep it enabled for ongoing security monitoring.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Design compartments intentionally:<\/strong> Separate prod\/nonprod\/shared. Cloud Guard targets map cleanly onto well-structured compartments.<\/li>\n<li><strong>Use multiple targets:<\/strong> Apply stricter recipes to production; tune dev\/test to reduce noise.<\/li>\n<li><strong>Centralize reporting and alert routing:<\/strong> One reporting region and consistent event routing improves SOC efficiency.<\/li>\n<li><strong>Integrate with incident management:<\/strong> Route Cloud Guard problems to tickets\/chatops\/paging with clear ownership.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Least privilege for Cloud Guard admins:<\/strong> Only a small group should manage recipes\/targets.<\/li>\n<li><strong>Separate duties:<\/strong> Security config vs remediation. App teams remediate in their compartments; security oversees governance.<\/li>\n<li><strong>Review responder permissions carefully:<\/strong> Automated responders require permissions that can change resources\u2014treat like production automation with change control.<\/li>\n<li><strong>Audit everything:<\/strong> Use OCI Audit to track changes to policies, targets, and recipes.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Minimize alert volume<\/strong> by tuning:<\/li>\n<li>route only high\/critical to immediate notifications<\/li>\n<li>send medium\/low to dashboards or daily summaries (via downstream tooling)<\/li>\n<li><strong>Avoid heavy automation triggers<\/strong> on every event; filter first.<\/li>\n<li><strong>Keep logging costs predictable<\/strong>: decide what to retain, where, and for how long.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices (operational performance)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Guard is managed, but your <strong>response workflow<\/strong> must scale:<\/li>\n<li>use clear triage categories<\/li>\n<li>use tagging to route ownership<\/li>\n<li>standardize runbooks per problem type<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Avoid \u201csingle inbox\u201d alerting. Use:<\/li>\n<li>Notifications topics per environment\/team<\/li>\n<li>multiple subscriptions (SOC, on-call, ticketing webhook)<\/li>\n<li>Test event routing periodically (quarterly is common).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Establish a <strong>problem triage SOP<\/strong>:\n  1) validate issue\n  2) identify owner (compartment\/tag)\n  3) remediate\n  4) verify closure\n  5) add exception (managed list) only if justified and time-bound<\/li>\n<li>Track metrics:<\/li>\n<li>time-to-detect (TTD)<\/li>\n<li>time-to-remediate (TTR)<\/li>\n<li>recurring problem types<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use tags like:<\/li>\n<li><code>Environment=Prod|NonProd<\/code><\/li>\n<li><code>OwnerTeam=...<\/code><\/li>\n<li><code>CostCenter=...<\/code><\/li>\n<li>Name targets and recipes consistently:<\/li>\n<li><code>cg-target-prod<\/code>, <code>cg-detector-prod-strict<\/code>, <code>cg-responder-prod-notify<\/code><\/li>\n<li>Document exception processes for managed lists.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Guard administration is controlled by <strong>OCI IAM policies<\/strong>.<\/li>\n<li>Apply role-based access:<\/li>\n<li><strong>Cloud Guard Admins:<\/strong> manage targets\/recipes\/managed lists<\/li>\n<li><strong>Security Analysts:<\/strong> read problems and investigate<\/li>\n<li><strong>App Owners:<\/strong> read problems affecting their compartments and remediate resources<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Guard is a managed OCI service; data at rest\/in transit is handled by OCI\u2019s platform security controls.<\/li>\n<li>For compliance requirements (key management, retention), verify Cloud Guard\u2019s data handling specifics in official docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Guard does not sit in your VCN; it\u2019s a control-plane service.<\/li>\n<li>Your outbound integrations (webhooks\/HTTPS) must be secured:<\/li>\n<li>TLS<\/li>\n<li>authentication (tokens)<\/li>\n<li>IP allowlisting where possible<\/li>\n<li>minimal payload exposure<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If you use Functions or external webhooks:<\/li>\n<li>store secrets in <strong>OCI Vault<\/strong> (recommended) rather than embedding in code<\/li>\n<li>rotate tokens regularly<\/li>\n<li>restrict who can read secrets<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable and review <strong>OCI Audit<\/strong> for:<\/li>\n<li>IAM policy changes<\/li>\n<li>target\/recipe changes<\/li>\n<li>responder configuration changes<\/li>\n<li>Use <strong>Events<\/strong> as a controlled, auditable routing layer for Cloud Guard findings.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Map Cloud Guard detectors to your control framework:<\/li>\n<li>network exposure controls<\/li>\n<li>identity governance controls<\/li>\n<li>data exposure controls<\/li>\n<li>Keep evidence:<\/li>\n<li>screenshots\/exports of problems<\/li>\n<li>change records of remediation<\/li>\n<li>exception approvals (managed lists)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Turning on automatic responders without testing.<\/li>\n<li>Using a single, overly broad target with noisy detectors for dev\/test.<\/li>\n<li>Creating permanent allowlist exceptions that never expire.<\/li>\n<li>Sending high-volume events to external endpoints without throttling\/deduplication.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start in <strong>notify-only<\/strong> mode.<\/li>\n<li>Use a dedicated <strong>security tooling compartment<\/strong> for:<\/li>\n<li>Notifications topics<\/li>\n<li>Events rules<\/li>\n<li>Functions (if any)<\/li>\n<li>Require change control for:<\/li>\n<li>recipe changes<\/li>\n<li>responder enablement<\/li>\n<li>managed list changes<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<p>Cloud Guard is highly useful, but plan for these realities:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Detection is not always real-time.<\/strong> Some detectors evaluate periodically; allow time for problems to appear or resolve.<\/li>\n<li><strong>Coverage varies by service\/region.<\/strong> Not all OCI services or all findings are supported everywhere\u2014verify detector coverage in docs.<\/li>\n<li><strong>Reporting region design matters.<\/strong> Changing reporting region later may be non-trivial\u2014verify current behavior before choosing.<\/li>\n<li><strong>False positives\/expected exceptions exist.<\/strong> Use managed lists and tuned recipes rather than ignoring problems.<\/li>\n<li><strong>Auto-remediation can be risky.<\/strong> Responders that change resources must be treated like production automation.<\/li>\n<li><strong>Event routing can create alert storms.<\/strong> If you route every problem update to email, you will overwhelm on-call. Filter carefully.<\/li>\n<li><strong>IAM complexity.<\/strong> Least-privilege policies for Cloud Guard + responders + integrations can be non-trivial. Use Oracle\u2019s guided policy creation and validate against IAM docs.<\/li>\n<li><strong>Not a SIEM.<\/strong> Cloud Guard is not designed to be your long-term forensic log store or cross-platform correlation engine.<\/li>\n<li><strong>Compartment sprawl reduces clarity.<\/strong> Without ownership tags and naming standards, problems become hard to route.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<p>Cloud Guard sits in the \u201ccloud security posture management + threat detection signals for OCI\u201d space. Alternatives vary by depth, scope, and cloud provider.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Comparison table<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Oracle Cloud Guard<\/strong><\/td>\n<td>OCI-native posture monitoring and problems workflow<\/td>\n<td>OCI-integrated targets\/recipes, centralized problems, native Events\/Notifications integration; often no additional cost (verify)<\/td>\n<td>OCI-focused; not a full SIEM; detector coverage depends on service\/region<\/td>\n<td>You run workloads on Oracle Cloud and want native continuous monitoring<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Security Zones<\/strong><\/td>\n<td>Preventing misconfiguration by enforcing policies<\/td>\n<td>Preventive guardrails; blocks risky operations (where applicable)<\/td>\n<td>Can be restrictive; not a full detective control; requires planning<\/td>\n<td>You want \u201cpolicy enforcement\u201d to prevent bad configs, not just detect them<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Vulnerability Scanning<\/strong> (OCI Vulnerability Scanning Service)<\/td>\n<td>Vulnerability scanning for compute\/images (verify current scope)<\/td>\n<td>Focused vulnerability insight<\/td>\n<td>Not a posture management replacement; different signal type<\/td>\n<td>Pair with Cloud Guard for vulnerability + posture coverage<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Logging\/Logging Analytics<\/strong><\/td>\n<td>Log-centric investigations and analytics<\/td>\n<td>Rich search\/retention\/analytics (depending on product)<\/td>\n<td>Requires pipeline design; costs can be significant<\/td>\n<td>You need deeper investigations, long retention, complex correlation<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Security Hub \/ GuardDuty \/ Config<\/strong><\/td>\n<td>AWS-native posture and threat detection<\/td>\n<td>Mature ecosystem and integrations<\/td>\n<td>AWS-only<\/td>\n<td>Use if your workloads are primarily on AWS<\/td>\n<\/tr>\n<tr>\n<td><strong>Microsoft Defender for Cloud<\/strong><\/td>\n<td>Azure posture + threat protection<\/td>\n<td>Deep Azure integration<\/td>\n<td>Azure-only<\/td>\n<td>Use if workloads are primarily on Azure<\/td>\n<\/tr>\n<tr>\n<td><strong>Google Security Command Center<\/strong><\/td>\n<td>GCP posture and security management<\/td>\n<td>GCP integration<\/td>\n<td>GCP-only<\/td>\n<td>Use if workloads are primarily on GCP<\/td>\n<\/tr>\n<tr>\n<td><strong>Open-source tools (Prowler, ScoutSuite, OPA policies)<\/strong><\/td>\n<td>DIY posture checks and policy-as-code<\/td>\n<td>Flexible, transparent, works in CI<\/td>\n<td>Requires building\/operating pipeline; not integrated like native services<\/td>\n<td>Use when you need custom controls in CI or multi-cloud checks (with effort)<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: regulated financial services tenancy<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A bank runs dozens of OCI compartments across business units, multiple regions, and strict controls for network exposure and identity changes. Auditors require evidence of continuous monitoring and incident response.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Cloud Guard enabled with a chosen reporting region.<\/li>\n<li>Targets:<ul>\n<li><code>prod<\/code> target with strict detector recipe + responder recipe that routes critical\/high problems to SOC paging.<\/li>\n<li><code>nonprod<\/code> target with tuned detector recipe to reduce noise.<\/li>\n<\/ul>\n<\/li>\n<li>Managed lists for approved corporate egress IPs and approved admin access CIDRs.<\/li>\n<li>OCI Events routes Cloud Guard problem events to:<ul>\n<li>Notifications (SOC distribution, on-call rotation)<\/li>\n<li>Functions (creates ITSM tickets and enriches with compartment owner tags)<\/li>\n<\/ul>\n<\/li>\n<li>OCI Audit retained and integrated with centralized logging for investigations.<\/li>\n<li><strong>Why Cloud Guard was chosen:<\/strong><\/li>\n<li>Native OCI integration and compartment-based governance.<\/li>\n<li>Standardized recipes for consistent monitoring.<\/li>\n<li>Event-driven integration into the SOC workflow.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Reduced exposure time for risky changes.<\/li>\n<li>Clear accountability per compartment.<\/li>\n<li>Auditable trail of detection \u2192 triage \u2192 remediation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: SaaS team on OCI<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A startup has a small DevOps team managing dev\/stage\/prod compartments. Security reviews happen ad hoc; mistakes like open ports happen during incident debugging.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Cloud Guard enabled and a single reporting region.<\/li>\n<li>Targets:<ul>\n<li>One target for prod with default detectors and notify-only responders.<\/li>\n<li>One target for dev\/stage with fewer notifications (only critical\/high).<\/li>\n<\/ul>\n<\/li>\n<li>OCI Events + Notifications sends high-severity problems to a shared on-call email and a chatops webhook (if used).<\/li>\n<li><strong>Why Cloud Guard was chosen:<\/strong><\/li>\n<li>Low operational overhead and fast setup.<\/li>\n<li>Helps the team catch common cloud misconfigurations without building tooling.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Fewer \u201cforgotten temporary changes.\u201d<\/li>\n<li>Faster feedback loop when risky config is introduced.<\/li>\n<li>Improved baseline security posture with minimal budget.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1) Is \u201cCloud Guard\u201d the current service name in Oracle Cloud?<\/h3>\n\n\n\n<p>Yes\u2014<strong>Cloud Guard<\/strong> is the OCI service name used in the Oracle Cloud Console and documentation. Always confirm current naming in the official docs: https:\/\/docs.oracle.com\/en-us\/iaas\/cloud-guard\/home.htm<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2) Is Cloud Guard free?<\/h3>\n\n\n\n<p>Cloud Guard is commonly listed as <strong>no additional charge<\/strong> on OCI pricing (verify for your region\/contract). You may still pay for integrated services (Notifications, Functions, Logging, data egress). See: https:\/\/www.oracle.com\/cloud\/price-list\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3) What is the \u201creporting region\u201d?<\/h3>\n\n\n\n<p>It is the region where Cloud Guard stores\/aggregates its reporting data for the tenancy. Choose it intentionally for operations and data residency. Verify exact behavior and change constraints in docs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4) Do I need to enable Cloud Guard in every region?<\/h3>\n\n\n\n<p>Often, yes\u2014Cloud Guard coverage depends on region enablement for the regions where resources run. Confirm region behavior in current documentation for your tenancy.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5) What is a target in Cloud Guard?<\/h3>\n\n\n\n<p>A <strong>target<\/strong> defines the scope Cloud Guard monitors (commonly one or more compartments) and the detector\/responder recipes applied to that scope.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6) What\u2019s the difference between detector recipes and responder recipes?<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Detector recipes<\/strong> define <em>what Cloud Guard detects<\/em>.<\/li>\n<li><strong>Responder recipes<\/strong> define <em>how Cloud Guard responds<\/em> (notify or take actions, depending on rule support).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Can Cloud Guard automatically fix issues?<\/h3>\n\n\n\n<p>It can support automated response via responders for certain scenarios, but capabilities vary. Start with notify-only, then carefully test responders and permissions before enabling auto-remediation. Verify current responder actions in docs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">8) How quickly will Cloud Guard detect a risky change?<\/h3>\n\n\n\n<p>Detection timing varies by detector type and service signals. Some issues may appear within minutes; others may take longer. Plan for non-instant detection and verify expectations with official documentation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">9) Does Cloud Guard replace OCI Audit?<\/h3>\n\n\n\n<p>No. <strong>OCI Audit<\/strong> records API calls and changes. Cloud Guard uses signals to create higher-level security problems and guidance. Use both: Audit for forensics; Cloud Guard for detection and triage.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">10) Does Cloud Guard replace a SIEM?<\/h3>\n\n\n\n<p>No. Cloud Guard provides security findings for OCI and a problems workflow. A SIEM provides broad log ingestion, long retention, advanced correlation, and forensic search across many sources.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">11) Can I integrate Cloud Guard with email, Slack, or ticketing?<\/h3>\n\n\n\n<p>Yes, commonly through <strong>OCI Events<\/strong> and <strong>Notifications<\/strong>, optionally with <strong>Functions<\/strong> or an HTTPS subscription endpoint. Exact integration patterns depend on your tooling.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">12) How do I reduce false positives?<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>managed lists<\/strong> for approved exceptions.<\/li>\n<li>Clone and tune <strong>detector recipes<\/strong>.<\/li>\n<li>Adjust alert routing: page only for high\/critical; ticket for medium; dashboard for low.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">13) Can different teams manage their own Cloud Guard settings?<\/h3>\n\n\n\n<p>Usually, Cloud Guard configuration is centralized for governance, while teams remediate issues in their compartments. You can delegate read-only access and remediation responsibilities while keeping recipe\/target control with security admins.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">14) What should I do before enabling responders that change resources?<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Test in non-production targets first.<\/li>\n<li>Review required IAM permissions and blast radius.<\/li>\n<li>Create a rollback plan and change-management process.<\/li>\n<li>Start with human-in-the-loop (notify-only) mode.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">15) What\u2019s a good first deployment approach?<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable Cloud Guard.<\/li>\n<li>Create targets for prod and nonprod.<\/li>\n<li>Start with default recipes.<\/li>\n<li>Integrate problem events to Notifications via Events.<\/li>\n<li>Tune over 2\u20134 weeks based on signal quality.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Cloud Guard<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Cloud Guard Docs<\/td>\n<td>Authoritative feature descriptions, concepts (targets\/recipes\/problems), configuration guidance. https:\/\/docs.oracle.com\/en-us\/iaas\/cloud-guard\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>OCI Price List<\/td>\n<td>Verify Cloud Guard pricing status and related service costs. https:\/\/www.oracle.com\/cloud\/price-list\/<\/td>\n<\/tr>\n<tr>\n<td>Pricing calculator<\/td>\n<td>OCI Cost Estimator<\/td>\n<td>Model costs for integrated services (Notifications, Functions, Logging). https:\/\/www.oracle.com\/cloud\/costestimator.html<\/td>\n<\/tr>\n<tr>\n<td>Official docs (IAM)<\/td>\n<td>OCI Identity and Access Management Docs<\/td>\n<td>Required to implement least privilege and safe responders. https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official docs (Events)<\/td>\n<td>OCI Events Service Docs<\/td>\n<td>Build event-driven alerting\/automation from Cloud Guard problems. https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Events\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official docs (Notifications)<\/td>\n<td>OCI Notifications Docs<\/td>\n<td>Configure topics\/subscriptions for Cloud Guard alerts. https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Notification\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official docs (Audit)<\/td>\n<td>OCI Audit Docs<\/td>\n<td>Investigate changes related to Cloud Guard findings. https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Audit\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official architecture<\/td>\n<td>OCI Architecture Center<\/td>\n<td>Reference architectures for governance\/security patterns (search for Cloud Guard and security posture). https:\/\/docs.oracle.com\/en\/solutions\/<\/td>\n<\/tr>\n<tr>\n<td>Hands-on labs<\/td>\n<td>Oracle LiveLabs<\/td>\n<td>Free guided labs; search catalog for \u201cCloud Guard\u201d and OCI security labs. https:\/\/apexapps.oracle.com\/pls\/apex\/r\/dbpm\/livelabs\/home<\/td>\n<\/tr>\n<tr>\n<td>CLI tooling<\/td>\n<td>OCI CLI Documentation<\/td>\n<td>Automate Cloud Guard-related workflows (verify current CLI commands). https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/API\/SDKDocs\/cliinstall.htm<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<p>The following providers may offer training related to Oracle Cloud, DevOps, SRE, and cloud security practices. Verify current course titles and Oracle Cloud\/Cloud Guard coverage on their websites.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Institute<\/th>\n<th>Suitable Audience<\/th>\n<th>Likely Learning Focus<\/th>\n<th>Mode<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps engineers, SREs, platform teams, beginners to advanced<\/td>\n<td>DevOps tooling, cloud operations, security fundamentals (verify OCI-specific coverage)<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>ScmGalaxy.com<\/td>\n<td>Beginners, engineers transitioning to DevOps<\/td>\n<td>SCM, DevOps foundations, CI\/CD, operations practices<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.scmgalaxy.com\/<\/td>\n<\/tr>\n<tr>\n<td>CLoudOpsNow.in<\/td>\n<td>Cloud engineers, operations teams<\/td>\n<td>Cloud operations, monitoring, reliability practices<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.cloudopsnow.in\/<\/td>\n<\/tr>\n<tr>\n<td>SreSchool.com<\/td>\n<td>SREs, operations engineers, architects<\/td>\n<td>Reliability engineering, incident response, monitoring<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.sreschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>AiOpsSchool.com<\/td>\n<td>SREs, ops teams, automation engineers<\/td>\n<td>AIOps concepts, automation, observability<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.aiopsschool.com\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<p>These sites are presented as trainer\/platform resources. Verify current Oracle Cloud and Cloud Guard offerings directly.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Platform\/Site<\/th>\n<th>Likely Specialization<\/th>\n<th>Suitable Audience<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>RajeshKumar.xyz<\/td>\n<td>DevOps\/cloud training content (verify OCI focus)<\/td>\n<td>Beginners to intermediate engineers<\/td>\n<td>https:\/\/rajeshkumar.xyz\/<\/td>\n<\/tr>\n<tr>\n<td>devopstrainer.in<\/td>\n<td>DevOps and cloud training (verify OCI modules)<\/td>\n<td>DevOps engineers, platform teams<\/td>\n<td>https:\/\/www.devopstrainer.in\/<\/td>\n<\/tr>\n<tr>\n<td>devopsfreelancer.com<\/td>\n<td>Freelance DevOps guidance and services (verify training availability)<\/td>\n<td>Small teams, startups<\/td>\n<td>https:\/\/www.devopsfreelancer.com\/<\/td>\n<\/tr>\n<tr>\n<td>devopssupport.in<\/td>\n<td>DevOps support and training resources (verify OCI content)<\/td>\n<td>Ops\/DevOps practitioners<\/td>\n<td>https:\/\/www.devopssupport.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<p>These organizations may provide consulting related to DevOps, cloud operations, and security programs. Verify Oracle Cloud and Cloud Guard-specific consulting offerings on their sites.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Company<\/th>\n<th>Likely Service Area<\/th>\n<th>Where They May Help<\/th>\n<th>Consulting Use Case Examples<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>cotocus.com<\/td>\n<td>Cloud\/DevOps consulting (verify OCI specialization)<\/td>\n<td>Cloud adoption, operations, automation<\/td>\n<td>Cloud governance setup, alerting pipelines, security posture operationalization<\/td>\n<td>https:\/\/cotocus.com\/<\/td>\n<\/tr>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>Training + consulting services (verify current portfolio)<\/td>\n<td>DevOps transformation, platform enablement<\/td>\n<td>Building incident response workflows around Cloud Guard events; implementing compartment\/tag governance<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>DEVOPSCONSULTING.IN<\/td>\n<td>DevOps consulting (verify current offerings)<\/td>\n<td>CI\/CD, infra automation, cloud ops<\/td>\n<td>Integrating Cloud Guard notifications into ticketing\/chatops; building runbooks and automation<\/td>\n<td>https:\/\/devopsconsulting.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before Cloud Guard<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI fundamentals:<\/li>\n<li>Tenancy, regions, availability domains<\/li>\n<li>Compartments and organization design<\/li>\n<li>OCI IAM:<\/li>\n<li>users, groups, policies, dynamic groups<\/li>\n<li>least privilege and compartment boundaries<\/li>\n<li>OCI networking basics:<\/li>\n<li>VCNs, subnets, route tables, security lists, NSGs<\/li>\n<li>OCI observability basics:<\/li>\n<li>Audit<\/li>\n<li>Events<\/li>\n<li>Notifications<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after Cloud Guard<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Security automation:<\/li>\n<li>OCI Events \u2192 Functions pipelines<\/li>\n<li>webhook integrations to ITSM\/chatops<\/li>\n<li>Governance:<\/li>\n<li>tagging strategies, policy-as-code, change control<\/li>\n<li>Advanced security services:<\/li>\n<li>OCI Vault (secrets and keys)<\/li>\n<li>Vulnerability scanning (verify the current OCI service scope)<\/li>\n<li>Central logging\/analytics and SIEM integrations<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use Cloud Guard<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Security Engineer \/ Cloud Security Architect<\/li>\n<li>SOC Analyst (cloud-focused)<\/li>\n<li>Platform Engineer (landing zone owner)<\/li>\n<li>DevOps Engineer \/ SRE (incident response and remediation)<\/li>\n<li>Compliance \/ Risk Analyst (control evidence)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (if available)<\/h3>\n\n\n\n<p>Oracle certifications change over time. Look for current Oracle Cloud certifications and security-related tracks on Oracle University and official certification pages. Verify current certification alignment with Cloud Guard:\nhttps:\/\/education.oracle.com\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build a \u201csecurity baseline\u201d:<\/li>\n<li>create prod\/nonprod targets<\/li>\n<li>tune detector recipes<\/li>\n<li>create managed lists for approved CIDRs<\/li>\n<li>Implement alert routing:<\/li>\n<li>critical\/high \u2192 paging or priority email<\/li>\n<li>medium \u2192 ticket<\/li>\n<li>low \u2192 daily digest<\/li>\n<li>Build an automation prototype:<\/li>\n<li>Events \u2192 Function \u2192 create ticket + enrich with compartment tags<\/li>\n<li>Create a monthly posture report workflow:<\/li>\n<li>export problem summaries<\/li>\n<li>track top recurring problems and remediation times<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI (Oracle Cloud Infrastructure):<\/strong> Oracle Cloud platform providing compute, networking, storage, and managed services.<\/li>\n<li><strong>Tenancy:<\/strong> Your top-level OCI account boundary containing compartments, policies, and resources.<\/li>\n<li><strong>Region:<\/strong> Geographic area where OCI resources run; Cloud Guard enablement can be region-dependent.<\/li>\n<li><strong>Reporting region:<\/strong> The region where Cloud Guard stores\/aggregates its reporting data for the tenancy.<\/li>\n<li><strong>Compartment:<\/strong> A logical container for organizing OCI resources and applying IAM policies.<\/li>\n<li><strong>Target (Cloud Guard):<\/strong> Defines the scope Cloud Guard monitors (often a compartment) and which recipes apply.<\/li>\n<li><strong>Detector:<\/strong> A rule or capability that identifies risky configuration or suspicious activity.<\/li>\n<li><strong>Detector recipe:<\/strong> A packaged set of detector rules applied to a target.<\/li>\n<li><strong>Responder:<\/strong> A rule or capability that reacts to a problem (notification and\/or remediation depending on support).<\/li>\n<li><strong>Responder recipe:<\/strong> A packaged set of responder rules applied to a target.<\/li>\n<li><strong>Managed list:<\/strong> A centrally managed allowlist\/denylist used by detectors for tuning.<\/li>\n<li><strong>Problem:<\/strong> A prioritized security issue created by Cloud Guard from findings, typically with risk\/severity and remediation guidance.<\/li>\n<li><strong>OCI Events:<\/strong> Service that routes events from OCI services to actions\/targets for automation.<\/li>\n<li><strong>OCI Notifications:<\/strong> Service that delivers messages to subscribers (email, SMS, HTTPS, etc., depending on configuration).<\/li>\n<li><strong>Security list \/ NSG:<\/strong> OCI virtual firewall constructs controlling allowed ingress\/egress to subnets or VNICs.<\/li>\n<li><strong>Least privilege:<\/strong> Security practice of granting only the minimum permissions needed to perform a task.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p><strong>Cloud Guard<\/strong> in <strong>Oracle Cloud<\/strong> (Security, Identity, and Compliance) is OCI\u2019s native service for continuous security posture monitoring and threat\/activity detection signals, turning findings into prioritized <strong>problems<\/strong> and enabling operational response through <strong>recipes<\/strong>, <strong>targets<\/strong>, and integrations like <strong>Events<\/strong> and <strong>Notifications<\/strong>.<\/p>\n\n\n\n<p>It matters because OCI environments change constantly\u2014Cloud Guard helps you detect risky exposure and policy drift early, route issues to the right owners, and build a repeatable triage and remediation workflow.<\/p>\n\n\n\n<p>Cost-wise, Cloud Guard is commonly listed as <strong>no additional charge<\/strong> (verify on Oracle\u2019s pricing pages), but real costs show up in <strong>integrations and operations<\/strong>: notifications volume, automation executions, logging\/retention, and on-call time if you don\u2019t tune recipes.<\/p>\n\n\n\n<p>Use Cloud Guard when you need OCI-native, compartment-aware, continuous security monitoring with a clear problems workflow. Pair it with strong IAM design, event-driven alerting, and (if needed) deeper logging\/SIEM capabilities.<\/p>\n\n\n\n<p>Next step: review the official Cloud Guard docs and run a controlled pilot in a non-production compartment, then expand to production with tuned recipes and an incident-ready response process.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Security, Identity, and Compliance<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[62,39],"tags":[],"class_list":["post-975","post","type-post","status-publish","format-standard","hentry","category-oracle-cloud","category-security-identity-and-compliance"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/975","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=975"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/975\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=975"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=975"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=975"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}