Send Email Alerts for OCI Security List Changes Using Events and Notifications
Security Lists are an important part of network security in
Oracle Cloud Infrastructure. They control ingress and egress traffic at the
subnet level. A small change in a Security List rule can allow new traffic,
block an application, or open a port that was not expected. In real
environments, it is not enough to manually review Security List changes after
an issue occurs. If you want more details on how to manually review security
list changes, kindly refer “OCI
Logging – Auditing VCN Security list changes”. Manual Audit Log review is useful during
investigation, but it is reactive. With OCI Events and Notifications, we can
make the process proactive. This pattern helps us receive immediate visibility
when network security rules are changed. It is especially useful for
environments where Security List changes should be reviewed by cloud
administrators, security teams, or network teams.
We need a proactive alert mechanism so that administrators
are notified when a Security List is created, updated, or deleted.
Oracle Cloud Infrastructure provides an event driven way to
achieve this using OCI Events and OCI Notifications. In this
article, we will create an email alert whenever a Security List change happens
in OCI. We will use OCI services Virtual
Cloud Network, Security List, OCI Events, OCI Notifications.
Prerequisites
We need following resources to perform this alert mechanism.
OCI tenancy
access
Required compartment
Existing VCN
Existing Security List
Permission to create Notification topic
Permission to create Events rule
Valid email address for receiving notification
Permission to modify Security List rules for testing
For this exercise we will use an existing Security List and
add a temporary ingress rule to validate the alert.
Step 1: Create Notification Topic
First, we will create a Notification topic. This topic will
be used by the Events rule to send the Security List change alert.
From the OCI Console, navigate to:
Developer Services → Application Integration → Notifications
Create a topic with a meaningful name.
Example topic name:
security-list-change-alert-topic
After the topic is created, it will be used as the target
for the Events rule.
Step 2: Create Email Subscription
After creating the Notification topic, create an email
subscription.
Use the following subscription protocol:
Email
Provide the email address that should receive the Security
List change alerts.
Once the subscription is created, OCI sends a confirmation
email to the recipient. The subscription remains in pending status until the
confirmation link is accepted.
The email subscription must be confirmed before alert emails
can be received.
After confirmation, the subscription status changes to
active.
Step 3: Create Events Rule
Next, we will create an Events rule to capture Security List
changes.
From the OCI Console, navigate to:
Observability & Management → Events Service → Rules
Create a new rule.
Example rule name:
security-list-change-alert-rule
Add a short description.
Example:
Rule for alerting security list changes. Send email
notification when Security List is created, updated, or deleted.
The rule should be created in the compartment where the
Security List events need to be monitored.
Step 4: Configure Events Rule Condition
In the Events rule condition, select the Networking service
and Security List event types.
The important Security List event types are:
Create Security List
Update Security List
Delete Security List
For most operational scenarios, Update Security List
is the most important event because adding, removing, or modifying ingress and
egress rules updates the Security List.
For this article, we will configure the rule to capture
Security List update, create and delete events. This makes the alert mechanism
more complete.
Step 5: Configure Notification Action
After defining the rule condition, configure the action.
Use the following action type:
Notifications
Select the Notification topic created earlier.
Example topic:
security-list-change-alert-topic
After the rule is created, OCI Events will monitor Security
List events and send matching events to the Notification topic.
Step 6: Modify Security List Rule for Testing
Now we will validate the setup by modifying a Security List.
Open the required VCN and select a Security List.
Add a temporary ingress rule.
Example test rule:
Source CIDR: 10.0.0.0/16
IP Protocol: TCP
Destination Port Range: 8080
Description: Temporary rule for security list alert
validation
Save the Security List change.
This update should generate a Security List update event.
The Events rule should match the event and send a message to the Notification
topic.
Step 7: Validate Email Alert
After saving the Security List change, check the subscribed
email inbox.
The alert email should include event details in JSON format.
The message usually contains useful information such as:
eventType
eventTime
compartmentId
resourceName
resourceId
These fields help identify what changed, when it changed,
and who performed the activity. A small delay in email delivery is normal.
Step 8: Remove the Temporary Test Rule
After validating the alert, remove the temporary test rule
from the Security List.
Example rule to remove:
Source CIDR: 10.0.0.0/16
Protocol: TCP
Destination Port: 8080
After removing the rule, another Security List update event
should be generated. This means another email alert may be received.
This confirms that both rule addition and rule removal are
captured by the event-driven alert mechanism. For example, if an application
suddenly becomes reachable on a new port or stops responding after a network
rule change, the alert email can help identify that a Security List was
recently modified.
This is a simple and effective governance pattern for OCI
networking. It helps us move from manual Audit Log review to proactive
notification whenever Security List changes happen. This approach improves
visibility into network security changes without requiring Cloud Guard,
Security Zones, custom scripts, or additional monitoring tools.
