Oracle Cloud Infrastructure

FortiSIEM Support Added: 6.4.0

Vendor: Oracle

Product Information: https://www.oracle.com/cloud/

• Configuration

• Streams Log Ingestion Information

• Sample Event

Configuration

• Setup in Oracle

• Setup in FortiSIEM

Setup in Oracle

Complete these steps from the Oracle Cloud Portal.

Create a User for FortiSIEM Integration

1. Login to Oracle Cloud.

2. In the Search Bar, enter "users".

3. Select Services > Users.

4. Click Create User.

5. Select IAM User and take the following steps.

   1. In the Name field, enter a name, such as "fortisiem-user".

   2. In the Description field, enter a description, such as "Used by FortiSIEM to ingest logs using Streams integration".

   3. Leave the other options as default.

   4. Click Create.

Generate an API Key for the User

1. On the Users page, from the left panel, select Resources > API Keys.
   Note: You should be re-directed to the Users page after creating a user.
   

2. Click Add API Key.

3. At the Pop Up, generate a key pair or upload an existing public key by taking the following steps.

   1. Select Generate API Key Pair. If you already have an RSA Key Pair, you can select or paste your public key instead.

   2. Click Download Private Key. You'll need this to upload to FortiSIEM later.

   3. Click Add.

   4. The next page outputs your API Key Config File. Copy this and save the entire config file to a text file. You'll need these items to upload to FortiSIEM.

   5. Click Close.

Create a Stream for Audit Logs

1. From Oracle Cloud, in the search bar, search for Services > Streaming.

2. Click Create Stream, and take the following steps.

   1. In the Stream Name field, enter a name, such as "fortisiem-stream".

   2. In the Compartment drop-down, select Root Compartment.

   3. Select Existing > Stream Pool: DefaultPool or Create Stream Pool.
      

      Note: A pool is a logical grouping of resources, not necessarily required to create a new one from default.

   4. In Define Stream Settings, enter the following:
      

      Retention: 24

      Number of Partitions: 5

      Note: You will scale this based on number of logs. 5 partitions provides 5MB/s write, and 10MB/s read. Increase this number if you believe the audit log volume will be significant. If you encounter a tenancy limit, open a case with Oracle to increase the limit and change it to a higher number. 1 may not be enough throughput if the volume of logs written exceeds 1MB/s.

   5. Click Create.

   6. Click on the created Streams Stream Information section.

   7. Select OCID. Record the ID for later use.

   8. In the same Stream Information section, record the Messages Endpoint URL for later use.

Create a Service Connector

A Service Connector is required to tell Oracle to ship logs from its logging service to a Stream.

1. Search for Service Connectors.

2. Click Service Connectors, and take the following steps.

   1. In the Connector Name field, enter a name, such as "fortisiem-connector".

   2. In the Description field, enter a description, such as "Connector to ship audit logs to fortisiem-stream".

   3. For Compartment, select Root compartment.

   4. For Source, select Logging.

   5. For Target, select Streaming.

   6. For Configure Source, take the following steps.

      1. In the Compartment Name field, enter a name, such as "root compartment".

      2. For Log Group:_Audit, select checkbox for Include_Audit in subcompartments.

   7. For Configure Target, take the following steps.

      1. For Compartment, select Root Compartment.

      2. For Stream, select fortisiem-stream.

   8. Click Create. If the system prompts you to create a default publishing policy to allow Connector to publish logs to stream, click Create.

Create a User Group and Add User to the Group

1. Login to Oracle Cloud.

2. Go to Services > Groups.

3. Click Create Group and take the following steps.

   1. In the Name field, enter a name, such as "fortisiem-group".

   2. In the Description field, enter a description, such as "Group for fortisiem user."

   3. Click Create.

4. Once the group is created, click Add User to Group.

5. Select User fortisiem-user, and click Add.

Create Policy to Allow User to Consume FortiSIEM-stream

1. Search for Services > Policies.
   

   Note: This is done to look for Identity policies.

2. Under List Scope, select Root compartment.

3. Click Create Policy, and take the following steps.

   1. In the Name field, enter a name, such as "fortisiem-policy".

   2. In the Description field, enter a description, such as "Policy for permitting fortisiem-group and fortisiem-user access to pull streams".

   3. In the Policy Builder, select Show manual editor.

   4. Paste this policy, replacing the OCID with the OCID of the Stream that was created earlier.
      

      #Template: Allow group <group_name> to use stream-pull in tenancy where target.stream.id = '<stream_ocid>'
      Allow group fortisiem-group to use stream-pull in tenancy where target.stream.id = 'ocid1.stream.oc1.iad.xxxxx'
      

   
   

Setup in FortiSIEM

FortiSIEM processes events from Oracle Cloud Infrastructure.

Complete these steps in the FortiSIEM UI:

1. For Multi-tenant users, change the scope to the appropriate FortiSIEM organization you want to configure Oracle OCI for.
2. Go to the ADMIN > Setup > Credentials tab.
3. In Step 1: Enter Credentials, click New.
   1. Follow the instructions in “Setting Credentials“ in the User's Guide to create a new credential.
   2. Enter these settings in the Access Method Definition dialog box, and click Save when done.

      Settings	Description
      Name	Enter a name for the credential.
      Device Type	Oracle Cloud Infrastructure
      Access Protocol	Streams
      Pull Interval	Leave the default.
      Message Endpoint	Enter the streams URL you recorded earlier.
      Stream OCID	Enter the OCID of the stream created earlier.
      User Config File	Upload the config file.
      User Private Key	Upload the key.
      Log Keyword	Leave the default option, which is OCI_AUDIT_LOG.

4. In Step 2: Enter IP Range to Credential Associations, if you have more than one FortiSIEM collector, select the collector that will do the polling from the drop-down list. Note: A drop-down list will not appear if you only have one collector.
5. Click New.
   1. Select the credential name you created (during step 3a) from the Credentials drop-down list. The IP/Host Name field should auto populate the URL.
   2. Click Save.
6. Click the Test drop-down list and select Test Connectivity without Ping to test the connection.
7. Wait for approximately 5 minutes.
8. Navigate to ADMIN > Setup > Pull Events table to check for the new job.
9. Navigate to ANALYTICS, and confirm that events appear.

Streams Log Ingestion Information

Oracle Streams can be used to ingest any log type, from any source including custom locations. If you'd like to ingest logs from services other than Audit,

you can create a separate Stream credential, and changing the Log Keyword to attach a header to each ingested log identifying what it is.

Audit log format is : OCI_AUDIT_LOG: {Log Message}

If you were ingesting from a custom log format, you could change the header to OCI_CUSTOM_APP1. You could then write a custom log parser for that data.

Example Log format: OCI_CUSTOM_APP1: {json log}

Sample Event

Event Type: Oracle-databaseservice-listautonomousdatabases

1 192.0.2.10 oraclecloud.com OCI_AUDIT_LOG1: {"data":{"additionalDetails":null,"availabilityDomain":"AD1","compartmentId":"ocid1.tenancy.oc1..aaaaaaaaegzp63kezjhyhycdzpmknqs5augg6r7qcgqy5am4lt3h6j3koxkq","compartmentName":"evansr","definedTags":null,"eventGroupingId":null,"eventName":"ListAutonomousDatabases","freeformTags":null,"identity":{"authType":null,"callerId":null,"callerName":null,"consoleSessionId":null,"credentials":"ST$eyJraWQiOiJhc3dfb2MxX2o0eGQiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJvY2ktb3B0aW1pemVyIiwic3ZjIjoib2NpLW9wdGltaXplciIsImlzX3N2YyI6InRydWUiLCJvcGMtY2VydHR5cGUiOiJpbnN0YW5jZSIsImlzcyI6ImF1dGhTZXJ2aWNlLm9yYWNsZS5jb20iLCJmcHJpbnQiOiJENDo3MTowODoyNToxMDo4MTozRDowQzoyNDo0RDpEMzpDMTpFQTpCMTozQjo2OTo1QzpFRjo1NDpCOTo5NDoxODpENjpBODpCQzpDRjpEMzo1QzpDMDpGRjpBRDozNCIsInB0eXBlIjoic2VydmljZSIsInN2Y0hvc3RpbmdUZW5hbnRJZCI6Im9jaWQxLnRlbmFuY3kub2MxLi5hYWFhYWFhYTY0ZDRyb2QyY2dycWxleXNrZ2FvNHdrYmVvc3lscWVsbG1lcWJ2eHhreWJob25scmJna2EiLCJhdWQiOiJvY2kiLCJ0dHlwZSI6Ing1MDkiLCJvcGMtaW5zdGFuY2UiOiJvY2lkMS5pbnN0YW5jZS5vYzEuaWFkLmFudXdjbGpycWNpaWNscWM1emc3bWpmN2J3Z3JvYXlhNTRsb2F4N2RpcnhkYWhyaHF5Ym5mNmFzb2x1cSIsImV4cCI6MTYzNDI0MDYzNSwib3BjLWNvbXBhcnRtZW50Ijoib2NpZDEuY29tcGFydG1lbnQub2MxLi5hYWFhYWFhYXZ2M2lnY2g3cWhocGdkdmQ1bGR2bGZuNXJoNnRnYW14dmZmbXRpbmVkZzRoc3BibHFvY3EiLCJpYXQiOjE2MzQyMzk0MzUsImp0aSI6IjYwNTQyYzZlLWIyNjctNGQ1OC1iY2VjLWMzMWQ5MTE0YTkxMSIsInRlbmFudCI6Im9jaWQxLnRlbmFuY3kub2MxLi5hYWFhYWFhYTY0ZDRyb2QyY2dycWxleXNrZ2FvNHdrYmVvc3lscWVsbG1lcWJ2eHhreWJob25scmJna2EiLCJqd2siOiJ7XCJraWRcIjpcIkQ0OjcxOjA4OjI1OjEwOjgxOjNEOjBDOjI0OjREOkQzOkMxOkVBOkIxOjNCOjY5OjVDOkVGOjU0OkI5Ojk0OjE4OkQ2OkE4OkJDOkNGOkQzOjVDOkMwOkZGOkFEOjM0XCIsXCJuXCI6XCJyNGIzUjAzblZWMDNoWDRVeXhmMFFuM0xIV1VRWVQ5QTFIYlBWMFA3QmVZd2VGUEM0aE1zZlJyaFlkTnVOTnU3YkV1S3BQcUswX0l1OUR1OVdPd0E0S0MzZWhlVzJqeDBraUtPVFlsODF0UFpSN1hNdXdjNVM0REJQbFR0T3hjUnVoZEc5RXQzN054cGJMZlo1bnoycC1YM3dxdXlCWDdjbDdCOVhtSUU5eG9iRWRwZmJGUTZlXzhCbnRNZFd0M2lnRDV3eXNRWE42UnJQSnpmM1lpR0s3a1FLV2RTQkRCay1oUmQ0azBiT2lCc3ZqVldpS3pRc09zTE1pRFlYeE5RSU1QQUQzbEN5dVQ3U0MzNF9sWXc5RzRFcG5uUEpZVHhnS095VmFhdGJnWVJQdjM0dnRxUFZmRG1ISHQySko3MmFWM1VhcnMtbWlUZVp2NlBWM0t5OVFcIixcImVcIjpcIkFRQUJcIixcImt0eVwiOlwiUlNBXCIsXCJhbGdcIjpcIlJTMjU2XCIsXCJ1c2VcIjpcInNpZ1wifSIsIm9wYy10ZW5hbnQiOiJvY2lkMS50ZW5hbmN5Lm9jMS4uYWFhYWFhYWE2NGQ0cm9kMmNncnFsZXlza2dhbzR3a2Jlb3N5bHFlbGxtZXFidnh4a3liaG9ubHJiZ2thIn0.gAQKu1oHeleRotA6YTJYBtTjQ-a-PGrq6hEEm5Gn52n9JZ_mHGJJwhIXvBVF8JgDp1k756JteGPurGVBT2Lc-8HXHMxPRcQsqwK5JDpGGE7lRza-iZmsWxowNYbRRCi9X6Pvt2VfrjQbYRvgHknNpQbxuajjYQ3dpgI537oiT2q_eSn0BX-hfBHZM9d9-Q5MpWuKyklyVI_EsnXB0E2QquGZkX8Ic6xOR7eRG5drXxinHaZ9-qI0gXks7bwiF_hpql4L78fBd5CYCDaMAl0G64LBbk3mXET3Y0YK29cnD2CA4dQSKSUTA7rvunjI-kdCtlQJtmI5l-GR49Y7DrHOHQ","ipAddress":"192.0.2.1,192.0.2.2","principalId":"oci-optimizer/D4:71:08:25:10:81:3D:0C:24:4D:D3:C1:EA:B1:3B:69:5C:EF:54:B9:94:18:D6:A8:BC:CF:D3:5C:C0:FF:AD:34","principalName":"oci-optimizer","tenantId":"ocid1.tenancy.oc1..aaaaaaaa64d4rod2cgrqleyskgao4wkbeosylqellmeqbvxxkybhonlrbgka","userAgent":"Oracle-JavaSDK/1.33.1 (Linux/4.14.35-2047.507.7.6.el7uek.x86_64; Java/1.8.0_301; Java HotSpot(TM) 64-Bit Server VM GraalVM EE 20.3.3/25.301-b09-jvmci-20.3-b18)"},"message":"ListAutonomousDatabases succeeded","request":{"action":"GET","headers":{},"id":"ED35F1B2C831403C8FA1B1500476B546/E0454F83ACADEDC84F994F64A6DB8A2C/D8DDC2DE2394258B8964E3C5D2334ECA","parameters":{},"path":"/20160918/autonomousDatabases"},"resourceId":null,"response":{"headers":{},"message":null,"payload":null,"responseTime":"2021-10-14T19:32:02.519Z","status":"200"},"stateChange":{"current":null,"previous":null}},"dataschema":"2.0","id":"125d76e1-3064-4b86-a3f3-ef24fd36b504","oracle":{"compartmentid":"ocid1.tenancy.oc1..aaaaaaaaegzp63kezjhyhycdzpmknqs5augg6r7qcgqy5am4lt3h6j3koxkq","ingestedtime":"2021-10-14T19:32:06.259Z","loggroupid":"_Audit","tenantid":"ocid1.tenancy.oc1..aaaaaaaa64d4rod2cgrqleyskgao4wkbeosylqellmeqbvxxkybhonlrbgka"},"source":"","specversion":"1.0","time":"2021-10-14T19:32:02.218Z","type":"com.oraclecloud.DatabaseService.ListAutonomousDatabases"}