Control: 4.13 Ensure VCN flow logging is enabled for all subnets

Description

VCN flow logs record details about traffic that has been accepted or rejected based on the security list rule.

Enabling VCN flow logs enables you to monitor traffic flowing within your virtual network and can be used to detect anomalous traffic.

Remediation

From Console

First, if a Capture filter has not already been created, create a Capture Filter by the following steps:

Go to the Network Command Center page (https://cloud.oracle.com/networking/network-command-center).
Click 'Capture filters'.
Click 'Create Capture filter'.
Type a name for the Capture filter in the Name box.
Select 'Flow log capture filter'.
For Sample rating select 100%.
Scroll to Rules.
For Traffic disposition select All.
For Include/Exclude select Include.
Level Source IPv4 CIDR or IPv6 prefix and Destination IPv4 CIDR or IPv6 prefix empty.
For IP protocol select Include.
Click Create Capture filter.

Second, enable VCN flow logging for your VCN or subnet(s) by the following steps:

Go to the Logs page.
Click the Enable Service Log button in the middle of the screen.
Select the relevant resource compartment.
Select Virtual Cloud Networks - Flow logs from the Service drop down menu.
Select the relevant resource level from the resource drop down menu either VCN or subnet.
Select the relevant resource from the resource drop down menu.
Select the from the Log Category drop down menu that either Flow Logs - subnet records or Flow Logs - vcn records.
Select the Capture filter from above
Type a name for your flow logs in the Log Name text box.
Select the Compartment for the Log Location
Select the Log Group for the Log Location or Click Create New Group to create a new log group
Click the Enable Log button in the lower left-hand corner.

Usage

Run the control in your terminal:

powerpipe control run oci_compliance.control.cis_v300_4_13

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run oci_compliance.control.cis_v300_4_13 --share

SQL

This control uses a named query:

with subnets_with_flowlog as (
  select
    configuration -> 'source' ->> 'resource' as subnet_id,
    lifecycle_state
  from
    oci_logging_log
  where
    configuration -> 'source' ->> 'service' = 'flowlogs'
    and lifecycle_state = 'ACTIVE'
)
select
  s.id as resource,
  case
    when a.subnet_id is null then 'alarm'
    else 'ok'
  end as status,
  case
    when a.subnet_id is null then s.title || ' flow logging disabled.'
    else s.title || ' flow logging enabled.'
  end as reason
  
  , s.region as region, s.tenant_name as tenant
  , coalesce(c.name, 'root') as compartment
from
  oci_core_subnet as s
  left join subnets_with_flowlog as a on s.id = a.subnet_id
  left join oci_identity_compartment as c on c.id = s.compartment_id;

Control: 4.13 Ensure VCN flow logging is enabled for all subnets

Description

Remediation

From Console

Usage

SQL

Tags