Configure Oracle Cloud Guard for Arctic Wolf monitoring

You can configure Oracle Cloud Guard® to send the necessary logs to Arctic Wolf® for security monitoring.

Note: Oracle Cloud Guard log monitoring is not supported for government-specific Oracle Cloud Infrastructure (OCI) regions.

These resources are required:

  • Access to the Oracle Cloud Console with administrator permissions
  • OpenSSL software library
  • Python 3
  • Linux or Mac OS X
    Note: For Windows support, contact your Concierge Security® Team (CST).

Create a group

  1. Sign in to the Oracle Cloud Console with administrator permissions.
  2. In the navigation menu, click Identity & Security > Domains.
  3. In the Name column, click Default.
  4. On the User management tab, in the Groups section, click Create group.
  5. On the Create group page, enter a name and description for the group.
  6. Click Create.

Create a policy

  1. Sign in to the Oracle Cloud Console with administrator permissions.
  2. In the navigation menu, click Identity & Security > Policies.
  3. On the Policies page, click Create Policy.
  4. On the Create Policy page, configure these settings:
    • Name — Enter a name for the policy.
    • Description — Enter a description for the policy.
    • Compartment — Select the root compartment from the list.
  5. In the Policy Builder section, click Show manual editor.
  6. In the field, enter:
    CODE 
    allow group <new_group> to read cloud-guard-family in tenancy
allow group <new_group> to read compartments in tenancy
    Where:
  7. Click Create.

Create a user

  1. Sign in to the Oracle Cloud Console with administrator permissions.
  2. In the navigation menu, click Identity & Security > Domains.
  3. In the Name column, click Default.
  4. On the User management tab, in the Users section, click Create.
  5. On the Create user page, configure these settings:
    • First name — Enter the first name of the user.
    • Last name — Enter the last name of the user.
    • Username / Email — Enter an email address for the user.
    • Use the email address as the username — Make sure that the toggle is in the on position.
    • Groups — Select the group that you created in Create a group.
  6. Click Create.

Generate private and public API keys

  1. Open your preferred terminal application.
  2. Run this command to create an .oci directory to store the key:
    CODE 
    mkdir ~/.oci
  3. Run this command to navigate to the Oracle Cloud Infrastructure directory:
    CODE 
    cd ~/.oci/
  4. Run this command to generate a private key that is encrypted with your own passphrase:
    CODE 
    openssl genrsa -out oci_api_key.pem -aes128 2048
  5. Run this command to start the Python interpreter:
    CODE 
    python
  6. Run this command to open the private key:
    CODE 
    f = open('oci_api_key.pem')
  7. Run this command to read the private key:
    CODE 
    f.read()
  8. Copy the output from f.read() and paste it into a new JSON file with this format:
    JSON 
    {"content": "-----ADD PRIVATE KEY-----\n..."}
    You will provide this file to Arctic Wolf later.
  9. Run this command to close the private key and exit the interpreter:
    CODE 
    f.close()
  10. Run this command to change the file permission so that only you can read the file:
    CODE 
    chmod go-rwx oci_api_key.pem
  11. Run this command to generate a public key from your private key:
    CODE 
    openssl rsa -pubout -in oci_api_key.pem -out oci_api_key_public.pem
    You will provide the public key to Oracle and the private key to Arctic Wolf.

Add a public API key

  1. Sign in to the Oracle Cloud Console with administrator permissions.
  2. In the navigation menu, click Identity & Security > Domains.
  3. In the Name column, click Default.
  4. On the User management tab, in the Users section, click the user that you created in Create a user.
  5. On the user page, on the API keys tab, click Add API key.
  6. In the Add API key panel, select Choose public key file.
  7. Upload the public key file that you generated in Generate private and public API keys.
  8. Click Add.
    The Configuration file preview window opens.
  9. In the Configuration file preview window, copy the user, fingerprint, tenancy, and region values and paste them in a safe, encrypted location.
    You will provide these values to Arctic Wolf later.

Provide Oracle Cloud Guard credentials to Arctic Wolf

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Data Collection > Cloud Sensors.
  3. Click Add Account +.
  4. On the Add Account page, click Oracle Cloud Guard.
  5. Configure these settings:
  6. Click Test and submit credentials.
  7. Delete the private and public key files from your computer.