Cloud Guard

Get a global view of your security posture

You can monitor and detect issues across global Oracle Cloud Infrastructure tenancies consisting of compartments and resources, across all subscribed regions. This enables you to adopt a cloud security posture management strategy with a global and centralized approach to help keep your OCI tenancies secure. Cloud Guard identifies problems for newly created resources and can be applied to your root compartment and inherit every child compartment and resource.

Integrated and automated remediation

Cloud Guard provides integrated and automated remediation with detector recipes and responder recipes. A Cloud Guard responder is an action that Cloud Guard can take when a detector has identified a problem. There are two types of responders.

• Notification responder: sends problem details to Oracle Cloud Infrastructure Events Service
• Remediation responder: takes an action against a problem, either automatically or on confirmation from the user—all responder activity is logged as OCI Audit events

Users can configure responders to execute immediately or confirm with the user before executing. Users can also disable responders.

Integrated threat detection for user activities and user behaviors

The threat detection tool identifies critical events as problems and provides actionable recommendations for immediate response. The problems can be handled in three different ways.

• Remediated: fixed using the Cloud Guard responder
• Resolved: fixed using another process
• Dismissed: closed out

The threat detection tool proactively monitors budding incidents as they develop and gives a comprehensive view of the chain of events that drives scoring.

Integrate Cloud Guard with external SIEM tools

Cloud Guard allows for integration with OCI Events, OCI Notifications, and OCI Functions to provide robust extensibility. This means customers can export their Cloud Guard logs containing threat detection problem data to their centralized external security information and event management (SIEM) systems (such as IBM QRadar and Splunk) for further analysis and action. Customers also have the option to create tickets in their service management systems to address the identified problems.