In Oracle Cloud Infrastructure (OCI), Network Security Groups (NSGs) are critical controls that regulate inbound and outbound traffic to cloud resources. Deletion of NSG security rules can immediately expose systems to unauthorized access, posing significant security and compliance risks. During implementation, it was identified that OCI Console did not provide a native event type to generate alerts when NSG security rules were deleted (Add & Update security rules are there as part of Event Type dropdown but not delete rule). This created a monitoring blind spot where accidental or malicious network exposure changes could occur without real-time visibility. Detection depended on manual audits or post-incident investigation, increasing the risk of delayed response and prolonged security exposure.
To close this gap, a custom backend-driven monitoring mechanism was developed. A controlled proof of concept (POC) NSG rule deletion was performed, and OCI Audit Logs were analyzed to identify the underlying backend event name "removenetworksecuritygroupsecurityrules", which is not exposed in the OCI Console event type list dropdown menu.
Using OCI CLI, a manual event rule was created in JSON format by defining this event name and linking it to the OCI Notifications service with active email subscriptions. Once deployed, the rule became visible and manageable through the OCI Console. This enables real-time alerts to stakeholders whenever NSG security rules are deleted, extending OCI’s native monitoring capabilities without requiring third-party tools.
(JSON file rule is attached)
NSGSecurityRuleDeletionDetection.json.txt