Skip to content

Config Checks Reference

Jump to bottom
WebbinRoot edited this page Jul 28, 2026 · 2 revisions

ConfigChecker - Static Config Checks

Detailed reference for findings produced by modules run process_config_check (source: modules/everything/utilities/config_audit.py).

Table of Contents

How to Run

modules run process_config_check
modules run process_config_check --services networking,object_storage,identity_domains
modules run process_config_check --json-out config_audit.json
modules run process_config_check --quiet

Notes:

  • Checks run on saved SQLite data; stale/partial saves can hide findings.
  • Run enum_all (or focused enum_*) before config checks for best coverage.

How to Use This Page

Each service has two layers:

  • A compact summary table for quick triage.
  • Detailed finding write-ups: a plain-English What It Detects explanation, followed by a Detection Logic section spelling out the exact field/value conditions for readers who want the technical detail.

Quick logic interpretation (for the Detection Logic bullets):

  • field contains 'VALUE' means a positive string match drives the finding.
  • field is empty/missing/false means absence/disabled state drives the finding.
  • truthy(field) means true-like/enabled state checks.

Severity Model

Severity Meaning in this module
CRITICAL Immediate, high-confidence exposure/impact path requiring urgent response.
HIGH Strong security risk with high abuse potential.
MEDIUM Meaningful weakness that often needs additional conditions to abuse.
LOW Hardening/governance weakness with lower immediate impact.
INFO Context/hunting signal that improves visibility and posture understanding.

Coverage Summary

Total implemented finding types: 145 across 65 services.

Service Critical High Medium Low Info Total
analytics 0 0 2 0 0 2
api_gateway 1 2 1 0 0 4
apiaccesscontrol 0 0 1 2 0 3
artifact_registry 0 0 1 0 0 1
bastion 0 1 0 0 0 1
bds 0 1 0 0 0 1
block_storage 0 0 0 2 0 2
blockchain 0 0 1 0 0 1
cache 1 1 1 0 0 3
certificates 0 0 1 0 0 1
cloud_guard 0 0 1 1 0 2
compute 0 0 0 2 2 4
compute_instance_agent 0 0 0 0 2 2
container_registry 0 1 1 0 0 2
data_catalog 0 0 1 1 0 2
data_integration 0 0 1 0 0 1
data_safe 0 0 3 0 0 3
data_science 0 0 1 0 0 1
database 1 0 3 0 0 4
db_multicloud 0 0 1 1 0 2
delegate_access_control 0 1 1 0 0 2
devops 0 0 1 0 0 1
dns 0 0 1 0 0 1
email 0 0 4 0 0 4
events 0 0 1 1 0 2
file_storage 0 1 1 0 0 2
functions 0 0 2 0 0 2
fusion_apps 0 0 1 1 0 2
generative_ai 0 0 1 0 0 1
generative_ai_agent 0 0 3 0 0 3
goldengate 0 0 1 0 0 1
governance_rules 0 0 1 1 0 2
healthchecks 0 0 2 0 0 2
identity 1 0 0 1 0 2
identity_domains 0 0 2 2 0 4
integration 0 0 2 0 0 2
iot 0 0 2 0 0 2
kubernetes 0 0 1 0 0 1
lockbox 0 2 0 0 0 2
logging 0 0 1 1 0 2
managed_kafka 0 0 2 0 0 2
management_agent 0 0 2 0 0 2
monitoring 0 0 1 1 0 2
network_firewall 2 0 1 0 0 3
network_load_balancer 0 1 1 0 0 2
networking 0 3 2 1 0 6
notifications 0 0 1 0 0 1
object_storage 2 2 2 2 0 8
ocvp 0 0 1 0 0 1
opensearch 1 2 0 0 0 3
operator_access_control 0 1 1 0 0 2
os_management_hub 0 0 0 2 0 2
postgresql 0 0 1 0 0 1
queue 0 0 0 1 0 1
resource_manager 0 0 3 0 0 3
service_connector 0 0 1 1 0 2
streaming 0 0 1 2 0 3
tagging 0 0 2 0 0 2
tenant_manager 0 0 1 1 0 2
vault 0 0 1 1 0 2
visual_builder 0 0 2 0 0 2
vulnerability_scanning 1 0 2 0 0 3
waas 0 0 3 0 0 3
waf 0 0 1 1 0 2
wlms 0 0 1 2 0 3

Severity Distribution

Severity Count
CRITICAL 10
HIGH 19
MEDIUM 81
LOW 31
INFO 4

Service Index

Finding Catalog

Grouped by service; sorted by severity then issue code.

Analytics Cloud

Quick Triage

Issue Code Severity Source Table Trigger Fields
ANALYTICS_PUBLIC_ENDPOINT_NO_ACCESS_CONTROL MEDIUM analytics_instances network_endpoint_details.network_endpoint_type, network_endpoint_details.whitelisted_ips, network_endpoint_details.whitelisted_vcns, network_endpoint_details.whitelisted_services
ANALYTICS_PUBLIC_ENDPOINT_OPEN_CIDR_ALLOWLIST MEDIUM analytics_instances network_endpoint_details.network_endpoint_type, network_endpoint_details.whitelisted_ips

Details

ANALYTICS_PUBLIC_ENDPOINT_NO_ACCESS_CONTROL (MEDIUM)

What It Detects: The instance uses a PUBLIC network endpoint (network_endpoint_details.network_endpoint_type) with zero ingress access-control rules configured -- whitelisted_ips, whitelisted_vcns, and whitelisted_services are all empty or null. Per OCI's own documentation, Public Access Type combined with Access Control set to "Not Configured" means the instance is accessible through the public endpoint without restriction: all networks, including the Internet, have access. This is not merely weak protection -- it is equivalent to no access control at all.

Detection Logic (analytics_instances): flags a row when:

  • network_endpoint_details.network_endpoint_type contains 'PUBLIC'
  • network_endpoint_details.whitelisted_ips, .whitelisted_vcns, .whitelisted_services are all empty/missing

Typical Remediation: add ingress access-control rules (IP/CIDR, VCN, or Oracle-service allowlist, up to 20 rules total) via UpdateAnalyticsInstance or the console, or migrate the instance to a PRIVATE network endpoint if internet-facing access is not required.

Recommended Module Refresh: modules run enum_analytics --instances

ANALYTICS_PUBLIC_ENDPOINT_OPEN_CIDR_ALLOWLIST (MEDIUM)

What It Detects: The instance's public-endpoint ingress allowlist (whitelisted_ips) contains a wide-open CIDR entry (0.0.0.0/0, ::/0, or an equivalent any/all wildcard), which is functionally equivalent to having no access control despite an operator having explicitly configured a rule. This is distinct from the "no rules at all" finding because the instance does have entries in whitelisted_ips, so an emptiness check alone would not catch it.

Detection Logic (analytics_instances): flags a row when:

  • network_endpoint_details.network_endpoint_type contains 'PUBLIC'
  • network_endpoint_details.whitelisted_ips includes public CIDR (0.0.0.0/0 or ::/0)

Typical Remediation: replace the 0.0.0.0/0-style entry with specific IP/CIDR ranges scoped to known client networks, or remove public exposure entirely by migrating to a PRIVATE network endpoint.

Recommended Module Refresh: modules run enum_analytics --instances

APIGW_DEPLOYMENT_NO_AUTHENTICATION (CRITICAL)

What It Detects: A deployment routed through a gateway with a PUBLIC endpoint whose specification has no request_policies.authentication policy at all (no JWT/Token/Custom/Dynamic authenticator). Every route under that deployment's path prefix accepts unauthenticated requests directly from the internet -- there is no credential check anywhere in the request path. specification is only populated on a full get_deployment response (list_deployments summaries omit it), so this check only evaluates deployments enumerated with --get.

Detection Logic (apigw_deployments): flags a row when:

  • lifecycle_state not in ('DELETED', 'DELETING', 'FAILED')
  • gateway_id resolves to a non-dead row in apigw_gateways whose endpoint_type contains 'PUBLIC'
  • specification is present (collected via --get)
  • specification.request_policies.authentication is empty/missing

Typical Remediation: add a request_policies.authentication policy (JWT, token, or custom authorizer function) to the deployment, or move it behind a private gateway if public access was never intended.

Recommended Module Refresh: modules run enum_apigateway --deployments --get

APIGW_ROUTE_ANONYMOUS_AUTHORIZATION (HIGH)

What It Detects: A specific route within an otherwise-authenticated deployment sets request_policies.authorization.type=ANONYMOUS, overriding the deployment's authenticator and letting that one route bypass authentication entirely, on a gateway with a PUBLIC endpoint. Only evaluated when the deployment itself DOES have an authentication policy configured (if it doesn't, APIGW_DEPLOYMENT_NO_AUTHENTICATION already covers every route and this finding is skipped to avoid noise).

Detection Logic (apigw_deployments): flags a row when:

  • same liveness/public-gateway/--get gating as APIGW_DEPLOYMENT_NO_AUTHENTICATION
  • specification.request_policies.authentication is present
  • a specification.routes[] entry has request_policies.authorization.type == 'ANONYMOUS'

Typical Remediation: confirm the route is genuinely intended to be public (e.g. a health check); otherwise remove the ANONYMOUS authorization override so the deployment's authenticator applies.

Recommended Module Refresh: modules run enum_apigateway --deployments --get

APIGW_PUBLIC_NO_NSG (HIGH)

What It Detects: Public API Gateway does not appear to have NSGs configured. This reduces network-layer filtering options.

Detection Logic (apigw_gateways): flags a row when:

  • endpoint_type contains 'PUBLIC'
  • network_security_group_ids is empty/missing/false

Typical Remediation: attach restrictive NSGs and limit ingress paths.

Recommended Module Refresh: modules run enum_apigateway --gateways --get

APIGW_PUBLIC_ENDPOINT (MEDIUM)

What It Detects: API Gateway is configured with a public endpoint. Public endpoints can increase external attack surface for exposed APIs if authentication and policy controls are weak.

Detection Logic (apigw_gateways): flags a row when:

  • endpoint_type contains 'PUBLIC'

Typical Remediation: prefer private endpoints where feasible, and enforce strong auth/policies for publicly exposed APIs.

Recommended Module Refresh: modules run enum_apigateway --gateways --get

ARTIFACT_REPOSITORY_MUTABLE (MEDIUM)

What It Detects: Repository appears mutable. Mutable artifacts can weaken supply-chain integrity since they can be overwritten.

Detection Logic (ar_repositories): flags a row when:

  • lifecycle_state == 'AVAILABLE' (a deleted/deleting repository row is excluded rather than flagged on stale data)
  • is_immutable is false/empty/disabled

Typical Remediation: enable repository immutability for sensitive artifact repositories.

Recommended Module Refresh: modules run enum_artifactregistry --repositories --get

BASTION_ALLOWLIST_ANY (HIGH)

What It Detects: Bastion allow list includes 0.0.0.0/0 (or equivalent). This exposes bastion sessions to the internet.

Detection Logic (bastion_bastions): flags a row when:

  • lifecycle_state == 'ACTIVE' (a deleted bastion row is excluded rather than flagged on stale data)
  • cidr_block_allow_list includes public CIDR (0.0.0.0/0 or ::/0)

Typical Remediation: restrict bastion CIDRs to approved administrative source ranges.

Recommended Module Refresh: modules run enum_core_network --bastion --get

BDS_CLUSTER_NOT_SECURE (HIGH)

What It Detects: The BDS cluster was provisioned without the 'Secure & highly available' option, so it has no Kerberos authentication, no Apache Sentry authorization, and no HDFS Transparent Encryption at rest. Any principal with network reachability to the cluster's Hadoop/Spark services (HDFS, YARN, Hive) can act as an arbitrary Hadoop user with no authentication required.

Detection Logic (bds_instances): flags a row when:

  • is_secure is false/empty/disabled

Typical Remediation: This setting cannot be changed on an existing cluster -- remediation requires recreating the cluster with the 'Secure & highly available' option enabled (is_secure=true). In the interim, restrict VCN/subnet security list and network security group rules to limit network reachability to this cluster's Hadoop/Spark service ports.

Recommended Module Refresh: modules run enum_bds --bds-instances --get

BLOCK_VOLUME_NO_CMK (LOW)

What It Detects: Volume is not tied to a customer-managed KMS key. Default provider-managed encryption may be sufficient for many workloads, but CMK is often required for stricter controls.

Detection Logic (blockstorage_volumes): flags a row when:

  • lifecycle_state.upper() in ('AVAILABLE', 'IN_USE', 'PROVISIONING', 'ACTIVE')
  • kms_key_id is empty/missing/false

Typical Remediation: use CMK-backed encryption for high-sensitivity workloads.

Recommended Module Refresh: modules run enum_core_block_storage --volumes --get

BOOT_VOLUME_NO_CMK (LOW)

What It Detects: Boot volume is not configured with a customer-managed KMS key.

Detection Logic (blockstorage_boot_volumes): flags a row when:

  • lifecycle_state.upper() in ('AVAILABLE', 'IN_USE', 'PROVISIONING', 'ACTIVE')
  • kms_key_id is empty/missing/false

Typical Remediation: evaluate CMK usage for boot volumes that host sensitive workloads.

Recommended Module Refresh: modules run enum_core_block_storage --boot-volumes --get

BLOCKCHAIN_SERVICE_ENDPOINT_HTTP (MEDIUM)

What It Detects: Blockchain platform service endpoint appears to use plaintext HTTP.

Detection Logic (blockchain_platforms): flags a row when:

  • lifecycle_state not in ('DELETED', 'DELETING', 'FAILED', 'INACTIVE') (a dead/inactive platform row is excluded rather than flagged on stale data)
  • service_endpoint starts with 'http://'

Typical Remediation: require HTTPS endpoints.

Recommended Module Refresh: modules run enum_blockchain --platforms --get

CACHE_USER_WEAK_AUTH_MODE (CRITICAL)

What It Detects: An enabled (status=ON) cache user with no effective password (Redis ACL "nopass"). authentication_mode is a nested object on OciCacheUser ({"authentication_type": "PASSWORD", "hashed_passwords": [...]} or {"authentication_type": "IAM"}), persisted as a JSON string -- it is never a bare "NONE"/"DISABLED" token, so an earlier version of this check that string-matched it against those literal tokens could never fire (a dead check). This version detects the real passwordless condition: PASSWORD mode with zero hashed_passwords, and/or a literal "nopass" token in acl_string. Any client that can reach the cluster's endpoint on the network can authenticate as this user with no credential at all.

Detection Logic (cache_users): flags a row when:

  • lifecycle_state == 'ACTIVE'
  • status is empty OR status == 'ON'
  • (authentication_mode.authentication_type == 'PASSWORD' AND authentication_mode.hashed_passwords is empty) OR 'nopass' in acl_string

Typical Remediation: set a password (hashed_passwords) for this user, switch it to IAM authentication_mode, or disable it (status=OFF) if unused.

Recommended Module Refresh: modules run enum_databases --cache-users --get

CACHE_CLUSTER_PUBLIC_ENDPOINT_IP (HIGH)

What It Detects: Cache endpoint IP appears outside RFC1918 private ranges.

Detection Logic (cache_clusters): flags a row when:

  • lifecycle_state == 'ACTIVE' (a deleted/deleting cluster row is excluded rather than flagged on stale data)
  • cluster endpoint IP is public-routable (non-RFC1918)

Typical Remediation: place cache endpoints on private subnets only.

Recommended Module Refresh: modules run enum_all

CACHE_CLUSTER_NO_NSG (MEDIUM)

What It Detects: Cache cluster has no NSGs configured, reducing network-level traffic filtering.

Detection Logic (cache_clusters): flags a row when:

  • lifecycle_state == 'ACTIVE' (a deleted/deleting cluster row is excluded rather than flagged on stale data)
  • nsg_ids is empty/missing/false

Typical Remediation: attach restrictive NSGs to cache clusters.

Recommended Module Refresh: modules run enum_all

CERTIFICATES_LEAF_ISSUED_BY_ROOT_CA (MEDIUM)

What It Detects: The certificate's issuer is a Root CA rather than an intermediate/issuing (subordinate) CA. Root CAs are the trust anchor for the whole hierarchy and OCI's own CA guidance states they should be used only to sign subordinate CA certificates, kept under strict access controls, and not exercised for routine leaf issuance. Direct root-to-leaf issuance widens the root's usage/exposure surface and removes the ability to revoke or rotate a compromised issuing path without invalidating the trust anchor itself.

Detection Logic (certificates): flags a row when:

  • config_type contains 'ROOT_CA_GENERATED_INTERNALLY' (or equivalent root-CA type)
  • leaf certificate references a root CA directly as issuer_certificate_authority_id (no intermediate CA in the chain)

Typical Remediation: create a subordinate (issuing) CA under the root, reissue affected certificates from it, and restrict the root CA to signing subordinate CA certificates only. The finding row records the specific issuer CA OCID and its config_type for triage.

Recommended Module Refresh: modules run enum_certificates --certificates --certificate_authorities

CLOUD_GUARD_TARGET_NOT_ACTIVE (MEDIUM)

What It Detects: The Cloud Guard target's own state or its lifecycle_state reports something other than ACTIVE, meaning Cloud Guard may not be actively monitoring this target's compartment.

Detection Logic (cloud_guard_targets): flags a row when:

  • state.upper() NOT IN ('ACTIVE', '') OR lifecycle_state.upper() NOT IN ('ACTIVE', '')

Typical Remediation: ensure required Cloud Guard targets are in ACTIVE state.

Recommended Module Refresh: modules run enum_cloudguard --targets

CLOUD_GUARD_DATA_SOURCE_NOT_ACTIVE (LOW)

What It Detects: The Cloud Guard data source is not in an ACTIVE lifecycle state, meaning the detector recipe relying on it may not be receiving the security signals it expects.

Detection Logic (cloud_guard_data_sources): flags a row when:

  • lifecycle_state.upper() NOT IN ('ACTIVE', '')

Typical Remediation: validate detector data sources are healthy and active.

Recommended Module Refresh: modules run enum_cloudguard --data-sources

COMPUTE_IMDS_V1 (LOW)

What It Detects: Legacy IMDS (v1) endpoints are enabled. IMDSv1 is more susceptible to SSRF‑style credential theft compared to IMDSv2.

Detection Logic (compute_instances): flags a row when:

  • lifecycle_state not in ('TERMINATED', 'TERMINATING') (a terminated instance row is excluded rather than flagged on stale data)
  • instance_options.are_legacy_imds_endpoints_disabled == false

Typical Remediation: disable legacy IMDS endpoints (use IMDSv2 only).

Recommended Module Refresh: modules run enum_core_compute --instances --get

COMPUTE_IN_TRANSIT_ENCRYPTION (LOW)

What It Detects: In‑transit encryption between instance and boot volume is disabled. This can expose data in transit within the host network path.

Detection Logic (compute_instances): flags a row when:

  • lifecycle_state not in ('TERMINATED', 'TERMINATING') (a terminated instance row is excluded rather than flagged on stale data)
  • launch_options.is_pv_encryption_in_transit_enabled == false

Typical Remediation: enable in-transit encryption for supported shapes and images.

Recommended Module Refresh: modules run enum_core_compute --instances --get

COMPUTE_CONFIDENTIAL_COMPUTING (INFO)

What It Detects: Confidential computing (memory encryption) is disabled. This reduces isolation of running workloads from host‑level inspection.

Detection Logic (compute_instances): flags a row when:

  • lifecycle_state not in ('TERMINATED', 'TERMINATING') (a terminated instance row is excluded rather than flagged on stale data)
  • platform_config.is_memory_encryption_enabled == false

Typical Remediation: enable memory encryption on supported shapes.

Recommended Module Refresh: modules run enum_core_compute --instances --get

COMPUTE_SHIELDED_INSTANCES (INFO)

What It Detects: Shielded instance protections are not enabled (secure boot and/or measured boot + TPM). This weakens protections against boot‑level tampering.

Detection Logic (compute_instances): flags a row when:

  • lifecycle_state not in ('TERMINATED', 'TERMINATING') (a terminated instance row is excluded rather than flagged on stale data)
  • one or more of platform_config.is_secure_boot_enabled, is_measured_boot_enabled, is_trusted_platform_module_enabled is false

Typical Remediation: enable shielded instance settings where supported.

Recommended Module Refresh: modules run enum_core_compute --instances --get

INSTANCE_AGENT_COMMAND_HISTORY_PRESENT (INFO)

What It Detects: Instance has recorded Run Command activity. Review command content/output for sensitive operations.

Detection Logic (compute_instance_agent_commands): flags a row when:

  • at least one command row exists with target_instance_id present

Typical Remediation: monitor and restrict who can submit instance agent commands.

Recommended Module Refresh: modules run enum_core_compute --instance-agent-commands --instance-agent-command-executions --get --download

INSTANCE_AGENT_RUN_COMMAND_ENABLED (INFO)

What It Detects: Run Command plugin is enabled, which expands remote command-execution surface.

Detection Logic (compute_instance_agent_plugins): flags a row when:

  • status.upper() in ('RUNNING', 'ENABLED')

Typical Remediation: disable Run Command where not required and tightly scope IAM permissions (instance-agent-command-family, instance-agent-command-execution-family).

Recommended Module Refresh: modules run enum_core_compute --instance-agent-plugins --get

PUBLIC_REPOSITORY (HIGH)

What It Detects: The repository is public. Images and metadata may be accessible without authentication.

Detection Logic (cr_repositories): flags a row when:

  • lifecycle_state == 'AVAILABLE' (a deleted repository row is excluded rather than flagged on stale data)
  • is_public is true/enabled

Typical Remediation: set repository visibility to private unless public access is required.

Recommended Module Refresh: modules run enum_containerregistry --repositories --get

CONTAINER_REGISTRY_REPO_MUTABLE (MEDIUM)

What It Detects: Repository is mutable (tags can be overwritten). This can enable supply‑chain confusion, rollback attacks, or untracked image changes.

Detection Logic (cr_repositories): flags a row when:

  • lifecycle_state == 'AVAILABLE' (a deleted repository row is excluded rather than flagged on stale data)
  • is_immutable is false/empty/disabled

Typical Remediation: enable immutability for sensitive repositories.

Recommended Module Refresh: modules run enum_containerregistry --repositories --get

DATA_CATALOG_PRIVATE_ENDPOINT_NO_SUBNET (MEDIUM)

What It Detects: The private endpoint row has no subnet_id, indicating incomplete or broken network placement -- the private endpoint cannot securely reach VCN-hosted data sources without a subnet binding.

Detection Logic (data_catalog_private_endpoints): flags a row when:

  • lifecycle_state not in ('DELETED', 'DELETING', 'FAILED') (a dead endpoint row is excluded rather than flagged on stale data)
  • subnet_id is empty/missing/false on the private endpoint row

Typical Remediation: verify the private endpoint's subnet in the console/CLI and recreate it bound to the intended private subnet if the reference is genuinely missing.

Recommended Module Refresh: modules run enum_data_catalog --private-endpoints --get

DATA_CATALOG_PRIVATE_ENDPOINT_NO_DNS_ZONES (LOW)

What It Detects: The private endpoint defines no DNS zones, so it cannot resolve any private FQDN/IP for on-prem or VCN-hosted data sources -- the entire reason to attach a private endpoint (avoiding public-network harvesting of data sources) is defeated if it silently cannot resolve the intended hosts.

Detection Logic (data_catalog_private_endpoints): flags a row when:

  • lifecycle_state not in ('DELETED', 'DELETING', 'FAILED') (a dead endpoint row is excluded rather than flagged on stale data)
  • dns_zones is empty/missing/false on the private endpoint row

Typical Remediation: add the DNS zones (VCN domain, subnet domain, or custom FQDNs) needed to resolve the data source(s) this endpoint is meant to serve.

Recommended Module Refresh: modules run enum_data_catalog --private-endpoints --get

DATAINTEGRATION_WORKSPACE_NOT_PRIVATE_NETWORK (MEDIUM)

What It Detects: Workspace has private network connectivity disabled, so it relies on Data Integration's default public network path to reach data sources rather than a customer VCN/subnet with a dedicated private endpoint. Per Oracle's OCI Data Integration docs, private network mode keeps data-source connectivity inside the VCN and, once enabled at creation, cannot later be disabled -- making this a stable, low-noise signal rather than a transient toggle.

Detection Logic (data_integration_workspaces): flags a row when:

  • workspace network_configuration does not designate a PRIVATE network mode (no private-endpoint/subnet binding)

Typical Remediation: prefer private network connectivity where source connectivity permits, mirroring the existing public-endpoint guidance for other services. This is remediation guidance rather than an absolute violation, since some workspaces legitimately only integrate public/SaaS sources.

Recommended Module Refresh: modules run enum_dataintegration --workspaces --get

DATA_SAFE_SECURITY_ASSESSMENT_BASELINE_DEVIATION (MEDIUM)

What It Detects: OCI Data Safe itself flags this assessment as deviated from the admin-set security baseline for the target database, per the service's automatic baseline-comparison feature (Security Assessment Overview / set-security-assessment-baseline). A true is_deviated_from_baseline value means the target's security configuration has drifted since the baseline was captured -- e.g. new risky settings, changed controls -- and warrants review of the assessment's findings.

Detection Logic (data_safe_security_assessments): flags a row when:

  • security assessment is_deviated_from_baseline is truthy relative to its designated baseline

Typical Remediation: open the assessment in the Data Safe console, review what changed versus baseline, and either remediate the drift or update the baseline if the change was intentional.

Recommended Module Refresh: modules run enum_data_safe --security-assessments --get

DATA_SAFE_TARGET_NEEDS_ATTENTION (MEDIUM)

What It Detects: The target database's Data Safe lifecycle_state is NEEDS_ATTENTION or FAILED, meaning Data Safe cannot connect to or manage the registered database (per the OCI TargetDatabase SDK model, this state reflects connectivity/credential/config problems reported in lifecycle_details). While Data Safe is in this state, security assessments, user assessments, and audit collection for that database are stale or not running, creating a monitoring blind spot.

Detection Logic (data_safe_target_databases): flags a row when:

  • target database lifecycle_state contains 'NEEDS_ATTENTION'

Typical Remediation: inspect lifecycle_details and re-validate the target's connection/credentials (database user, wallet, ACL/network path) in the Data Safe console.

Recommended Module Refresh: modules run enum_data_safe --target-databases --get

DATA_SAFE_USER_ASSESSMENT_BASELINE_DEVIATION (MEDIUM)

What It Detects: Same OCI-native baseline-drift signal as the security assessment check, but for the User Assessment (privileged users, roles, profiles) feature of Data Safe. A true is_deviated_from_baseline value means privileged-user posture on the target database has changed since the baseline snapshot, which is a common indicator of new or elevated user grants worth reviewing.

Detection Logic (data_safe_user_assessments): flags a row when:

  • user assessment is_deviated_from_baseline is truthy relative to its designated baseline

Typical Remediation: review the user assessment's findings for newly-flagged accounts/roles and confirm the change was authorized.

Recommended Module Refresh: modules run enum_data_safe --user-assessments --get

DATA_SCIENCE_PRIVATE_ENDPOINT_NO_SUBNET (MEDIUM)

What It Detects: Private endpoint row has no subnet_id, which can indicate incomplete or misconfigured network placement.

Detection Logic (data_science_private_endpoints): flags a row when:

  • subnet_id is empty/missing/false

Typical Remediation: ensure private endpoints are bound to intended private subnets.

Recommended Module Refresh: modules run enum_datascience --private-endpoints --get

AUTONOMOUS_DB_PUBLIC_EXPOSURE (CRITICAL)

What It Detects: The Autonomous Database exposes a public endpoint or has no network access controls (no allow-listed IPs, no private subnet, no private endpoint), leaving it reachable from the internet.

Detection Logic (db_autonomous_databases): flags a row when:

  • truthy(public_endpoint)
  • or all of whitelisted_ips, subnet_id, private_endpoint are empty/missing (no network scoping at all)

Typical Remediation: use a private endpoint/subnet or restrict access with an IP allow-list.

Recommended Module Refresh: modules run enum_databases --autonomous --get

AUTONOMOUS_DB_MTLS_NOT_REQUIRED (MEDIUM)

What It Detects: The Autonomous Database allows TLS (non-mutual) connections; mTLS is not enforced.

Detection Logic (db_autonomous_databases): flags a row when:

  • is_mtls_connection_required is false/empty/disabled

Typical Remediation: require mutual TLS (mTLS) for client connections.

Recommended Module Refresh: modules run enum_databases --autonomous --get

AUTONOMOUS_DB_NO_CMK (MEDIUM)

What It Detects: The Autonomous Database does not reference a customer-managed KMS key (Oracle-managed default).

Detection Logic (db_autonomous_databases): flags a row when:

  • kms_key_id is empty/missing/false

Typical Remediation: use CMK-backed encryption where policy/compliance requires it.

Recommended Module Refresh: modules run enum_databases --autonomous --get

ORACLE_DB_NO_CMK (MEDIUM)

What It Detects: Oracle DB system does not reference a customer-managed KMS key.

Detection Logic (db_db_systems): flags a row when:

  • kms_key_id is empty/missing/false

Typical Remediation: use CMK-backed encryption where policy/compliance requires it.

Recommended Module Refresh: modules run enum_databases --oracle --get

DBMULTICLOUD_AWS_STS_PUBLIC_ENDPOINT (MEDIUM)

What It Detects: The connector's OIDC token exchange with AWS STS (used to federate OCI identity into AWS IAM roles per service_role_details) traverses the public internet instead of an AWS PrivateLink/VPC interface endpoint, since aws_sts_private_endpoint is unset. AWS's own STS guidance recommends VPC interface endpoints so STS AssumeRoleWithWebIdentity traffic stays on the AWS backbone rather than being reachable from the public path.

Detection Logic (dbmulticloud_aws_identity_connectors): flags a row when:

  • AWS connector's STS/connection endpoint configuration indicates a public (non-VPC-private) path is in use

Typical Remediation: provision an AWS STS VPC interface endpoint and set it on the connector (aws_sts_private_endpoint) to keep the cross-cloud trust exchange private.

Recommended Module Refresh: modules run enum_dbmulticloud --aws-identity-connectors

DBMULTICLOUD_AZURE_SERVICE_PRINCIPAL_IDENTITY (LOW)

What It Detects: azure_identity_mechanism has exactly two valid values (ARC_AGENT, SERVICE_PRINCIPAL); SERVICE_PRINCIPAL relies on a long-lived, rotatable client secret/certificate credential rather than the Azure Arc-enabled server's system-assigned managed identity. Microsoft's own Arc guidance recommends managed-identity authentication where possible specifically because it removes stored- credential/rotation risk.

Detection Logic (dbmulticloud_azure_connectors): flags a row when:

  • Azure connector identity is a standing service-principal credential rather than a managed/short-lived identity

Typical Remediation: reconfigure the Oracle DB Azure Connector to use the ARC_AGENT identity mechanism (system-assigned managed identity) instead of a Service Principal secret.

Recommended Module Refresh: modules run enum_dbmulticloud --azure-connectors

DAC_ACCESS_REQUEST_REVOKE_OR_EXPIRY_FAILED (HIGH)

What It Detects: This access request's teardown path failed (SDK-defined terminal-failure state), meaning the granted operator/service-provider access to the resource may not have been fully revoked or removed even though it was expected to end. Verify current effective access on resource_id via the OCI console/CLI (get_delegated_resource_access_request) and manually revoke/close the grant, then investigate why automated revocation failed.

Detection Logic (delegate_access_control_access_requests): flags a row when:

  • request_status in ('REVOKE_FAILED','EXPIRY_FAILED','CLOSE_FAILED','UNDEPLOY_FAILED')

Typical Remediation: treat this as a potentially still-active break-glass grant until proven otherwise. Confirm via the console/CLI whether access on resource_id was actually torn down, manually revoke it if not, and escalate the automated teardown failure to Oracle support if it recurs.

Recommended Module Refresh: modules run enum_delegate_access_control --access-requests --get

DAC_ACCESS_REQUEST_PREAPPROVED_NO_REVIEW (MEDIUM)

What It Detects: The Delegation Control governing this resource pre-approved every action in this Service Provider Access Request, so it was auto-approved without an explicit customer approver decision (per OCI docs: "If all of the Service Provider Actions listed ... are in the pre-approved list ... the request is automatically approved"). Review the governing Delegation Control's pre-approved-action list (delegation_control_id) and narrow it so sensitive actions on this resource_type require explicit approval instead of standing auto-approval.

Detection Logic (delegate_access_control_access_requests): flags a row when:

  • request_status contains 'PREAPPROVED'
  • requester_type contains 'OPERATOR'

Typical Remediation: edit the referenced Delegation Control (delegation_control_id) and remove sensitive actions from its pre-approved-action list, or disable auto-approval so Service Provider Access Requests against this resource_type require an explicit approver decision. Cross-reference requested_action_names on this request with the Delegation Control's pre-approved list to see exactly what was auto-approved.

Recommended Module Refresh: modules run enum_delegate_access_control --delegation-controls --get

DEVOPS_REPOSITORY_HTTP_URL (MEDIUM)

What It Detects: Repository URL appears to use plaintext HTTP transport.

Detection Logic (devops_repositories): flags a row when:

  • http_url starts with 'http://' OR repository_url starts with 'http://'

Typical Remediation: enforce HTTPS/SSH repository URLs.

Recommended Module Refresh: modules run enum_devops --repositories --get

DNS_DNSSEC_DISABLED (MEDIUM)

What It Detects: DNSSEC is not enabled for this public zone, which can allow DNS spoofing/poisoning. SECONDARY zones are excluded -- a SECONDARY zone mirrors an external primary via zone transfer, DNSSEC signing is owned by that primary, and OCI does not support independently enabling DNSSEC on a SECONDARY zone, so flagging one would be a false positive with no action the tenant can take on this specific zone.

Detection Logic (dns_zones): flags a row when:

  • scope == 'GLOBAL'
  • lifecycle_state not in ('DELETED', 'DELETING', 'FAILED')
  • zone_type != 'SECONDARY'
  • dnssec_state != 'ENABLED'

Typical Remediation: enable DNSSEC for public zones where supported.

Recommended Module Refresh: modules run enum_dns --zones

EMAIL_DOMAIN_DKIM_MISSING (MEDIUM)

What It Detects: Domain has no active DKIM configuration, which can weaken sender authenticity guarantees.

Detection Logic (email_domains): flags a row when:

  • lifecycle_state.upper() in ('', 'ACTIVE') (the domain itself is live)
  • the domain's id is absent from the set of email_domain_id values seen on ACTIVE rows of email_domain_dkims

Typical Remediation: configure and enable DKIM for each sending domain.

Recommended Module Refresh: modules run enum_email --domains --dkims

EMAIL_SUBMIT_ENDPOINT_PLAINTEXT (MEDIUM)

What It Detects: One or more submit endpoints appear to use plaintext HTTP transport.

Detection Logic (email_configuration): flags a row when:

  • http_submit_endpoint starts with 'http://' OR smtp_submit_endpoint starts with 'http://'

Typical Remediation: enforce TLS-enabled submit endpoints.

Recommended Module Refresh: modules run enum_email --email-configuration

EMAIL_DOMAIN_SPF_MISSING (MEDIUM)

What It Detects: Domain has no active SPF configuration, which can increase spoofing risk.

Detection Logic (email_domains): flags a row when:

  • lifecycle_state.upper() in ('', 'ACTIVE') (the domain itself is live)
  • the domain's id is absent from the set of email_domain_id values seen on ACTIVE rows of email_domain_spfs

Typical Remediation: configure SPF records for authorized sending infrastructure.

Recommended Module Refresh: modules run enum_email --domains --spfs

EMAIL_SENDER_NOT_VERIFIED (MEDIUM)

What It Detects: Sender identity is unverified and may fail anti-spoofing controls or operational checks.

Detection Logic (email_senders): flags a row when:

  • is_email_verified is false/empty/disabled

Typical Remediation: verify sender identities before operational use.

Recommended Module Refresh: modules run enum_email --senders

EVENTS_RULE_SECURITY_MONITORING_DISABLED (MEDIUM)

What It Detects: The rule's condition targets identitycontrolplane (user/group/policy/identity provider) or virtualnetwork (VCN/route table/security list/NSG/gateway) event types -- the exact resource families the CIS OCI Foundations Benchmark (controls 3.3-3.12) recommends alerting on -- but the rule is currently disabled or INACTIVE. Because the rule already exists with this scope, this flags a real detection gap rather than a design opinion.

Detection Logic (events_rules): flags a row when:

  • a rule matching security-relevant event types (IAM/policy/network changes) has is_enabled is false

Typical Remediation: re-enable the rule (or confirm an equivalent active rule already covers the same event types) so IAM and network control-plane changes are still alerted on.

Recommended Module Refresh: modules run enum_events --rules

EVENTS_RULE_NO_EFFECTIVE_ACTION (LOW)

What It Detects: The rule is enabled and active, meaning it will match its condition and attempt to fire, but none of its attached actions are currently enabled and healthy (empty action list, all actions individually disabled, or all actions in a FAILED/INACTIVE/DELETED/DELETING lifecycle state). Matched events are silently dropped, creating a monitoring/automation blind spot that looks configured but is not functioning.

Detection Logic (events_rules): flags a row when:

  • truthy(is_enabled)
  • actions is empty/missing/false (no configured action fires)

Typical Remediation: re-enable at least one action or verify the downstream ONS topic, stream, or function target still exists and is reachable.

Recommended Module Refresh: modules run enum_events --rules --get

FILE_STORAGE_EXPORT_OPEN_TO_ANY (HIGH)

What It Detects: Export option allows 0.0.0.0/0 (or equivalent), which can expose NFS shares broadly.

Detection Logic (file_storage_exports): flags a row when:

  • at least one export option has source as public CIDR AND access in {READ_WRITE, READONLY, READ_ONLY, READWRITE}

Typical Remediation: restrict export source CIDRs to trusted networks.

Recommended Module Refresh: modules run enum_filestorage --exports --get

FILE_STORAGE_MOUNT_TARGET_NO_NSG (MEDIUM)

What It Detects: Mount target has no NSGs attached, reducing network-level access controls.

Detection Logic (file_storage_mount_targets): flags a row when:

  • nsg_ids is empty/missing/false

Typical Remediation: attach NSGs and limit ingress to required clients only.

Recommended Module Refresh: modules run enum_filestorage --mount-targets --get

FUNCTION_INVOKE_ENDPOINT_HTTP (MEDIUM)

What It Detects: Invoke endpoint starts with HTTP (plaintext) instead of HTTPS.

Detection Logic (functions_functions): flags a row when:

  • invoke_endpoint starts with 'http://'

Typical Remediation: require HTTPS endpoints for function invocation.

Recommended Module Refresh: modules run enum_functions --functions --get

FUNCTION_APP_SYSLOG_HTTP (MEDIUM)

What It Detects: Syslog URL starts with HTTP (plaintext).

Detection Logic (functions_apps): flags a row when:

  • syslog_url starts with 'http://'

Typical Remediation: use TLS-protected log destinations.

Recommended Module Refresh: modules run enum_functions --apps --get

FUSION_APPS_BREAK_GLASS_NO_LOCKBOX (MEDIUM)

What It Detects: Oracle provisions a Lockbox automatically alongside Break Glass so that emergency support access routes through Oracle Managed Access' approval/audit workflow. An ACTIVE environment with Break Glass on but no lockbox_id is an inconsistent state, implying the emergency‑access path may not be governed by a trackable approval record.

Detection Logic (fusion_apps_environments): flags a row when:

  • is_break_glass_enabled is truthy
  • environment is not simultaneously bound to a Lockbox-managed approval gate

Typical Remediation: verify Break Glass/Lockbox configuration in the environment's Security tab in the Fusion console and re‑run enum_fusion_apps to confirm the field populates; treat a persistent empty lockbox_id here as a provisioning gap to raise with Oracle Support.

Recommended Module Refresh: modules run enum_fusion_apps --fusion_environments --get

FUSION_APPS_BREAK_GLASS_ENABLED (LOW)

What It Detects: Break Glass grants Oracle‑authorized support operators a temporary, credentialed access path into this Fusion environment via Oracle Managed Access, and ships with auto‑approval enabled by default per Oracle's own documentation. This is a legitimate, often‑purchased support feature, not a bug, but it is a standing external‑access surface worth surfacing as a posture item.

Detection Logic (fusion_apps_environments): flags a row when:

  • is_break_glass_enabled is truthy on the environment

Typical Remediation: confirm the environment's Lockbox approval mode is not left on silent auto‑approve, and that OCI Audit/Cloud Guard alerting is wired to any Break Glass session per Oracle's published best practices.

Recommended Module Refresh: modules run enum_fusion_apps --fusion_environments --get

GENAI_ENDPOINT_CONTENT_MODERATION_DISABLED (MEDIUM)

What It Detects: The endpoint's content_moderation_config (OCI Generative AI "AI Guardrails" feature, ContentModerationConfig.is_enabled) is absent or explicitly disabled. Per OCI documentation, content moderation guardrails are NOT applied by default to foundational models, so this flags endpoints where nobody opted in.

Detection Logic (generative_ai_endpoints): flags a row when:

  • content_moderation_config is empty/missing or content_moderation_config.is_enabled is false

Typical Remediation: enable content moderation (INFORM or BLOCK mode) on customer-facing or compliance-sensitive endpoints to reduce toxic/biased-output and policy risk. This is a posture signal, not an exploit path -- it only reads the already-saved is_enabled flag with no inference about intended use.

Recommended Module Refresh: modules run enum_generative_ai --endpoints

GENERATIVE_AI_AGENT_ENDPOINT_CONTENT_MODERATION_DISABLED (MEDIUM)

What It Detects: The endpoint's content_moderation_config either does not exist or has should_enable_on_input/should_enable_on_output set to false, so user prompts and/or generated agent responses are not screened for toxic, biased, or policy-violating content. OCI documentation explicitly recommends enabling content moderation on both directions.

Detection Logic (generative_ai_agent_agent_endpoints): flags a row when:

  • content_moderation_config missing, or should_enable_on_input/should_enable_on_output is false

Typical Remediation: update the endpoint to set should_enable_on_input=true and should_enable_on_output=true in content_moderation_config.

Recommended Module Refresh: modules run enum_generative_ai_agent --agent-endpoints --get

GENERATIVE_AI_AGENT_ENDPOINT_PII_GUARDRAIL_DISABLED (MEDIUM)

What It Detects: The endpoint's guardrail_config has no active PII detection on either input or output, so personally identifiable information in user prompts or generated responses is not flagged, redacted, or blocked. This increases the risk of sensitive personal data being exposed to end users or persisted in session/trace logs.

Detection Logic (generative_ai_agent_agent_endpoints): flags a row when:

  • PII guardrail config missing, or both input_guardrail_mode and output_guardrail_mode are DISABLE/empty

Typical Remediation: enable BLOCK or INFORM mode for personally_identifiable_information_config.input_guardrail_mode and output_guardrail_mode.

Recommended Module Refresh: modules run enum_generative_ai_agent --agent-endpoints --get

GENERATIVE_AI_AGENT_ENDPOINT_PROMPT_INJECTION_GUARDRAIL_DISABLED (MEDIUM)

What It Detects: The endpoint has no active prompt-injection guardrail (input_guardrail_mode is DISABLE or the prompt_injection_config block is absent), so instructions hidden in user input or retrieved knowledge-base content are not screened before reaching the agent. Because agent endpoints can be wired to tools (function-calling/SQL/HTTP), an unguarded prompt injection can potentially trigger unintended tool invocation.

Detection Logic (generative_ai_agent_agent_endpoints): flags a row when:

  • guardrail_config.prompt_injection_config missing, or input_guardrail_mode contains 'DISABLE'/empty

Typical Remediation: set input_guardrail_mode to BLOCK (or at minimum INFORM) in guardrail_config.prompt_injection_config.

Recommended Module Refresh: modules run enum_generative_ai_agent --agent-endpoints --get

GOLDENGATE_CONNECTION_PLAINTEXT_CREDENTIAL (MEDIUM)

What It Detects: The GoldenGate connection defines a username but does not reference a Vault secret (missing vault_id and/or key_id), indicating the credential is not protected by OCI Vault.

Detection Logic (goldengate_connections): flags a row when:

  • truthy(username)
  • vault_id and/or key_id are empty/missing (credential not Vault-backed)

Typical Remediation: store connection credentials in OCI Vault and reference them via vault_id/key_id.

Recommended Module Refresh: modules run enum_goldengate --connections --get

GOVRULES_TENANCY_ATTACHMENT_NEEDS_ATTENTION (MEDIUM)

What It Detects: The tenancy attachment is in NEEDS_ATTENTION, meaning the parent tenancy's governance rule (a QUOTA lockdown, TAG policy, or ALLOWED_REGIONS restriction) failed to apply to the target member tenancy and is silently not enforced there. For example, an ALLOWED_REGIONS rule that should block resource creation outside approved regions, or a QUOTA rule meant to zero out a risky service, is not actually active on that tenancy — the guardrail exists on paper but currently provides no real protection for that member.

Detection Logic (governance_rules_tenancy_attachments): flags a row when:

  • tenancy attachment lifecycle_state contains 'NEEDS_ATTENTION'

Typical Remediation: inspect the attachment (GetTenancyAttachment) for the blocking cause — often a pre-existing resource in the child tenancy that conflicts with the rule — and retry via oci governance-rule tenancy- attachment retry, then re-run modules run enum_governance_rules --tenancy-attachments --get to confirm enforcement took effect.

Recommended Module Refresh: modules run enum_governance_rules --tenancy-attachments --get

GOVRULES_RULE_NO_ACTIVE_ATTACHMENT (LOW)

What It Detects: The governance rule is ACTIVE (a QUOTA, TAG, or ALLOWED_REGIONS template) but has no live tenancy attachment — every attachment for this rule is DELETED, or none exist at all. The rule provides no actual protection anywhere in the organization: it was defined but never rolled out to a member tenancy, or its only attachment(s) were later removed.

Detection Logic (governance_rules_rules): flags a row when:

  • rule lifecycle_state contains 'ACTIVE'
  • no tenancy attachment referencing this rule is in a live state (ACTIVE/CREATING/UPDATING/NEEDS_ATTENTION)

Typical Remediation: attach the rule to the intended member tenancies (CreateTenancyAttachment) or delete the unused rule to reduce governance drift. Re-run modules run enum_governance_rules --rules --tenancy-attachments --get to confirm the current attachment state before deciding.

Recommended Module Refresh: modules run enum_governance_rules --rules --tenancy-attachments --get

HEALTHCHECKS_HTTP_MONITOR_HEADER_POTENTIAL_SECRET (MEDIUM)

What It Detects: This Health Checks HTTP monitor defines a custom headers dict sent on every public probe. Oracle's own API reference explicitly disallows the Authorization header on monitors for this exact reason: monitor configuration is not a secrets store, and it is readable by anyone holding the health-check- family "read" IAM verb, a materially broader audience than whatever service the header is meant to authenticate to. A custom header key that looks credential-bearing (for example X-Api-Key, X-Auth- Token, or Cookie) is a common workaround for the Authorization ban and typically indicates a live credential is stored in plaintext in the monitor definition.

Detection Logic (healthchecks_http_monitors): flags a row when:

  • headers dict has a key matching a credential-shaped name (password/token/secret/apikey/etc.) with a non-empty value

Typical Remediation: remove the credential-bearing header from the monitor and have the monitored endpoint authenticate probes some other way (for example an allow-listed vantage-point source range), or rotate the credential and store it in OCI Vault instead of a plaintext monitor header.

Recommended Module Refresh: modules run enum_healthchecks --http-monitors --get

HEALTHCHECKS_MONITOR_SENSITIVE_PORT_PUBLIC_EXPOSURE (MEDIUM)

What It Detects: This enabled TCP monitor targets a well-known remote-access, database, or admin-management port (e.g. 22/SSH, 3389/RDP, 3306/MySQL, 5432/PostgreSQL, 6379/Redis, 1433/MSSQL, 1521-1522/Oracle DB, 9200/9300/Elasticsearch, 11211/Memcached, 27017/MongoDB, 2379/etcd, 445/135/SMB-RPC, 5985/5986/WinRM, 23/Telnet). Oracle's "Securing Health Checks" documentation states that resources monitored by this service must be accessible from the public internet for vantage-point probes to succeed. An enabled TCP monitor configured against one of these ports is therefore self-reported evidence that the operator has intentionally exposed that sensitive port to the public internet on the target host, a high-value target for credential brute-force or exploitation if it lacks compensating controls.

Detection Logic (table_name): flags a row when:

  • truthy(is_enabled)
  • protocol contains 'TCP'
  • port is a well-known remote-access/database/admin-management port (22, 3389, 3306, 5432, 6379, 1433, 1521/1522, 9200/9300, 11211, 27017, 2379, 445/135, 5985/5986, 23)

Typical Remediation: cross-check the monitor's targets against security-list/NSG data for the target host. If the monitored port does not need to be reachable from the public internet, restrict it to a private/VPN- only path (bastion, private endpoint, or VPN) and drop it from this public monitor, or replace it with an HTTP(S) health monitor against a purpose-built, unauthenticated health endpoint instead of the raw admin/database port.

Recommended Module Refresh: modules run enum_healthchecks --ping-monitors --http-monitors --get

IAM_POLICY_ANY_USER_OR_GROUP_NO_CONDITIONS (CRITICAL/HIGH)

What It Detects: An Allow policy statement whose subject is OCI's true "everyone in the tenancy" wildcard -- any-user (matches every principal, including service/instance/resource principals) or any-group (Oracle's recommended everyone-equivalent for user-like principals) -- with no where clause narrowing which principals or contexts the grant applies to. A named group/dynamic-group with a broad grant is normal and is NOT flagged here; this specifically targets grants that apply to literally anyone. Statements are parsed with the oci-lexer-parser package (the same policy lexer used by the OpenGraph builders) rather than string-matched, so quoting/whitespace/multi-line statements and the presence of a real where clause are handled correctly; a statement that fails to parse is skipped (not treated as unconditional).

Detection Logic (identity_policies): flags a row when:

  • statement kind == 'allow'
  • subject.type in ('any-user', 'any-group')
  • conditions is absent (no where clause)
  • severity: CRITICAL if actions.values includes manage or resources.type == 'all-resources'; HIGH otherwise (narrower verb/resource, still tenancy-wide exposure)

Typical Remediation: replace any-user/any-group with an explicit group/dynamic-group, or add a where clause (e.g. request.principal.type, request.user.id) narrowing the grant to only the principals that actually need it.

Recommended Module Refresh: modules run enum_identity --policies --get

IAM_USER_MULTIPLE_API_KEYS (LOW)

What It Detects: User has more than one active/recorded API key, which can increase key-sprawl risk.

Detection Logic (identity_user_api_keys): flags a row when:

  • count(api_keys grouped by user_id) > 1

Typical Remediation: rotate/revoke stale keys and enforce key hygiene.

Recommended Module Refresh: modules run enum_identity --api-keys

IDD_MFA_DISABLED_OR_UNKNOWN (MEDIUM)

What It Detects: MFA appears disabled or unspecified (mfa_enabled_category). This check's data source was previously dead: enum_identity had no component that ever called list_authentication_factor_settings()/populated identity_domain_authentication_factor_settings, so this tenant-wide MFA-posture check could never fire regardless of real risk. A new --idd-mfa-settings enumeration component now wires the collection path so this check is functional.

Detection Logic (identity_domain_authentication_factor_settings): flags a row when:

  • mfa_enabled_category is empty OR mfa_enabled_category.lower in ('none', 'disabled', 'off')

Typical Remediation: enable MFA for the domain and enforce strong MFA policies.

Recommended Module Refresh: modules run enum_identity --domains --idd-mfa-settings

IDD_PW_WEAK_POLICY (MEDIUM)

What It Detects: The password policy has one or more weak settings: a minimum length under 14 characters, passwords that never expire or expire after more than 60 days, fewer than 10 remembered previous passwords, more than 4 allowed failed login attempts before lockout, or no complexity requirements (missing lowercase/uppercase/numeral/special-character minimums).

Detection Logic (identity_domain_password_policies): flags a row when:

  • any of min_length < 14, password_expires_after > 60, num_passwords_in_history < 10, max_incorrect_attempts > 4, or complexity fields (min_lower_case/min_upper_case/min_numerals/min_special_chars) <= 0

Typical Remediation: increase min length, enforce complexity, reduce expiry window, increase password history, and tighten lockout thresholds.

Recommended Module Refresh: modules run enum_identity --domains

IDD_USER_NOT_IN_GROUP (LOW)

What It Detects: User appears to have no group memberships. Centralized group governance may be bypassed.

Detection Logic (identity_domain_users): flags a row when:

  • groups is empty/missing/false

Typical Remediation: assign users to least‑privilege groups and enforce consistent policies.

Recommended Module Refresh: modules run enum_identity --domains

IDD_USER_WITH_MULTIPLE_API_KEYS (LOW)

What It Detects: User has more than one recorded API key, increasing key-sprawl risk.

Detection Logic (identity_domain_user_api_keys): flags a row when:

  • count(identity_domain_api_keys grouped by user/domain principal) > 1

Typical Remediation: review key sprawl; rotate/revoke unused keys and enforce key hygiene.

Recommended Module Refresh: modules run enum_identity --domains

INTEGRATION_INSTANCE_FILE_SERVER_EXPOSED_NO_ALLOWLIST (MEDIUM)

What It Detects: File Server is enabled (is_file_server_enabled) on top of the same unrestricted PUBLIC endpoint (no allowlisted_http_ips, allowlisted_http_vcns, or is_integration_vcn_allowlisted in network_endpoint_details). File Server adds a file-transfer surface used for VB/PCS/OIC lookups and integrations, increasing the impact of the missing allowlist beyond the base app/API surface.

Detection Logic (integration_instances): flags a row when:

  • truthy(is_file_server_enabled)
  • same public-with-no-allowlist condition as INTEGRATION_INSTANCE_NO_NETWORK_ALLOWLIST (including the nested runtime/design_time check below)

Typical Remediation: apply the same IP/VCN allowlist fix as INTEGRATION_INSTANCE_NO_NETWORK_ALLOWLIST, or disable File Server (is_file_server_enabled) if it is not actively used.

Recommended Module Refresh: modules run enum_integration --integration-instances --get

INTEGRATION_INSTANCE_NO_NETWORK_ALLOWLIST (MEDIUM)

What It Detects: The instance's public endpoint (instance_url) has no allowlisted_http_ips, allowlisted_http_vcns, or VCN allowlisting configured in network_endpoint_details, so it is reachable from any internet address with only IDCS/user-credential auth as a gate. OCI's own Integration Cloud documentation and CIS OCI Foundations Benchmark control 2.6 recommend restricting OIC access to approved corporate IPs, CIDRs, or VCNs. PublicEndpointDetails also carries independent runtime/design_time sub-objects (each with their own allowlisted_http_ips/allowlisted_http_vcns), settable via ChangeIntegrationInstanceNetworkEndpointDetails and mapping to the instance's two separate endpoints (instance_url vs instance_design_time_url) -- an instance that restricts access exclusively through those nested allowlists, leaving the legacy top-level fields empty, is also considered allowlisted and is NOT flagged.

Detection Logic (integration_instances): flags a row when:

  • network_endpoint_details.network_endpoint_type contains 'PUBLIC'
  • top-level allowlisted_http_ips, allowlisted_http_vcns empty and is_integration_vcn_allowlisted is false
  • network_endpoint_details.runtime.allowlisted_http_ips/allowlisted_http_vcns also empty
  • network_endpoint_details.design_time.allowlisted_http_ips/allowlisted_http_vcns also empty

Typical Remediation: configure the allowlist (Instance Details > Network Access) or front the instance with a WAF/service gateway, then re-run enum_integration --get to confirm the change landed.

Recommended Module Refresh: modules run enum_integration --integration-instances --get

IOT_DOMAIN_GROUP_VCN_ALLOWLIST_EMPTY (MEDIUM)

What It Detects: IoT domain group DB VCN allow list is empty, increasing risk of broad backend DB exposure. db_allow_listed_vcn_ids only appears on the full IotDomainGroup GET response (absent from list_iot_domain_groups summaries) -- a domain group enumerated without --get has this field as None, which must not be confused with a genuinely empty (collected) allow-list.

Detection Logic (iot_domain_groups): flags a row when:

  • lifecycle_state not in ('DELETED', 'DELETING', 'FAILED')
  • db_allow_listed_vcn_ids is not None (collected via --get)
  • db_allow_listed_vcn_ids is empty

Typical Remediation: restrict DB access to explicit approved VCN IDs.

Recommended Module Refresh: modules run enum_iot --domain-groups --get

IOT_DOMAIN_IDENTITY_GROUP_ALLOWLIST_EMPTY (MEDIUM)

What It Detects: IoT domain DB identity-group allow list is empty. Access controls may be overly broad or undefined. db_allow_listed_identity_group_names is likewise GET-only (absent from IotDomainSummary) -- None means "not collected", not "empty".

Detection Logic (iot_domains): flags a row when:

  • lifecycle_state not in ('DELETED', 'DELETING', 'FAILED')
  • db_allow_listed_identity_group_names is not None (collected via --get)
  • db_allow_listed_identity_group_names is empty

Typical Remediation: define explicit identity groups allowed for DB interactions.

Recommended Module Refresh: modules run enum_iot --domains --get

KUBERNETES_ENGINE_PUBLIC_ENDPOINT (MEDIUM)

What It Detects: The Kubernetes control plane has a public endpoint. This increases exposure of the management plane to the internet.

Detection Logic (containerengine_clusters): flags a row when:

  • lifecycle_state == 'ACTIVE' (a deleted/deleting cluster row is excluded rather than flagged on stale data)
  • endpoint_config.is_public_ip_enabled is true and endpoints.public_endpoint is present

Typical Remediation: restrict the endpoint to private IPs or use allow‑listed CIDRs.

Recommended Module Refresh: modules run enum_kubernetes --clusters

LOCKBOX_ACTIVE_RESOURCE_HAS_NO_APPROVAL_GATE (HIGH)

What It Detects: This ACTIVE lockbox's approval_template_id references an approval template with auto_approval_state set to ENABLED, joining lockbox_lockboxes to lockbox_approval_templates. That means the specific protected resource (resource_id) currently grants Oracle‑operator access with zero human approval -- more actionable than the template‑level finding because it names the exact exposed resource_id and compartment_id.

Detection Logic (lockbox_lockboxes): flags a row when:

  • lockbox lifecycle_state contains 'ACTIVE'
  • approval_template_id joins to an approval template with auto_approval_state contains 'ENABLED'

Typical Remediation: rebind the lockbox to a manual‑approval template, or disable auto‑approval on the referenced approval_template_id (see LOCKBOX_APPROVAL_TEMPLATE_AUTO_APPROVAL_ENABLED).

Recommended Module Refresh: modules run enum_lockbox --lockboxes

LOCKBOX_APPROVAL_TEMPLATE_AUTO_APPROVAL_ENABLED (HIGH/LOW)

What It Detects: The approval template has auto_approval_state set to ENABLED, meaning access requests from Oracle‑authorized operators are approved automatically without any human reviewing the configured approver_levels (up to three user/group approvers). This defeats the core purpose of Lockbox/Managed Access -- a human‑in‑the‑loop gate on operator access to the customer's resources. An approval template is a standalone, reusable definition -- it only actually gates (or auto-approves) access to a real resource once an ACTIVE Lockbox (which always protects one specific resource_id) references it via approval_template_id. This check joins the template against lockbox_lockboxes to distinguish a template that is genuinely bound to a live lockbox from one that is defined but currently attached to nothing (mirrors the Network Firewall policy/firewall attachment split).

Detection Logic (lockbox_approval_templates): flags a row when:

  • template lifecycle_state contains 'ACTIVE'
  • auto_approval_state contains 'ENABLED'
  • severity: HIGH if the template's id appears as approval_template_id on any ACTIVE row of lockbox_lockboxes; LOW if the template is not currently bound to any active lockbox

Typical Remediation: set auto_approval_state to DISABLED unless auto‑approval is an explicit, documented business decision. Also check LOCKBOX_ACTIVE_RESOURCE_HAS_NO_APPROVAL_GATE findings to identify which lockboxes (and therefore which protected resources) reference this approval_template_id.

Recommended Module Refresh: modules run enum_lockbox --approval-templates

LOGGING_LOG_DISABLED (MEDIUM)

What It Detects: Log collection is disabled for this log object.

Detection Logic (logging_logs): flags a row when:

  • lifecycle_state not in ('DELETING', 'FAILED') (INACTIVE is a real, currently-existing log-configuration state distinct from is_enabled and is NOT excluded)
  • not is_enabled.strip.lower in ('true', '1', 'yes', 'on')

Typical Remediation: enable log collection for security-relevant sources.

Recommended Module Refresh: modules run enum_logging --logs --get

LOGGING_RETENTION_SHORT (LOW)

What It Detects: Log retention is configured for fewer than 30 days (but not unset/0), which may be insufficient for investigations.

Detection Logic (logging_logs): flags a row when:

  • lifecycle_state not in ('DELETING', 'FAILED')
  • retention_duration is short/invalid

Typical Remediation: align log retention with incident response and compliance needs.

Recommended Module Refresh: modules run enum_logging --logs --get

KAFKA_PLAINTEXT_BOOTSTRAP_URL (MEDIUM)

What It Detects: Bootstrap URL appears to include plaintext listener semantics (for example port 9092). kafka_bootstrap_urls is list[BootstrapUrl] ([{"name": "PLAINTEXT", "url": "host:9092"}, ...]), GET-only (absent from KafkaClusterSummary/list) -- it is parsed as the JSON list it actually is and each entry's listener name/url is inspected, rather than naively comma-splitting a string (which would shred each JSON object's fields across the split and could never match a protocol:// prefix that this field never actually contains).

Detection Logic (kafka_clusters): flags a row when:

  • lifecycle_state == 'ACTIVE'
  • kafka_bootstrap_urls is present (collected via --get)
  • an entry's name contains 'plaintext' (case-insensitive) OR its url contains ':9092'

Typical Remediation: prefer TLS-enabled listeners and enforce authenticated client access.

Recommended Module Refresh: modules run enum_managedkafka --clusters --get

KAFKA_AUTH_MATERIAL_NOT_CONFIGURED (MEDIUM)

What It Detects: No client auth secret or certificate bundle is recorded for this cluster. secret_id and client_certificate_bundle are both GET-only (absent from KafkaClusterSummary, always None together with kafka_bootstrap_urls on a list-only row) -- without --get, "not configured" is indistinguishable from "not looked at yet", so a cluster enumerated without --get is skipped rather than false-positived.

Detection Logic (kafka_clusters): flags a row when:

  • lifecycle_state == 'ACTIVE'
  • kafka_bootstrap_urls is present (collected via --get)
  • secret_id is empty AND client_certificate_bundle is empty

Typical Remediation: configure authenticated client access paths.

Recommended Module Refresh: modules run enum_managedkafka --clusters --get

MANAGEMENT_AGENT_INSTALL_KEY_UNLIMITED (MEDIUM)

What It Detects: The install key has no cap on the number of agents that can register with it (isUnlimited is true) and is ACTIVE. Per Oracle's own guidance, if an unlimited install key is compromised a pentester can enroll rogue agents anywhere the key is scoped, and each enrolled agent can then be used to run commands on the underlying host via Management Agent plugins/tasks. This key has not yet been consumed (currentKeyInstallCount is 0).

Detection Logic (management_agent_install_keys): flags a row when:

  • lifecycle_state contains 'ACTIVE'
  • truthy(is_unlimited)
  • current_key_install_count == 0 (not yet consumed)

Typical Remediation: delete this key and reissue one with allowedKeyInstallCount set to the expected fleet size and a short timeToLive, or delete it immediately if it is no longer needed for active rollout.

Recommended Module Refresh: modules run enum_management_agent --install_keys --get

MANAGEMENT_AGENT_INSTALL_KEY_UNLIMITED_IN_USE (MEDIUM)

What It Detects: The install key is not just theoretically unlimited (isUnlimited is true) but has confirmed live usage (currentKeyInstallCount > 0) while remaining ACTIVE with no install cap. This is a proven, still-valid credential that can keep enrolling agents indefinitely if leaked, for example if it was left behind in config-management repos, golden images, or install scripts, letting a pentester register a rogue agent that can then execute commands on the host it lands on.

Detection Logic (management_agent_install_keys): flags a row when:

  • lifecycle_state contains 'ACTIVE'
  • truthy(is_unlimited)
  • current_key_install_count > 0 (confirmed live usage)

Typical Remediation: rotate this key -- delete it and issue a replacement with a bounded install count matching the completed rollout. Also audit management_agent_agents for any host or display_name the deployer does not recognize, since it may indicate a rogue agent was enrolled with this key.

Recommended Module Refresh: modules run enum_management_agent --install_keys --get

MONITORING_ALARM_ENABLED_NO_DESTINATIONS (MEDIUM)

What It Detects: The alarm is enabled and will evaluate its metric query, but has no configured Notifications topic or Streaming destination, so a FIRING transition notifies no one. OCI's CreateAlarmDetails requires at least one destination at creation, so an empty list on a currently‑enabled alarm indicates the referenced topic/stream was later deleted or the destination was cleared post‑creation.

Detection Logic (monitoring_alarms): flags a row when:

  • truthy(is_enabled)
  • destinations is empty/missing/false

Typical Remediation: attach a valid Notifications topic or Streaming destination, or disable the alarm if it is no longer needed.

Recommended Module Refresh: modules run enum_monitoring --alarms

MONITORING_ALARM_CRITICAL_DISABLED (LOW)

What It Detects: The alarm is configured with CRITICAL severity -- OCI's highest alarm severity, intended for conditions requiring immediate action -- but is currently disabled, so it will never fire regardless of the underlying metric condition. This is a narrow, low‑noise check (only the CRITICAL subset, not all disabled alarms) since routine, non‑critical alarms are commonly toggled off during maintenance.

Detection Logic (monitoring_alarms): flags a row when:

  • severity contains 'CRITICAL'
  • is_enabled is false/empty/disabled

Typical Remediation: re-enable the alarm or confirm the disablement is intentional and time-boxed.

Recommended Module Refresh: modules run enum_monitoring --alarms

NETWORK_FIREWALL_ALLOW_ANY_ANY (CRITICAL/LOW)

What It Detects: Rule appears to allow ANY-to-ANY traffic. Broad allow rules can bypass segmentation controls and increase blast radius. A Network Firewall Policy in OCI is a standalone rules container -- it only enforces traffic once a separate NetworkFirewall resource is deployed into a subnet referencing it (network_firewall_policy_id). This check joins the rule's policy against network_firewall_firewalls (excluding DELETED/DELETING/FAILED instances) to distinguish a policy that is actually attached and enforcing traffic from one that is defined but currently attached to nothing.

Detection Logic (network_firewall_security_rules): flags a row when:

  • action == 'ALLOW'
  • condition.source_address or condition.destination_address includes any/all/*
  • condition.service includes any/all/*
  • severity: CRITICAL if network_firewall_policy_id appears in a non-dead row of network_firewall_firewalls; LOW if the policy is not currently attached to any live firewall instance

Typical Remediation: narrow to explicit address/service objects and limit to required flows (before the policy is ever attached, if it isn't already).

Recommended Module Refresh: modules run enum_networkfirewall --firewalls --get

NETWORK_FIREWALL_ALLOW_WITHOUT_MATCH_CRITERIA (CRITICAL/LOW)

What It Detects: ALLOW rule has no match criteria (no src/dst/app/service/url). This can behave as an overly broad allow in policy evaluation. Same attachment-awareness as NETWORK_FIREWALL_ALLOW_ANY_ANY above -- the rule's policy is joined against network_firewall_firewalls to determine whether it is actually enforcing traffic today.

Detection Logic (network_firewall_security_rules): flags a row when:

  • action == 'ALLOW'
  • condition.source_address, condition.destination_address, condition.application, condition.service, and condition.url are all empty
  • severity: CRITICAL if network_firewall_policy_id appears in a non-dead row of network_firewall_firewalls; LOW if the policy is not currently attached to any live firewall instance

Typical Remediation: add explicit source/destination/service/application/url conditions (before the policy is ever attached, if it isn't already).

Recommended Module Refresh: modules run enum_networkfirewall --firewalls --get

NETWORK_FIREWALL_INSPECT_WITHOUT_MODE (MEDIUM)

What It Detects: INSPECT rule has no valid inspection mode. This can weaken intended IDS/IPS behavior.

Detection Logic (network_firewall_security_rules): flags a row when:

  • action == 'INSPECT'
  • inspection not in ('INTRUSION_DETECTION', 'INTRUSION_PREVENTION')

Typical Remediation: set inspection to INTRUSION_DETECTION or INTRUSION_PREVENTION.

Recommended Module Refresh: modules run enum_networkfirewall --firewalls --get

NLB_PUBLIC_NO_NSG (HIGH)

What It Detects: Public NLB has no attached NSGs, reducing network-level filtering controls.

Detection Logic (network_load_balancers): flags a row when:

  • lifecycle_state == 'ACTIVE' (a deleted/deleting NLB row is excluded rather than flagged on stale data)
  • is_private.lower() in ('false', '0', 'no', 'off')
  • network_security_group_ids is empty/missing/false

Typical Remediation: attach restrictive NSGs and explicit ingress policy.

Recommended Module Refresh: modules run enum_network_load_balancers --get

NLB_PUBLIC (MEDIUM)

What It Detects: NLB is configured as public and reachable from internet-routed paths.

Detection Logic (network_load_balancers): flags a row when:

  • lifecycle_state == 'ACTIVE' (a deleted/deleting NLB row is excluded rather than flagged on stale data)
  • is_private.lower() in ('false', '0', 'no', 'off')

Typical Remediation: use private NLBs unless internet exposure is required.

Recommended Module Refresh: modules run enum_network_load_balancers --get

VCN_SECURITY_LIST_INGRESS_ANY_ANY (HIGH/LOW)

What It Detects: Ingress rule allows 0.0.0.0/0 (or equivalent) with any protocol.

Detection Logic (virtual_network_security_lists): flags a row when:

  • ingress rule source is public CIDR AND protocol is ANY
  • severity: HIGH if the security list's id appears in security_list_ids on a non-terminal row of virtual_network_subnets; LOW if not currently attached to any subnet

Typical Remediation: restrict source CIDRs and allowed protocols/ports.

Recommended Module Refresh: modules run enum_core_network --security-lists --subnets --get

VCN_SECURITY_LIST_RDP_OPEN_TO_INTERNET (HIGH/LOW)

What It Detects: Ingress rule exposes RDP from any-address CIDR.

Detection Logic (virtual_network_security_lists): flags a row when:

  • rule.protocol is TCP
  • severity: HIGH if attached to a live subnet (see above); LOW if not

Typical Remediation: restrict RDP ingress to approved admin CIDRs.

Recommended Module Refresh: modules run enum_core_network --security-lists --subnets --get

VCN_SECURITY_LIST_SSH_OPEN_TO_INTERNET (HIGH/LOW)

What It Detects: Ingress rule exposes SSH from any-address CIDR.

Detection Logic (virtual_network_security_lists): flags a row when:

  • rule.protocol is TCP
  • severity: HIGH if attached to a live subnet (see above); LOW if not

Typical Remediation: restrict SSH ingress to approved admin CIDRs.

Recommended Module Refresh: modules run enum_core_network --security-lists --subnets --get

VCN_ROUTE_TABLE_DEFAULT_TO_IGW (MEDIUM/LOW)

What It Detects: Route table contains a default route (0.0.0.0/0 or equivalent) to an internet gateway.

Detection Logic (virtual_network_route_tables): flags a row when:

  • route_rule.network_entity_id indicates internet gateway
  • severity: MEDIUM if the route table's id appears as route_table_id on a non-terminal row of virtual_network_subnets; LOW if not currently attached to any subnet

Typical Remediation: ensure default internet routes are only attached to intended public subnets.

Recommended Module Refresh: modules run enum_core_network --route-tables --subnets --get

VCN_SUBNET_ALLOWS_PUBLIC_IP (MEDIUM)

What It Detects: Subnet does not prohibit public IP assignment on attached VNICs.

Detection Logic (virtual_network_subnets): flags a row when:

  • lifecycle_state not in ('TERMINATED', 'TERMINATING')
  • prohibit_public_ip_on_vnic.lower in ('false', '0', 'no', 'off')

Typical Remediation: disable public IP assignment by default for private subnets.

Recommended Module Refresh: modules run enum_core_network --subnets --get

VCN_SECURITY_LIST_EGRESS_ANY_ANY (LOW)

What It Detects: Egress rule allows any protocol to 0.0.0.0/0 (or equivalent). Always LOW regardless of subnet attachment (already at the severity floor); the title/description note whether the list is currently attached to a live subnet.

Detection Logic (virtual_network_security_lists): flags a row when:

  • egress rule destination is public CIDR AND protocol is ANY

Typical Remediation: tighten egress to least privilege.

Recommended Module Refresh: modules run enum_core_network --security-lists --get

NOTIFICATION_HTTP_SUBSCRIPTION (MEDIUM)

What It Detects: Subscription endpoint uses plaintext http://, which does not provide TLS protection in transit. OCI's ons subscription protocol enum (CUSTOM_HTTPS/EMAIL/HTTPS/ORACLE_FUNCTIONS/PAGERDUTY/ SLACK/SMS) never issues a bare "HTTP" value, so an earlier version of this check that string-matched protocol == 'HTTP' could never fire (a dead check). This version inspects the actual endpoint URL for the plaintext scheme, which OCI does allow as free text on a CUSTOM_HTTPS/HTTPS subscription.

Detection Logic (notification_subscriptions): flags a row when:

  • lifecycle_state != 'DELETED'
  • endpoint.lower starts with 'http://'

Typical Remediation: use HTTPS endpoints for notification subscriptions.

Recommended Module Refresh: modules run enum_notifications --subscriptions --get

OBJECT_STORAGE_PAR_ANY_OBJECT_WRITE (CRITICAL)

What It Detects: A Pre-Authenticated Request (PAR) with access_type of AnyObjectWrite or AnyObjectReadWrite -- a bucket-wide (not single-object) grant. Anyone holding the PAR's secret URL can write/overwrite ANY object in the bucket with zero OCI authentication -- no IAM credentials, no policy evaluation, nothing but knowledge of the URL. object_storage_preauthenticated_requests has no compartment_id column, so this check joins to object_storage_buckets by (namespace, bucket_name) to resolve it.

Detection Logic (object_storage_preauthenticated_requests): flags a row when:

  • access_type in ('AnyObjectWrite', 'AnyObjectReadWrite')

Typical Remediation: delete this PAR if it isn't actively required; if it is, scope it to a single object_name instead of a bucket-wide Any* access type, and set the shortest viable time_expires.

Recommended Module Refresh: modules run enum_objectstorage --pars --namespaces <namespace>

OBJECT_STORAGE_PAR_ANY_OBJECT_READ (HIGH)

What It Detects: A Pre-Authenticated Request (PAR) with access_type=AnyObjectRead -- a bucket-wide (not single-object) grant. Anyone holding the PAR's secret URL can list and read EVERY object in the bucket with zero OCI authentication.

Detection Logic (object_storage_preauthenticated_requests): flags a row when:

  • access_type == 'AnyObjectRead'

Typical Remediation: delete this PAR if it isn't actively required; if it is, scope it to a single object_name instead of a bucket-wide Any* access type, and set the shortest viable time_expires.

Recommended Module Refresh: modules run enum_objectstorage --pars --namespaces <namespace>

OBJECT_STORAGE_BUCKET_PUBLIC_DOWNLOAD_AND_LIST (CRITICAL)

What It Detects: Bucket allows anonymous list + download access (ObjectRead). This can expose all object names and contents to the internet if the namespace is known.

Detection Logic (object_storage_buckets): flags a row when:

  • public_access_type == 'ObjectRead'

Typical Remediation: set Public Access Type to “NoPublicAccess” unless explicitly required. Use GetBucket to verify settings and review access logs for potential exposure.

Recommended Module Refresh: modules run enum_objectstorage --buckets --get --namespaces <namespace>

OBJECT_STORAGE_BUCKET_PUBLIC_DOWNLOAD (HIGH)

What It Detects: Bucket allows anonymous downloads (ObjectReadWithoutList). Object contents can be retrieved if names are guessed or leaked.

Detection Logic (object_storage_buckets): flags a row when:

  • public_access_type == 'ObjectReadWithoutList'

Typical Remediation: set Public Access Type to “NoPublicAccess” unless explicitly required. Review logs for potential downloads of sensitive objects.

Recommended Module Refresh: modules run enum_objectstorage --buckets --get --namespaces <namespace>

OBJECT_STORAGE_BUCKET_CMK_NOT_SET_UP (MEDIUM)

What It Detects: Customer‑managed keys (CMK) are not configured. CMK adds an extra authorization layer: principals must hold KMS decrypt permissions to read objects. This check is gated on get_run (only evaluates buckets enumerated with --get, since kms_key_id is absent from list-only BucketSummary rows) -- enum_objectstorage's buckets --get loop previously never stamped get_run=True on the row (unlike every other --get-capable enum module), so this check could never fire regardless of real risk; the stamp is now applied.

Detection Logic (object_storage_buckets): flags a row when:

  • kms_key_id is empty/missing/false

Typical Remediation: enable KMS encryption on sensitive buckets and restrict key usage. GetBucket is required to see CMK settings.

Recommended Module Refresh: modules run enum_objectstorage --buckets --get --namespaces <namespace>

OBJECT_STORAGE_BUCKET_VERSIONING_DISABLED (MEDIUM)

What It Detects: Bucket versioning is disabled. Without versioning, accidental deletes/overwrites or ransomware‑style changes are harder to recover.

Detection Logic (object_storage_buckets): flags a row when:

  • versioning == 'Disabled'

Typical Remediation: enable versioning for buckets that store important or regulated data. The relevant bucket field is only viewable if one has permissions to GetBucket. ListBucket does not contain the info needed.

Recommended Module Refresh: modules run enum_objectstorage --buckets --get --namespaces <namespace>

OBJECT_STORAGE_NO_READ_LOG (LOW)

What It Detects: No read‑level audit logs are configured for the bucket. This limits ability to detect data exfiltration or suspicious access.

Detection Logic (object_storage_buckets): flags a row when:

  • True is empty/missing/false

Typical Remediation: enable read logs to detect access and potential exfiltration.

Recommended Module Refresh: modules run enum_objectstorage --buckets --get --namespaces <namespace>

OBJECT_STORAGE_NO_WRITE_LOG (LOW)

What It Detects: No write‑level audit logs are configured for the bucket. This reduces visibility into object creation, overwrite, and delete actions.

Detection Logic (object_storage_buckets): flags a row when:

  • True is empty/missing/false

Typical Remediation: enable write logs to detect create/update/delete activity.

Recommended Module Refresh: modules run enum_objectstorage --buckets --get --namespaces <namespace>

OPENSEARCH_CLUSTER_SECURITY_DISABLED (CRITICAL)

What It Detects: The cluster's security_mode is DISABLED, meaning OpenSearch and OpenSearch Dashboards accept connections with no username/password authentication at all, and traffic is transmitted over plaintext HTTP. Any principal with network reachability to the cluster's private endpoint can read/write all indices.

Detection Logic (opensearch_clusters): flags a row when:

  • security_mode contains 'DISABLED'

Typical Remediation: update the cluster to at least PERMISSIVE and then ENFORCING (oci opensearch cluster update --security-mode). Note the transition is one-directional and enforcing cannot be reverted.

Recommended Module Refresh: modules run enum_opensearch --opensearch-clusters

OPENSEARCH_CLUSTER_PUBLIC_ENDPOINT_IP (HIGH)

What It Detects: opensearch_private_ip is populated but is not within any RFC1918 private range, indicating the cluster's data-plane endpoint may be reachable outside the VCN. Search with OpenSearch is designed to expose the cluster only via private endpoints inside its VCN/subnet; a non-private address here should be treated as a network- exposure misconfiguration and investigated (subnet/NSG/route table review) alongside the compute/networking auditors.

Detection Logic (opensearch_clusters): flags a row when:

  • opensearch_private_ip is a valid IPv4 address outside RFC1918 private ranges

Typical Remediation: confirm the cluster's subnet is private (no internet gateway route) and that no NAT/public load balancer fronts the OpenSearch or Dashboard endpoints.

Recommended Module Refresh: modules run enum_opensearch --opensearch-clusters

OPENSEARCH_CLUSTER_SECURITY_PERMISSIVE (HIGH)

What It Detects: The cluster's security_mode is PERMISSIVE. OpenSearch Dashboards requires a username/password, but direct connections to the OpenSearch API endpoint can still be made without credentials, so data- plane access is effectively unauthenticated for anyone with network reachability.

Detection Logic (opensearch_clusters): flags a row when:

  • security_mode contains 'PERMISSIVE'

Typical Remediation: ENFORCING is the OCI-recommended mode and the only mode available for newly created clusters; upgrade PERMISSIVE clusters to ENFORCING (irreversible).

Recommended Module Refresh: modules run enum_opensearch --opensearch-clusters

OAC_OPERATOR_CONTROL_FULLY_PRE_APPROVED (HIGH)

What It Detects: The operator control is configured with "Pre-Approve All Actions", so every access request an Oracle operator raises against resources governed by this control is auto-approved with no customer review, regardless of the action's risk. OCI's own OperatorControl API docs state that if this is enabled, all access requests associated with the operator control will be auto-approved, and the Operator Access Control admin guide recommends selecting specific pre-approved actions rather than blanket pre-approval.

Detection Logic (oac_operator_controls): flags a row when:

  • operator control lifecycle_state contains 'ASSIGNED'
  • truthy(is_fully_pre_approved)

Typical Remediation: switch to a curated pre-approved action list (or require approvers) so higher-risk operator actions still need human sign-off. Cross-reference active assignments (oac_operator_control_assignments) and any auto-approved access requests (oac_access_requests) tied to this control's resources.

Recommended Module Refresh: modules run enum_operator_access_control --operator_controls

OAC_ASSIGNMENT_LOG_NOT_FORWARDED (MEDIUM)

What It Detects: The assignment governing this resource is not forwarding Oracle operator audit logs to a customer- controlled remote syslog server. Actions Oracle operators take on the resource are therefore only visible in Oracle's own audit trail, not the customer's SIEM/log pipeline. OCI's Operator Access Control admin guide documents log forwarding as the recommended mechanism for monitoring operator activity and meeting regulatory/compliance requirements.

Detection Logic (oac_operator_control_assignments): flags a row when:

  • assignment lifecycle_state in ('APPLIED','CUSTOMERASSIGNED')
  • is_log_forwarded is false/empty/disabled

Typical Remediation: enable "Forward audit logs" and configure a remote syslog server on the assignment so operator activity is captured outside Oracle's platform.

Recommended Module Refresh: modules run enum_operator_access_control --assignments

OSMH_MANAGEMENT_STATION_HOST (LOW)

What It Detects: is_management_station marks this instance as a management station: it proxies OCI traffic and mirrors vendor/custom software-source repositories (yum/DNF) that are then served to potentially many downstream on-prem or third-party-cloud instances. Compromise of this single host threatens the integrity of every package distributed to its served fleet, making it a high-value pivot target disproportionate to its instance count of one.

Detection Logic (osmh_managed_instances): flags a row when:

  • management station reports a degraded health_state/mirror_state (patch-serving reliability risk)

Typical Remediation: harden and monitor management-station hosts ahead of ordinary managed instances (restrict network reachability to only its proxy/mirror ports, keep GPG/HTTPS validation enabled for any third-party sources it mirrors), and treat compromise of a management station as a fleet-wide package-supply- chain incident, not a single-host one.

Recommended Module Refresh: modules run enum_os_management_hub --managed-instances --get

OSMH_SCHEDULED_JOB_BROAD_OR_DYNAMIC_TARGET (LOW)

What It Detects: A scheduled job whose managed_compartment_ids or dynamic_set_ids is non-empty is not bound to a fixed, reviewed instance/group list -- OCI docs confirm these targeting modes are mutually exclusive with managed_instance_ids/managed_instance_group_ids and sweep in any current or future managed instance matching the compartment or dynamic membership rule. Anyone who can create/modify such a job (via an over-broad OS Management Hub IAM grant) gets a package install/update/remove, module- stream, software-source-attach, or lifecycle-promote execution primitive across the entire matched fleet rather than a curated subset.

Detection Logic (osmh_scheduled_jobs): flags a row when:

  • scheduled job targets an entire group/compartment/dynamic scope rather than an explicit, bounded instance list

Typical Remediation: prefer explicit managed_instance_ids/managed_instance_group_ids scoping; where compartment-wide or dynamic targeting is required, tightly restrict who can author scheduled jobs and review the job's operations list to confirm the actual blast radius is intended.

Recommended Module Refresh: modules run enum_os_management_hub --scheduled-jobs --get

POSTGRESQL_DB_SYSTEM_NO_NSG (MEDIUM)

What It Detects: The DB system's network_details.nsgIds list is empty, so network access to the PostgreSQL endpoint (port 5432) relies solely on the subnet-wide Security List rather than a dedicated Network Security Group. Oracle's own PostgreSQL documentation recommends NSGs as the mechanism to scope inbound access to specific client resources/NSGs; without one, any host permitted by the broader subnet Security List can reach the database endpoint.

Detection Logic (postgresql_db_systems): flags a row when:

  • lifecycle_state not in ('DELETING','DELETED','FAILED')
  • network_details.nsg_ids is empty/missing/false

Typical Remediation: attach a restrictive NSG (allow only the specific application/client NSGs on port 5432) via UpdateDbSystem network_details.nsgIds, in addition to or instead of relying on the subnet Security List.

Recommended Module Refresh: modules run enum_postgresql --db-systems --get

APIACCESSCONTROL_REQUEST_ACCESS_LIVE (MEDIUM)

What It Detects: Request state is APPROVED, APPROVED_FOR_FUTURE, or DEPLOYED, meaning an operator/caller currently holds -- or is imminently scheduled to hold -- live privileged API access to resource_id for up to duration_in_hrs hours. OCI's Privileged API Access Control admin guide instructs proactively revoking access if the justification is no longer valid or a concern arises.

Detection Logic (apiaccesscontrol_requests): flags a row when:

  • access request status indicates currently-granted/live access

Typical Remediation: correlate resource_id/resource_type and severity (SEV_1/SEV_2 warrant faster triage) against expected change windows, and revoke unexpected or stale grants if the justification no longer holds.

Recommended Module Refresh: modules run enum_apiaccesscontrol --requests

APIACCESSCONTROL_CONTROL_SINGLE_APPROVER (LOW)

What It Detects: ACTIVE control has number_of_approvers <= 1, so only a single identity is needed to approve a privileged access request -- no segregation-of-duties/dual-control. OCI documents a "Requires Second Approval" setting (number_of_approvers=2) specifically to require two distinct identities and block the cloud administrator from self-approving, and states this is best practice for sensitive infrastructure such as Exadata.

Detection Logic (apiaccesscontrol_controls): flags a row when:

  • control's approver list has exactly one configured approver (no dual-control redundancy)

Typical Remediation: raise number_of_approvers to 2 for controls guarding high-value resource_type entries so a single approver cannot unilaterally grant privileged access.

Recommended Module Refresh: modules run enum_apiaccesscontrol --controls

APIACCESSCONTROL_REQUEST_PENDING_APPROVAL (LOW)

What It Detects: Request state is CREATED or APPROVAL_WAITING -- an open access-request decision not yet acted on by an approver group. OCI's own admin guide calls out managing pending/ unattended requests and reminding approvers as a required operational practice, since an unattended request can silently expire or be acted on too late.

Detection Logic (apiaccesscontrol_requests): flags a row when:

  • access request status contains 'PENDING'

Typical Remediation: surface these for prompt approve/reject action by the designated approver group rather than letting them age out.

Recommended Module Refresh: modules run enum_apiaccesscontrol --requests

QUEUE_NO_CMK (LOW)

What It Detects: Queue relies on Oracle's default provider-managed key instead of a customer-managed key from Vault. OCI's official Queue security guidance recommends creating and managing your own encryption keys in Vault rather than the auto-generated default, so key rotation/disable/delete stays under the operator's control and IAM policies can restrict who can manage it.

Detection Logic (queues): flags a row when:

  • queue has no customer-managed KMS key reference (Oracle-managed default in use)

Typical Remediation: call UpdateQueue with a Vault key OCID for queues carrying sensitive message payloads, and gate key lifecycle operations with a dedicated IAM policy.

Recommended Module Refresh: modules run enum_queue --queues --get

ORM_STACK_VARIABLE_POTENTIAL_SECRET (MEDIUM)

What It Detects: Stack variable keys indicate potential secret material (for example password/token/private key). Plaintext stack variables can leak in stack exports and job artifacts.

Detection Logic (resource_manager_stacks): flags a row when:

  • variables JSON has key names matching sensitive patterns (password/token/key/secret/etc.) with non-empty values

Typical Remediation: move secrets to OCI Vault references and avoid plaintext variable values.

Recommended Module Refresh: modules run enum_resourcemanager --stacks --jobs --get --download

ORM_PRIVATE_ENDPOINT_NO_NSG (MEDIUM)

What It Detects: Resource Manager private endpoint has no NSGs attached. This replaces a previous ORM_PRIVATE_ENDPOINT_SOURCE_IP_ANY check that inspected source_ips for a public CIDR -- per the OCI SDK's own PrivateEndpoint.source_ips docstring, that field is an address automatically assigned BY Resource Manager for its own OUTBOUND traffic, not a customer-configurable inbound allowlist, so the old check was evaluating the wrong field entirely. The real customer-controlled network-restriction surface for a private endpoint is its attached NSGs (nsg_id_list).

Detection Logic (resource_manager_private_endpoints): flags a row when:

  • lifecycle_state not in ('DELETING', 'DELETED', 'FAILED')
  • nsg_id_list is empty/missing

Typical Remediation: attach restrictive NSGs to the private endpoint's VNIC.

Recommended Module Refresh: modules run enum_resourcemanager --private-endpoints --get

ORM_CONFIG_SOURCE_PROVIDER_MISSING_SECRET_REF (MEDIUM)

What It Detects: Configuration source provider has a username set but no secret_id reference. The underlying table was previously misnamed (resource_configuration_source_provider, which nothing in the codebase ever registered in the schema or wrote to -- a dead check that could never fire regardless of real risk); the correct, registered table (resource_manager_config_source_providers, populated by ResourceManagerConfigSourceProvidersResource) is now used.

Detection Logic (resource_manager_config_source_providers): flags a row when:

  • username is present AND secret_id is empty

Typical Remediation: store credentials in OCI Vault and reference them via secret OCIDs.

Recommended Module Refresh: modules run enum_resourcemanager --config-source-providers --get

SCH_SERVICE_CONNECTOR_FAILED (MEDIUM)

What It Detects: The connector's lifecycle_state is FAILED, meaning its source->task->target data-movement pipeline is not running. Service Connector Hub is the mechanism OCI's CIS Landing Zone guidance recommends for routing Audit, VCN Flow, and Object Storage logs to a SIEM, so a FAILED connector can mean security-relevant telemetry is silently not being delivered.

Detection Logic (sch_service_connectors): flags a row when:

  • lifecycle_state contains 'FAILED'

Typical Remediation: inspect lifecycle_details on the row and the connector's service logs (console/CLI) for the root cause -- commonly an authorization or target- service error -- then repair or re-enable the connector. Confirm downstream log delivery (SIEM/Object Storage/Stream) resumes once fixed.

Recommended Module Refresh: modules run enum_service_connector --service-connectors --get

SCH_SERVICE_CONNECTOR_NEEDS_ATTENTION (LOW)

What It Detects: The connector is in OCI's NEEDS_ATTENTION state, indicating partial/degraded delivery (e.g. intermittent authorization errors, throttling, or per-run failures) rather than total failure. lifecycle_details on the row typically carries the specific error. Since Connector Hub commonly carries audit/flow-log traffic to external monitoring, a degraded pipeline can produce gaps in log completeness worth investigating even though the connector is technically still enabled.

Detection Logic (sch_service_connectors): flags a row when:

  • lifecycle_state contains 'NEEDS_ATTENTION'

Typical Remediation: review lifecycle_details and recent run history for the connector to identify the intermittent failure mode, then correct the underlying authorization/target-service/throttling issue. This is a degradation signal rather than a hard failure.

Recommended Module Refresh: modules run enum_service_connector --service-connectors --get

STREAMING_STREAM_POOL_NOT_PRIVATE (MEDIUM)

What It Detects: The stream pool's is_private flag is not set, so its messages endpoint (endpoint_fqdn) is publicly resolvable and reachable over the internet rather than restricted to a VCN subnet, per OCI's own Streaming security documentation. Producers/consumers therefore rely solely on IAM request signing and TLS rather than network-level isolation to reach the pool.

Detection Logic (streaming_stream_pools): flags a row when:

  • lifecycle_state in ('ACTIVE','UPDATING')
  • is_private is false/empty/disabled

Typical Remediation: recreate or migrate the pool with a private endpoint (subnet-scoped) for sensitive workloads, or confirm public exposure is intentional. This is a posture signal (mirrors the existing VAULT_KMS_VIRTUAL_PRIVATE_VAULT precedent of flagging a common product default) rather than proof of an active compromise.

Recommended Module Refresh: modules run enum_streaming --stream_pools --get

STREAMING_POOL_KAFKA_AUTO_CREATE_TOPICS_ENABLED (LOW)

What It Detects: The pool's Kafka-compatibility settings have auto_create_topics_enable turned on, deviating from OCI's documented default of false. Any producer able to reach the Kafka-compatible endpoint can implicitly provision new topics/streams, bypassing explicit topic-provisioning controls and enabling resource-sprawl/DoS via unbounded topic creation -- a well-known Kafka hardening item.

Detection Logic (streaming_stream_pools): flags a row when:

  • kafka_settings.auto_create_topics_enable is truthy

Typical Remediation: disable auto-create and provision topics/streams explicitly through IAM-gated calls.

Recommended Module Refresh: modules run enum_streaming --stream_pools --get

STREAMING_POOL_NO_CUSTOMER_MANAGED_KEY (LOW)

What It Detects: No customer-managed (Vault) key is configured, so the pool falls back to Oracle-managed encryption at rest. This mirrors the existing VAULT_KMS_SOFTWARE_KEY pattern: not a vulnerability by itself, but a weaker key-lifecycle control (no customer rotate/disable/delete/audit) for compliance- sensitive streaming data.

Detection Logic (streaming_stream_pools): flags a row when:

  • custom_encryption_key.kms_key_id is empty/missing/false

Typical Remediation: assign a Vault master encryption key via custom_encryption_key when data sensitivity or compliance requires customer key control.

Recommended Module Refresh: modules run enum_streaming --stream_pools --get

TAGGING_DEFINITION_FREEFORM_TAG_POTENTIAL_SECRET (MEDIUM)

What It Detects: OCI's Security Guide states tags must never hold confidential data and points to OCI Vault instead. This tag definition resource carries its own freeform_tags with a key that reads as a credential and a non-empty string value. Unlike a tag default, this value is not auto-propagated to other resources -- it is visible only to anyone who can read this one tag definition -- so it is lower urgency but still worth flagging.

Detection Logic (tag_definitions): flags a row when:

  • a key in freeform_tags matches a credential-shaped key pattern with a non-empty value

Typical Remediation: move the value into OCI Vault and strip the key from freeform_tags.

Recommended Module Refresh: modules run enum_tagging --tag-definitions

TAGGING_TAG_DEFAULT_POTENTIAL_SECRET_VALUE (MEDIUM)

What It Detects: OCI's Security Guide states tags must never hold confidential data and points to OCI Vault instead. This tag default's key name reads as a credential (password, secret, token, private key, or API key) and carries a non-empty literal value that auto-populates onto every new resource created in this compartment/tenancy scope unless explicitly overridden, and mandatorily so when is_required is set. That bakes the secret into every future resource's tags.

Detection Logic (tag_defaults): flags a row when:

  • tag_definition_name matches a credential-shaped key pattern
  • value is a non-empty literal

Typical Remediation: move the value into OCI Vault, blank or delete this tag default, and rotate any secret it may have exposed.

Recommended Module Refresh: modules run enum_tagging --tag-defaults

TENANT_MANAGER_DOMAIN_VERIFICATION_LAPSED (MEDIUM)

What It Detects: The domain claim's lifecycle_state is still ACTIVE but its TXT-record ownership verification status (status) is no longer Active. A Tenant Manager domain claim exists to prove ownership of a corporate email domain and, while Active, blocks outsiders from creating new OCI tenancies using email addresses from that domain -- new sign-ups from the domain are intercepted and brought under this organization's governance. Once the claim is revoked, released, or expiring, that protection is void and anyone with an email address on the domain can create an unmanaged shadow tenancy outside this organization's oversight.

Detection Logic (tenant_manager_domains): flags a row when:

  • lifecycle_state contains 'ACTIVE'
  • status in ('REVOKED','REVOKING','RELEASED','RELEASING','EXPIRING','FAILED')

Typical Remediation: re-add the domain's TXT record in DNS and re-verify ownership in Tenant Manager, or confirm the domain is intentionally being released/retired. If unintentional, treat this as a priority fix -- the exposure window starts the moment the claim leaves the Active state.

Recommended Module Refresh: modules run enum_tenant_manager --domains

TENANT_MANAGER_DOMAIN_VERIFICATION_STALE_PENDING (LOW)

What It Detects: This domain claim has been sitting in PENDING verification (status) for longer than a 7-day threshold measured from time_created. OCI documents a 72-hour verification/remediation window after which an unverified domain claim is revoked; a claim still Pending well beyond that (the 7-day threshold absorbs clock skew and normal DNS propagation delay) indicates the TXT record was never added to DNS or that verification stalled. Until verification completes, the domain is not protected: outsiders can still sign up for OCI using this domain's email addresses without this organization's governance oversight.

Detection Logic (tenant_manager_domains): flags a row when:

  • lifecycle_state contains 'ACTIVE'
  • status contains 'PENDING'
  • time_created age exceeds 7 days

Typical Remediation: add the provided TXT record to the domain's DNS registrar to complete verification, or remove the stale claim if the domain is no longer being onboarded.

Recommended Module Refresh: modules run enum_tenant_manager --domains

VAULT_KMS_VIRTUAL_PRIVATE_VAULT (MEDIUM)

What It Detects: Vault is using the DEFAULT vault type rather than a Virtual Private Vault (VPV). VPVs provide a dedicated HSM partition with stronger isolation and are generally preferred for high‑sensitivity key material and compliance‑driven environments.

Detection Logic (vault_vaults): flags a row when:

  • vault_type.upper == 'DEFAULT'

Typical Remediation: create a Virtual Private Vault and migrate keys/secrets that require stronger isolation. This is often a posture/compliance control rather than an immediate exploit path.

Recommended Module Refresh: modules run enum_vault --vaults

VAULT_KMS_SOFTWARE_KEY (LOW)

What It Detects: Key protection mode is SOFTWARE instead of HSM. SOFTWARE keys are cheaper but provide weaker protections for key material compared to HSM‑backed keys.

Detection Logic (vault_keys): flags a row when:

  • protection_mode.upper == 'SOFTWARE'

Typical Remediation: use HSM protection for sensitive keys. Evaluate alongside IAM controls on key usage (encrypt/decrypt/generateDataKey). This is a posture signal.

Recommended Module Refresh: modules run enum_vault --keys --key-id <key_ocid>

VISUAL_BUILDER_ALLOWLIST_ANY (MEDIUM)

What It Detects: The PUBLIC endpoint's allowlisted_http_ips contains 0.0.0.0/0 (or an equivalent any-address entry), which functionally negates the allowlist and reopens the instance to the entire internet even though it appears to be in "restricted" allowlist mode.

Detection Logic (visual_builder_instances): flags a row when:

  • network_endpoint_details.network_endpoint_type contains 'PUBLIC'
  • allowlisted_http_ips includes public CIDR (0.0.0.0/0 or ::/0)

Typical Remediation: replace the any-address entry with specific administrative/corporate CIDR ranges, or move to a private endpoint (network_endpoint_type=PRIVATE bound to a VCN/subnet).

Recommended Module Refresh: modules run enum_visual_builder --vb-instances

VISUAL_BUILDER_INSTANCE_PUBLIC_UNRESTRICTED (MEDIUM)

What It Detects: The instance uses a PUBLIC network endpoint with no allowlisted_http_ips and no allowlisted_http_vcns configured. Oracle's own Visual Builder admin documentation defines this exact combination as the "Default" access mode: unrestricted network access reachable from the entire public internet with no IP or VCN restriction. Visual Builder instances host app-dev/runtime consoles and deployed web/REST endpoints, so this is a meaningful internet-facing exposure.

Detection Logic (visual_builder_instances): flags a row when:

  • network_endpoint_details.network_endpoint_type contains 'PUBLIC'
  • allowlisted_http_ips and allowlisted_http_vcns both empty

Typical Remediation: switch the instance to "Secure access from allowed IPs and VCNs only" (populate allowlisted_http_ips/allowlisted_http_vcns) or to a private endpoint (network_endpoint_type=PRIVATE bound to a VCN/subnet).

Recommended Module Refresh: modules run enum_visual_builder --vb-instances

OCVP_CLUSTER_SHIELDED_INSTANCE_DISABLED (MEDIUM)

What It Detects: The ESXi cluster does not have Shielded Instance protection (Secure Boot + TPM-based measured boot) enabled. OCI documents this as a STIG-aligned firmware hardening control that defends against boot- level rootkits/malware and ransomware on the ESXi host fleet. Shielded Instances can only be turned on at cluster-creation time and cannot be enabled retroactively, so an ACTIVE cluster with this flag falsy will remain unprotected until it is rebuilt.

Detection Logic (ocvp_clusters): flags a row when:

  • is_shielded_instance_enabled is false/empty/disabled

Typical Remediation: provision a replacement cluster with Shielded Instances enabled and migrate workloads to it; this setting cannot be retrofitted onto the existing cluster. esxi_hosts_count and vmware_software_version on the row provide sizing/version context for planning the rebuild.

Recommended Module Refresh: modules run enum_ocvp --clusters

VULN_SCANNING_OPEN_HIGH_SEVERITY_VULNERABILITY (CRITICAL/HIGH)

What It Detects: Vulnerability state is OPEN (as opposed to FIXED/NOT_APPLICABLE) with a scanner-reported severity of CRITICAL or HIGH, impacting one or more resources in this compartment (impacted_resources_count). This is a direct read of the Vulnerability Scanning service's own verdict (lifecycle_state ACTIVE, state OPEN, severity CRITICAL/HIGH), not an inference, so it is resistant to false positives.

Detection Logic (vulnerability_scanning_vulnerabilities): flags a row when:

  • severity contains 'CRITICAL' or 'HIGH'
  • problem_status indicates the finding is still open/unresolved

Typical Remediation: patch/update the affected package or image referenced by vulnerability_reference (see cve_description for details), prioritizing CRITICAL findings first, then re-run enum_vulnerability_scanning --vulnerabilities to confirm state moves to FIXED.

Recommended Module Refresh: modules run enum_vulnerability_scanning --vulnerabilities

VULN_SCANNING_CONTAINER_SCAN_TARGET_FAILED (MEDIUM)

What It Detects: Container scan target lifecycle_state is FAILED, a terminal SDK error state rather than a transient CREATING/UPDATING one. While FAILED, images in target_registry are not being scanned for known CVEs -- a registry-scanning blind spot, not a temporary interruption.

Detection Logic (vulnerability_scanning_container_scan_targets): flags a row when:

  • container scan target target_state contains 'FAILED'

Typical Remediation: verify the target/recipe configuration and IAM policy for the registry, recreate the target, and re- run enum_vulnerability_scanning --container-scan-targets to confirm ACTIVE state before relying on this registry's scan coverage.

Recommended Module Refresh: modules run enum_vulnerability_scanning --container-scan-targets

VULN_SCANNING_HOST_SCAN_TARGET_FAILED (MEDIUM)

What It Detects: Host scan target lifecycle_state is FAILED, a terminal SDK error state distinct from the transient CREATING/UPDATING states. While the target remains FAILED, the compute instances covered by target_compartment_id/instance_ids are not actually being scanned for OS vulnerabilities -- a silent scanning coverage gap rather than a temporary blip.

Detection Logic (vulnerability_scanning_host_scan_targets): flags a row when:

  • host scan target target_state contains 'FAILED'

Typical Remediation: review the target for the underlying error (common causes: missing service gateway or disabled traffic-forwarding for private-subnet agent scanning, a disabled Vulnerability Scanning plugin on the agent, or a missing IAM policy), then recreate the target and re-run enum_vulnerability_scanning --host-scan-targets to confirm it returns to ACTIVE.

Recommended Module Refresh: modules run enum_vulnerability_scanning --host-scan-targets

WAAS_CERTIFICATE_EXPIRED (MEDIUM/LOW)

What It Detects: The certificate's time_not_valid_after is in the past while lifecycle_state is still ACTIVE, meaning an expired TLS certificate remains attached to a WAAS resource. Public clients hitting the fronted domain will see certificate-invalid warnings, training users to click through TLS errors and opening a MITM/downgrade risk.

Detection Logic (waas_certificates): flags a row when:

  • lifecycle_state contains 'ACTIVE'
  • time_not_valid_after < now
  • severity: MEDIUM if the certificate's id appears as policy_config.certificate_id on a non-dead row of waas_waas_policies; LOW if not currently referenced by any policy

Typical Remediation: rotate/replace the certificate (upload a new cert and update the policy's SSL config), then remove the expired one.

Recommended Module Refresh: modules run enum_waas --certificates --waas-policies --get

WAAS_CERTIFICATE_EXPIRING_SOON (MEDIUM/LOW)

What It Detects: The certificate is still valid but time_not_valid_after falls within the next 30 days, so it will expire without rotation. Flags upcoming TLS breakage/outage risk before it becomes an active MITM/trust-warning exposure.

Detection Logic (waas_certificates): flags a row when:

  • lifecycle_state contains 'ACTIVE'
  • now <= time_not_valid_after < now + 30 days
  • severity: MEDIUM if attached to a policy (see above); LOW if not

Typical Remediation: schedule certificate renewal ahead of the expiry date.

Recommended Module Refresh: modules run enum_waas --certificates --waas-policies --get

WAAS_CERTIFICATE_TRUST_VERIFICATION_DISABLED (MEDIUM/LOW)

What It Detects: is_trust_verification_disabled=true means chain-of-trust verification was skipped when the certificate was uploaded, which OCI documents as indicating the certificate is most likely self- signed. A self-signed cert fronting a public WAAS domain causes browser trust warnings for end users and offers no CA-backed identity assurance, undermining the purpose of TLS termination at the WAF edge.

Detection Logic (waas_certificates): flags a row when:

  • truthy(is_trust_verification_disabled)
  • severity: MEDIUM if attached to a policy (see above); LOW if not

Typical Remediation: replace with a CA-issued certificate for any domain serving public traffic; self-signed certs should be limited to internal/test policies only.

Recommended Module Refresh: modules run enum_waas --certificates --waas-policies --get

WAF_POLICY_DEFAULT_ACTION_NOT_BLOCKING (MEDIUM/LOW)

What It Detects: The policy's default action (request_access_control.default_action_name, resolved against actions[]) is applied to any request that matches none of the configured request access-control rules. When that action's type is ALLOW or CHECK it is not a blocking action -- ALLOW passes the request through untouched and CHECK only logs it -- so unmatched traffic reaches the origin unblocked. This violates OCI's own recommended deny-by-default WAF posture.

Detection Logic (web_app_firewall_policies): flags a row when:

  • policy lifecycle_state contains 'ACTIVE' and was enumerated with --get (actions[] populated)
  • the action referenced by request_access_control.default_action_name has type in ('ALLOW','CHECK')
  • severity: MEDIUM if the policy's id appears as web_app_firewall_policy_id on a non-dead row of web_app_firewalls; LOW if not currently deployed

Typical Remediation: set the Default Action for request access control to a RETURN_HTTP_RESPONSE action (e.g. HTTP 403/400) so traffic not covered by an explicit allow rule is blocked, then re-run enum_waf --get to confirm.

Recommended Module Refresh: modules run enum_waf --firewall-policies --firewalls --get

WAF_POLICY_RATE_LIMIT_ACTION_CHECK_ONLY (LOW)

What It Detects: A rate-limiting rule under request_rate_limiting.rules is bound (via action_name) to an action whose type is CHECK, so requests that exceed the configured rate are logged but never throttled or blocked. Rate-limiting rule actions are only ever CHECK or RETURN_HTTP_RESPONSE, so CHECK unambiguously means the rule provides visibility only -- not the brute-force/DoS/scraping mitigation it appears to implement. Always LOW regardless of deployment status (already at the severity floor); the title/description note whether the policy is currently deployed.

Detection Logic (web_app_firewall_policies): flags a row when:

  • policy enumerated with --get (actions[] populated)
  • a request_rate_limiting.rules[] entry's action_name resolves to an action with type contains 'CHECK'

Typical Remediation: rebind the rule's action_name to a RETURN_HTTP_RESPONSE action (e.g. HTTP 429) once validated in CHECK mode, then re-run enum_waf --get to confirm.

Recommended Module Refresh: modules run enum_waf --firewall-policies --get

WLMS_DOMAIN_PATCH_READINESS_ERROR (MEDIUM)

What It Detects: The domain's patch_readiness_status is ERROR while the domain itself is ACTIVE, meaning WLMS cannot currently orchestrate a patch apply against it (Oracle's WLMS docs require a Passed/OK readiness state before patching can proceed). This is a platform‑visible blocker to remediating known WebLogic Server CVEs via the managed patching path.

Detection Logic (wlms_wls_domains): flags a row when:

  • patch_readiness_state contains 'ERROR'

Typical Remediation: review lifecycle_details and the domain's patch‑readiness detail in the console/CLI (oci wlms wls- domain get) to resolve the underlying scan failure (agent connectivity, OPatch/middleware‑home integrity, disk space) so patches can be applied.

Recommended Module Refresh: modules run enum_wlms --wls-domains --get

WLMS_DOMAIN_PATCH_READINESS_UNKNOWN (LOW)

What It Detects: patch_readiness_status is UNKNOWN on an ACTIVE domain, indicating no readiness scan has completed, so the platform has no basis for confirming this domain is patchable. Left unresolved, the domain effectively sits outside the managed‑ patching workflow.

Detection Logic (wlms_wls_domains): flags a row when:

  • patch_readiness_state is empty/missing or contains 'UNKNOWN'

Typical Remediation: trigger/verify a patch‑readiness scan (oci wlms wls-domain ... scan or console "View patch readiness details") and re‑enumerate.

Recommended Module Refresh: modules run enum_wlms --wls-domains --get

WLMS_MANAGED_INSTANCE_PLUGIN_INACTIVE (LOW)

What It Detects: The managed‑instance's WLMS agent plugin_status is INACTIVE (the only other value is ACTIVE per the OCI CLI spec), meaning the host is not currently reporting to WLMS. WebLogic servers on this host are outside patch orchestration and configuration visibility until the agent resumes reporting.

Detection Logic (wlms_managed_instances): flags a row when:

  • managed instance's management-agent plugin state is not ACTIVE/RUNNING

Typical Remediation: check the WLS Management Agent service on the host (connectivity, agent process health) and confirm it resumes ACTIVE status.

Recommended Module Refresh: modules run enum_wlms --managed-instances --get

Home | Getting Started | Auth | Workspace | Orchestration Modules | Downloads to Disk | Data View/Export | Operator Runbook | Troubleshooting and FAQ | OpenGraph - Node/Edge Tables | OpenGraph - Default Priv Escalation Mode | OpenGraph - IAM Conditionals | OpenGraph - Inheritance & IncludeAll | ConfigChecker - Static Config Checks | Module Development Guide

OCInferno Wiki

Core Operations

OpenGraph

Config Checks

Development

Clone this wiki locally