oci:audit
OCI Audit log
Every API call in the tenancy (eventName per service); tenancy-level retention
- Host type
- Oracle Cloud Infrastructure
- Tier, as a whole
- Recommended
- Cost class
- Included
- Techniques
- 0
- Rules listed
- 10
- Events
- 3
Why this tier
CISA/ASD priority source; OMB M-26-14 A1 (Identity used; our analysis); OMB M-26-14 A10 (Attack vectors and lateral movement; our analysis); OMB M-26-14 A4 (Privilege changes; our analysis); OMB M-26-14 A5 (Infrastructure changes; our analysis); OMB M-26-14 A8 (Anomalous activity; our analysis)
Licensing
- License or service
- OCI Audit service
- What is free
- All API calls recorded automatically; tenancy-level retention (documentation states 365 days; the page meta-text describes a 90-day default configurable to 365)
- What costs
- Nothing for the Audit log itself; export or Logging-service storage beyond the free tier is billed
- Notes
- Cannot be disabled
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Identity used | Supports an activity | our analysis: identity.principalName on every Audit event |
| OMB M-26-14: Privilege changes | Supports an activity | our analysis: IAM policy, group and dynamic-group operations |
| OMB M-26-14: Infrastructure changes | Supports an activity | our analysis: LaunchInstance, TerminateInstance and configuration changes |
| OMB M-26-14: Anomalous activity | Supports an activity | our analysis: unusual API usage |
| OMB M-26-14: Attack vectors and lateral movement | Supports an activity | our analysis: console sign-in and API key use |
| ASD ACSC / CISA et al.: Priority enterprise log sources | priority_source | quoted (cloud): use of the tenant's user accounts; administrative configuration changes; security principals |
Techniques
No ATT&CK analytic names this source.