Description

Ensure VCN flow logs are enabled for every subnet, either by enabling them for the whole VCN or for each subnet. Flow logs record details about accepted and rejected network traffic, such as source, destination, ports, and protocol, and store them in a Logging service log group.

Rationale

Without flow logs, there is no record of which systems talked to each other or what traffic was blocked. This makes it very hard to detect scanning, data exfiltration, or lateral movement, and to investigate incidents afterwards. Flow logs also help troubleshoot security list and network security group rules.

Impact

  • Records network traffic metadata for monitoring and investigations

  • Helps troubleshoot security rules

  • Adds logging storage and ingestion costs

Default Value

By default, VCN flow logs are not enabled.

Pre-Requisites

  • Permission to manage flow logs, log groups, and capture filters

  • A log group to store the flow logs (or create one during setup)

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Networking, and under Network Command Center select Flow logs.

  3. Verify that an active flow log exists for each VCN, or for each subnet.

  4. If any subnet is not covered, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Networking, and under Network Command Center select Flow logs.

  3. Select Enable flow logs, enter a name, and select or create a log group.

  4. Select or create a capture filter (for example, 100% sampling of all traffic).

  5. Select Next, then add an enablement point: choose Virtual cloud network and select the VCN, or choose Subnet and select the subnet.

  6. Review the settings and select Enable flow logs.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Networking, and under Network Command Center select Flow logs.

  3. Select the flow log and disable or delete it.

Reference