# Ensure event rule monitoring network security group changes has notification actions configured

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698527521133-ensure-event-rule-monitoring-network-security-group-changes-has-notification-actions-configured
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure an Events Service rule in the root compartment watches for network security group (NSG) changes and has an action that sends a notification to a monitored topic. The rule should match all of the related event types, so the security team is alerted as soon as these changes happen.

**Rationale**

Network security groups control traffic to specific resources such as instances and databases. An unauthorized rule change can open these resources to the internet. Alerting on NSG changes lets the team review traffic rule changes quickly and reverse any that were not approved.

**Impact**

-   The security team is alerted when an NSG or its rules are created, changed, moved, or deleted
    
-   Speeds up detection of unauthorized or accidental changes
    
-   Alert volume depends on how often these changes happen
    

**Default Value**

By default, no event rules or notification topics are configured.

**Pre-Requisites**

-   Permission to manage cloudevents-rules and ons-topics in the root compartment
    
-   A notification topic with at least one confirmed subscription (for example, the security team's email address)
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Observability & Management, and under Events Service select Rules. In the Compartment filter, select the root compartment (tenancy).
    
3.  Look for an enabled rule whose conditions match the Networking service and these event types: Network Security Group – Change Compartment, Network Security Group – Create, Network Security Group – Delete, and Network Security Group – Update Security Rules.
    
4.  Open the rule and verify that its Actions include a Notifications action pointing to a topic with an active subscription.
    
5.  If no such rule exists, or it has no notification action, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  If you do not have a topic, open Developer Services > Application Integration > Notifications, select Create topic, then create a subscription (for example, Email) and confirm it.
    
3.  Open the navigation menu, select Observability & Management, and under Events Service select Rules. In the Compartment filter, select the root compartment (tenancy).
    
4.  Select Create rule and enter a name, for example notify-on-nsg-changes.
    
5.  Under Rule conditions, choose Event type, select Service name Networking, and select the event types: Network Security Group – Change Compartment, Network Security Group – Create, Network Security Group – Delete, and Network Security Group – Update Security Rules.
    
6.  Under Actions, choose Action type Notifications, and select the compartment and topic.
    
7.  Select Create rule.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Observability & Management, and under Events Service select Rules. In the Compartment filter, select the root compartment (tenancy).
    
3.  Select the rule and select Disable, or delete the rule.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Events/Task/managingrules.htm](https://docs.oracle.com/en-us/iaas/Content/Events/Task/managingrules.htm)
    
-   [https://docs.oracle.com/en-us/iaas/Content/Security/Reference/iam\_security.htm](https://docs.oracle.com/en-us/iaas/Content/Security/Reference/iam_security.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.