Oracle Cloud Infrastructure (OCI) is Oracle’s public cloud platform — similar to AWS, Azure, or Google Cloud — designed to run enterprise workloads securely and efficiently.
It provides cloud services such as Compute, Storage, Networking, Databases, Security, and Observability.
Oracle OCI generates several types of logs that you can extract through APIs, CLI, or connectors (like ArcSight SmartConnector):
Audit Logs (Activity Logs) - Records every API call or console action — who did what, when, and from where.
Service Logs (Explore Logs) - Logs from OCI services (Compute, Object Storage, Load Balancer, VCN Flow, Functions, etc.) — used for troubleshooting and analytics.
Flow Logs - Network traffic records (source/destination, ports, protocols, etc.) — useful for network forensics.
Custom Logs - Application or system logs you send to OCI Logging from your own workloads.
Sign in with your tenancy and user credentials.
Click your profile icon (upper-right corner).
Choose User Settings.
Click on Token and keys
If you are Admin and you want creating a key for another user: go to Identity & Security → Domains → select the domain→ User management → select the user → API Keys.
Click Add API Key.
Choose Generate API Key Pair (recommended).
This option automatically creates both public and private keys.
When prompted, click Download Private Key — this file ends with .pem.
Store it securely (for example: ~/.oci/oci_api_key.pem).
Click Add to finish.
After adding the key, the Console shows a Configuration File Preview.
Here are the details that you need to the OCI Service:
[DEFAULT]
user=ocid1.user.oc1..aaaaaaaaexample
fingerprint=aa:bb:cc:dd:ee:ff:11:22:33:44:55:66:77:88:99:00
tenancy=ocid1.tenancy.oc1..aaaaaaaexampletenancy
region=us-ashburn-1
key_file=The Private Key file that you downloaded before
You can always view this snippet again:
User Settings → API Keys → ⋮ (menu) → View Configuration File
In the left menu, navigate to Identity & Security → Policies.
Find the compartment or tenancy where the policy should apply.
For most API integrations, this is at the tenancy level.
Click Create Policy.
Fill in the fields as follows:
Name: (e.g.) AllowAuditAccess
Description: (e.g.) Allow API key users in AuditReaders group to read Audit logs
Compartment: choose your tenancy root compartment
Statement: enter the permissions (see examples below)
Under Policy Builder:
Choose in the Policy Use cases drill down Audit.
Choose in the Common policy templates drill down Let auditors inspect your resources.
Choose Groups check box.
Select the group to add permissions for.
click Create.
/All Rules/Real-time Rules/Mobula/Products/ORACLE/OCI@ORACLE/ORACLE OCI Audit/OCI: Admin Logged In Successfully
/All Rules/Real-time Rules/Mobula/Products/ORACLE/OCI@ORACLE/ORACLE OCI Audit/OCI: First-Time Admin User Activity
/All Rules/Real-time Rules/Mobula/Products/ORACLE/OCI@ORACLE/ORACLE OCI Audit/OCI: Multiple Admin Account Login Failures
/All Rules/Real-time Rules/Mobula/Products/ORACLE/OCI@ORACLE/ORACLE OCI Audit/OCI: User Logged In from Known Malicious IP
/All Rules/Real-time Rules/Mobula/Products/ORACLE/OCI@ORACLE/ORACLE OCI Audit/OCI: User Logged In from Multiple Countries
/All Rules/Real-time Rules/Mobula/Products/ORACLE/OCI@ORACLE/ORACLE OCI Audit/OCI: User Logged In From Unauthorized Country
/All Rules/Real-time Rules/Mobula/Products/ORACLE/OCI@ORACLE/ORACLE OCI Audit/OCI: User Logged In Outside Working Hours