Add Oracle Cloud Guard support to the OCI CCF data connector
- Dominant language
- Python
- Stars
- 6.1k
- Forks
- 3.8k
- Avg merge
- 4d 7h
- Merged PRs (30d)
- 125
Description
Is your feature request related to a problem? Please describe.
Oracle Cloud Guard is OCI's core CSPM and threat-detection service, but its events were not represented in the OCI CCF connector (OracleCloudInfraConnector, table OCI_LogsV2_CL). Cloud Guard problem lifecycle events (detected, remediated, dismissed) arrive on the OCI stream in CloudEvents shape rather than the OCI Logging unified envelope, so they landed with empty EventType and id, an ingest-time TimeGenerated, and none of the Cloud Guard problem fields mapped. That makes Cloud Guard data hard to use for detection and triage.
Describe the solution you'd like
Extend the connector additively to ingest and normalize Cloud Guard problem and sighting events:
Add Cloud Guard columns: problem type, status, name, description, recommendation, affected resource name/id/type, risk level and score, sighting type and score, tactic and technique, detector rule type, actor and principal, region, reason, first and last detected, labels.
CloudEvents envelope fallback so TimeGenerated, EventType, and id resolve from eventTime, eventType, and eventID when the OCI Logging keys are absent, with no change to audit or flow-log behavior.
Region normalization that handles both the array shape (audit) and the scalar string (Cloud Guard).
3.0.11 identity-credential prevention preserved.
Net schema change is additive only, 221 to 263 columns, backward compatible for in-place updates.
Describe alternatives you've considered
A slimmer refactor that removed redundant and duplicate columns was considered but set aside, because removing columns from a GA connector breaks existing customer queries, workbooks, and analytics. The redundancy and ingestion-cost concern is tracked separately as its own issue with a deprecation-with-notice plan.
Additional context
Validated end to end on live Cloud Guard problemremediated events: EventType = com.oraclecloud.cloudguard.problemremediated, id populated, TimeGenerated sourced from eventTime, region and all problem fields populated, DCR ingestion showing rows received with zero dropped. Worked example: PR #14859 (additive build on 3.0.11, version 3.0.12).
Contributor guide
Assessment
This issue has not been assessed yet.