This dashboard transforms raw VCN logs into actionable insights, giving security, network, and cloud teams the power to quickly detect, investigate, and respond to threats within their Oracle Cloud environment. It performs threat evaluation on client IP addresses to find those with bad reputation.

The following image is an example Virtual Cloud Network dashboard/view:

The Virtual Cloud Network dashboard has the following widgets:

• All Network Traffic:

  Provides an at-a-glance overview of the total network traffic volume (in GB) over the selected time period, along with a percentage trend. This helps you quickly assess significant increases or decreases in overall data flow, which could indicate shifts in activity or potential security events.

• Threat IPs by Location:

  Displays the geographic origin of threat IPs detected on your network using a world map visualization. This allows you to identify if suspicious activity is concentrated in specific regions, which can help with threat attribution or geo-based access blocking.

• Top 10 Denied Connections by Port:

  Shows a breakdown of the ports that are being most frequently targeted with denied connection attempts. Understanding which ports face the highest risk lets you focus on reinforcing security controls where they are needed most.

• Top 10 Denied Connections by Source:

  Highlights the source IP addresses that are generating the most denied connection attempts, visualized as a pie chart. This helps you quickly identify persistent offenders or potentially compromised hosts targeting your network.

• Top 10 Destination Ports:

  Lists the most popular destination ports in terms of traffic volume, helping pinpoint which services and protocols are most accessed. This is valuable for validating expected traffic patterns and spotting abnormal access trends that could signal an attack.

• Network Data Traffic Analysis by Source IP:

  Provides a detailed, time-based visualization of network data transfers broken down by source IP, including bubble and bar charts for volume and log record activity. This widget enables rapid detection of data spikes, traffic anomalies, or unusual source behaviors requiring further investigation.

Together, these widgets give you end-to-end visibility for spotting, investigating, and responding to VCN-related security events.

The widgets in this dashboard/view collectively provide deep visibility into access-related activities across compute resources.

By tracking failed login attempts for both Linux (SSH) and Windows (RDP), as well as monitoring for sudo command abuse and access control changes, the dashboard enables teams to:

• Identify and investigate brute-force or targeted attack attempts.
• Detect privilege escalation efforts or policy tampering.
• Correlate activity across user accounts and compute instances to quickly zero in on suspicious patterns. This comprehensive view empowers security teams and administrators to proactively detect, investigate, and respond to threats before they escalate, strengthening the security posture of the compute environment.

The following image is an example Compute dashboard/view:

The following widgets are displayed in your Compute dashboard/view:

• Failed SSH Login Trend by Destination Account:

  This bar chart displays trends in failed SSH login attempts over time, grouped by the targeted account. It helps identify which user accounts are being targeted most frequently by unauthorized login attempts and spot brute-force attacks.

• Failed SSH Login Trend by Destination Account:

  The treemap visualizes the distribution of failed SSH logins across different destination accounts, providing a quick, comprehensive view of which accounts are most vulnerable or frequently attacked within the environment.

• Failed SSH Login Trend by Destination:

  This bar chart tracks failed SSH login attempts by destination server IP over time. It enables rapid identification of specific compute instances that are under attack or experiencing abnormal login activity.

• Multiple Failed SUDO Commands:

  This widget is designed to highlight users or sessions where multiple failed sudo command attempts occurred, which can indicate privilege escalation attempts or incorrect configurations.

• Top 10 Windows Failed Logins (RDP):

  Displays the most frequent failed Remote Desktop Protocol login attempts on Windows servers, which is useful for identifying possible brute-force attacks on Windows-based compute resources.

• Windows Access Control Changes by Category Over Time:

  Shows trends in access control changes on Windows systems, categorized for easier analysis. This helps in spotting unauthorized access adjustments or monitoring for compliance.

This dashboard provide visibility into user actions, authentication attempts, and API activity across your OCI tenancy. It helps you to proactively identify, investigate, and respond to security incidents within OCI, helping maintain compliance and minimize risk. It performs threat evaluation on client IP addresses to find those with bad reputation.

The following image is an example OCI Audit dashboard/view:

The following widgets are displayed in your OCI Audit dashboard/view:

• Active Users:

  Shows the current number of users performing actions in the environment, along with a trend indicator. This helps administrators quickly gauge overall activity, and spot unusual spikes or drops in user engagement.

• Failed Logins:

  Displays the count of failed login attempts in the selected period. With accompanying trend lines, this widget helps in spotting any rise in authentication failures that could indicate brute-force attempts or credential misuse.

• Failed Logins by Location:

  Intended to show the geographic origin of failed logins, highlighting suspicious attempts from unexpected regions. This view is crucial for identifying location-based attack patterns.

• Top 10 API Methods:

  Lists the most frequently used API methods, giving insight into the types of operations being executed most often. Reviewing this helps spot potentially risky activities, such as a spike in modification (PUT/POST) operations.

• Top 10 Actions by Path:

  Displays the most common resource paths accessed or modified in the environment. This widget helps identify which areas of the infrastructure are most frequently targeted, supporting the detection of abnormal or unauthorized changes.

• User and Activity Correlation:

  Visualizes users and their associated activities over time, with bubble size and color denoting activity level and endpoint type. This correlation is useful for rapidly spotting anomalous behaviors or high-risk user actions that deviate from the norm.