> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/l-p-integrations/oracle-cloud-infrastructure/oracle-cloud-infrastructure-manual-setup-small-environments.md). # Oracle Cloud Infrastructure - Manual Setup (Small Environments) *If you wish to centralize logs across many regions into a single architecture, see* [*Oracle Cloud Infrastructure - Manual Setup (Large/Enterprise Environments)*](/connect-your-technology/l-p-integrations/oracle-cloud-infrastructure/oracle-cloud-setup-manual-large-enterprise-environments.md) *or* [*Oracle Cloud Infrastructure - Terraform Setup*](/connect-your-technology/l-p-integrations/oracle-cloud-infrastructure/oracle-cloud-infrastructure-terraform-setup.md)*.* This process is intended for customers with smaller environments who wish to perform the setup manually. It is designed for simpler, single-tenant setups with one device per OCI region. ## Scope and Limitations When choosing to set up this integration, remember the following: * This guide is for one device per OCI region. You will need to repeat this process if you are setting up devices in multiple regions. See the [Multiple Region Configuration section](#multiple-region-configuration) for more information. ## Prerequisites * Make sure there is a user from your organization with Admin-level cloud access to the relevant cloud environment. * Have an email address from your organization that can be used to associate with the IAM machine user you will create. ## Before You Begin ### Resource Names For ease of use, this guide provides suggested names for all region-specific and global resources you will create and that the polling policy will later reference. You may choose to deviate from the suggested names, but be sure to substitute your chosen names where applicable. ### Multiple Region Configuration {% hint style="warning" %} If you are not onboarding multiple regions and you do not anticipate ever doing so, skip this section. {% endhint %} If you are onboarding multiple regions, please note: * The cloud resources you will create in Steps 1-6 are region-specific and must be recreated per region. Note that because region-specific resources exist only in a specific region, for simplicity, you may reuse names. * We recommend you reuse the Identity and Access Management (IAM) resources you will create in Steps 8-11, as they are global across all regions. See below for more information on resource types and their availability in the console. **Region-specific resources:** * Bucket * Retention policy * Lifecycle policy * Stream * Rule * Connector **Global resources:** * Compartment * User * User Group * User key (tied exclusively to its user) * Policy (note that the policy will list regional resources. This means that while you may use the same policy for each region, adding the additional regional resources to the policy will be mandatory.) ### Required Values During the OCI configuration process, you will need to copy out and save a number of values as you add them or they are generated by OCI. Be sure to delete this file once your device is successfully added to Workbench, as it contains sensitive information. These values include, in the order they are created or generated: * Region identifier * OCID * Messages Endpoint * user * fingerprint * tenancy * Base64-encoded user key Knowing each of these values is necessary to successfully complete OCI configuration steps and to also add OCI as a Security Device in Workbench. ## Step 1: Create a Bucket In this step, you will create a bucket to store your audit logs. 1. [Log in to OCI.](https://cloud.oracle.com/) 2. Make sure you are in the correct OCI region for your device. 3. Note your region identifier and save it to a safe place for later use. To find your region identifier, select your region in the top right, then choose **Manage regions** and refer to the list.
Use the top right menu to select Manage regions.
4. Navigate to **Storage > Object Storage & Archive Storage** and select **Buckets**. 5. In the List scope section, select the root compartment if it is not already selected. Be sure to create the rest of your resources in this same root compartment. 6. Select **Create Bucket**. 7. On the Create Bucket screen, configure the following settings: * **Bucket Name** - enter "Expel\_Audit\_Bucket". * **Default Storage Tier** - leave as Standard, then select Emit Object Events. * Leave all other defaults on this page as is. 8. Select **Create**. Your new bucket appears in the list. ## Step 2: Set a Retention Rule Expel recommends implementing a Retention Rule Lock, meaning the lock cannot be disabled without bucket deletion. This ensures audit logs remain untouchable during the window Expel maintains to fetch and re-fetch logs. 1. In the row for your new bucket, select the three dots menu on the right and choose **View Bucket Details**.
Use the three dots to select View Bucket Details.
2. Scroll down and select **Retention Rules** on the left side menu. 3. Select **Create Rule**. 4. On the Create Retention Rule screen, configure the following settings: * **Name** - enter "Expel\_Audit\_Protection". * **Retention Rule Type** - leave as **Time-Bound**. * **Retention Duration** - set the Retention Time Amount to **7 days**. *Be sure to select this setting so that the rule cannot be reversed.* * Select **Enable Retention Rule Lock**. * Leave the **Scheduled Lock Time** as it suggests or configure it how you wish. 5. Select **Create**. 6. Check the box to confirm you want to create a time-bound retention rule and select **Create** again. ## Step 3: Set a Lifecycle Policy Rule This step isn’t necessary for Expel functionality, but is highly recommended for cost control. Here you will create a rule to delete files outside of the retention window. {% hint style="info" %} For maximum reliability, Expel recommends a 14 day lifecycle. {% endhint %} 1. Scroll down and select **Lifecycle Policy Rules** in the left menu. 2. Select **Create Rule**. 3. On the Create Lifecycle Rule screen, configure the following settings: * **Name** - enter "Delete\_After\_Expel\_Window". * **Target** - leave as **Objects**. * **Lifecycle Action** - select **Delete**. * **Number of Days** - enter "14". * **State** - leave as **Enabled**. 4. Select **Create**. ## Step 4: Create a Stream The stream you create here will function as a running log of all the files uploaded to the audit log bucket, helping our event poller to determine what it needs to download. {% hint style="info" %} If you are onboarding a device in multiple regions, you will need to create a stream in each region. For simplicity, you can use the same **stream name** in each region, however, the associated **stream ID (OCID)** that is generated will be unique in each region. {% endhint %} 1. Navigate to **Analytics & AI > Messaging > Streaming**. 2. Select **Create Steam**. 3. On the Create Stream screen, configure the following settings: * **Stream Name** - enter "Expel\_Audit\_Stream". * **Compartment** - select the root compartment then choose **Auto-Create a default stream pool**. If you already have an existing stream pool, choose **Select Existing Stream Pool > DefaultPool**. * **Define Stream Settings** - enter "168" for Retention and "1" for Number of Partitions. 4. Select **Create**. 5. In the list of streams, select the stream you just created. 6. Copy the following values and save them to a safe place for later use: * OCID * Messages Endpoint ## Step 5: Create a Rule This event rule will tell OCI which events belong in the stream you just created above. 1. In the OCI search bar, search "Rules" and then select the **Services > Rules** result. 2. Select **Create Rule**. 3. Set the rule properties: * **Display Name** - enter "Expel\_Audit\_Upload\_Event". * **Description** - enter "Triggers when files are uploaded to Expel Audit Bucket". 4. In the Rule Conditions section: * **Condition** - select **Event Type**. * **Service Name** - select **Object Storage**. * **Event Type** - select **Object - Create and Object - Update**. 5. Select **+ Another Condition**. * **Condition** - select **Attribute**. * **Attribute Name** - select **bucketName**. * **Attribute Values** - enter "Expel\_Audit\_Bucket" and press Enter. 6. In the Actions section: * **Action Type** - select **Streaming**. * **Stream Compartment** - select your **root** **compartment**. * **Stream** - select **Expel\_Audit\_Stream**. 7. Select **Create Rule**. ## Step 6: Create a Connector This connector will forward all the logs in this region’s audit log group to the Expel Audit Bucket. 1. In the OCI search bar, search for "Connector Hub" and select the **Connector Hub** result. 2. Select **Create connector**. 3. Set the connector properties: * **Connector name** - enter "Expel\_Audit\_Forwarder". * **Description** - enter "Forwards audit log group to Expel Audit Bucket". * **Resource compartment** - select your **root compartment**. 4. In the Configure connector section: * **Source** - select **Logging**. * **Target** - select **Object Storage**. 5. In the Configure source section: * **Compartment name** - leave your root compartment selected. * **Log group** - select **\_Audit**. * Select **Include \_Audit in subcompartments**. * Skip the Log filter task fields. 6. Skip the Configure task section. 7. In the Configure target section: * **Compartment** - leave your root compartment selected. * **Bucket** - select **Expel\_Audit\_Bucket**. * Select **Show additional options**. * **Batch size (in MBs)** - leave blank. * **Batch time (in milliseconds)** - enter "60000". * An alert banner appears. Select **Create** on the right side of the banner to create your policy.
Select the Create button in the banner.
* The alert banner changes to confirm the policy was created.
Look for a green in the banner and a Policy created message.
8. In the Enable logs section, leave logs **disabled**. 9. Select **Create** in the lower left to create your connector. ## Step 7: Confirm Your Bucket is Receiving Logs {% hint style="warning" %} It may take 5-10 minutes for resources to be created and for the bucket to populate. {% endhint %} 1. Navigate to **Storage > Object Storage & Archive Storage** and select **Buckets**. 2. Select **Expel\_Audit\_Bucket**. 3. In the **Objects** section, use the file explorer to verify that log files exist in the bucket. You can also look at the Last Modified time stamps on these files to further verify that the Connector is working.
Select the V beside the folder icon.
## Step 8: Create an Expel Machine User Group This group will be used to associate the machine user you will soon create with the policy you will grant to the user. {% hint style="info" %} If you have already onboarded a device in another region using this guide, you can reuse the existing user group. {% endhint %} 1. Navigate to I**dentity & Security > Identity** and select **Domains**. 2. Select your domain (it may be "Default"). 3. Select **Groups** in the left menu. 4. Select **Create group**. 5. On the Create Group screen, configure the following settings: * **Name** - enter "Expel\_Machine\_Users". * **Description** - enter "Group with audit polling permissions". 6. Select **Create**. ## Step 9: Create an Expel Log Polling Policy This step will grant our machine user the least level of privileges for the task. {% hint style="info" %} If you have already onboarded a device in another region using this guide, you can reuse the existing policy by appending a line allowing access to your new Stream ID. See the [Reference section](#reference) for an example of a policy with two regions. {% endhint %} 1. Navigate to **Identity & Security > Identity** and select **Policies**. 2. Select **Create Policy**. 3. On the Create Policy screen, configure the following settings: * **Name** - enter "Allow\_Expel\_Log\_Polling". * **Description** - enter "Allow Expel to find and download new log files". * **Compartment** - select your **root compartment**, if it is not already selected. 4. In the Policy Builder section: * Toggle on **Show manual editor**. * Copy and paste the following policy into the editor, replacing `` with the OCID of the stream you created in [Step 4](#step-4-create-a-stream). {% hint style="warning" %} If you deviated from the suggested resource names in this guide, be sure to substitute your names in the policy below. {% endhint %} ``` Allow group 'Default'/'Expel_Machine_Users' to use stream-pull in tenancy where target.stream.id= '' Allow group 'Default'/'Expel_Machine_Users' to read buckets in tenancy where target.bucket.name= 'Expel_Audit_Bucket' Allow group 'Default'/'Expel_Machine_Users' to read objects in tenancy where target.bucket.name= 'Expel_Audit_Bucket' Allow group 'Default'/'Expel_Machine_Users' to read users in tenancy ``` 5. Did you use your stream ID in the new policy? Check to be sure before continuing. 6. Select **Create**. ## Step 10: Create an Expel Machine User In this step, you will create a user to add to the new group. {% hint style="info" %} If you have already onboarded a device in another region using this guide, you can reuse the existing Expel\_Machine\_User. {% endhint %} 1. Navigate to **Identity & Security > Identity** and select **Domains**. 2. Select your domain (it may be "Default"). 3. Select **Users** in the left menu. 4. Select **Create user**. 5. On the Create user screen, configure the following settings: 1. **Last name** - enter "Expel\_Machine\_User". 2. **Username / Email** - we recommend you enter an email you’ll have access to, both so that you can create an API key as the user, and so that OCI can contact you should any problems or maintenance needs arise. 3. Select **Use the email address as the username**. 4. Under Groups, select the check box for **Expel\_Machine\_Users**. 5. Select **Create**. 6. Log out of OCI. In the next step, you will need to log in as the user you just created. ## Step 11: Create a User Key {% hint style="info" %} If you have already onboarded a device in another region using this guide, you can reuse the existing API key. If you do not want to do that, you will need to create a new user and add them to the existing group. You can then generate an API key from that user. {% endhint %} 1. Check for an activation email from Oracle at the address you assigned to the machine user in [Step 10](#step-10-create-an-expel-machine-user). Follow their prompts and log in as the new user. 2. Select the profile image in the upper right and select your username. 3. Scroll down and select **API keys** in the left menu. 4. In the API keys section, select **Add API key**. 5. On the Add API key screen, select **Generate API key pair**. 6. Select **Download private key**. 7. Select **Add**. 8. Pause at this screen and copy and securely store the following values provided in the configuration file: * user * fingerprint * tenancy
The configuration file preview shows all of your values and includes a link to copy.
9. Rename the .pem file you downloaded to "**machineuser.pem**" for ease of CLI reference, and base64 encode it. On UNIX-like systems, you can do this by running `cat machineuser.pem | base64`. {% hint style="danger" %} For security reasons, we do NOT recommend using an online Base64 encoding website. {% endhint %} 10. Copy and securely store this output as the **base64-encoded user key**; you will need to enter it later in Workbench. {% hint style="warning" %} Be sure to delete the .pem file after you have completed the integration with Workbench. {% endhint %} 11. After you have recorded all the needed values, select **Close**. ## Step 12: Add Oracle Cloud Infrastructure as a Security Device in Workbench Now, you can add a Security Device in Workbench to complete the integration. {% hint style="info" %} If you are onboarding devices for additional regions, you can reuse all of the Connection Settings values except Stream ID, Stream endpoint, and OCI region, which are unique to the region you are onboarding. {% endhint %} 1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F). 2. In the side menu, navigate to **Organization Settings > Security Devices**. 3. Select **Add Security Device**. 4. In the search box, type “Oracle” and then select the **Oracle Cloud Infrastructure (OCI) Audit** integration. 5. A configuration pane displays. Complete the fields as follows: 1. **Name** - in a per-region configuration, we’d recommend the format \-\. *For example, "Acme-IAD".* 2. **Location** - we recommend the OCI region identifier. *For example, "us-ashburn-1".* 3. **Connection Settings** - provide the appropriate values you recorded from Steps [4](#step-4-create-a-stream) and [11](#step-11-create-a-user-key).: 4. **Stream ID** - enter the **OCID value**. 5. **Stream endpoint** - enter the **Messages Endpoint** value. 6. **OCI user** - enter the full user value you recorded from the Configuration file preview screen in [Step 11](#step-11-create-a-user-key), beginning with **ocid1.user.oc1**. 7. **OCI key fingerprint** - enter the fingerprint value. 8. **OCI user tenancy** - enter the full tenancy value you recorded from the Configuration file preview screen in [Step 11](#step-11-create-a-user-key), beginning with **ocid1.tenancy.oc1**. 9. **OCI region** - enter the OCI region identifier for the region you are onboarding. *Note that this is NOT the "region" value provided in the configuration file in* [*Step 11*](https://support.expel.io/hc/en-us/articles/38056604986515-Oracle-Cloud-Infrastructure-Manual-Setup-Small-Environments#h_01JJWFSA11S5CMJ9B62DJFKGWM)*. This must be a* [*valid OCI region*](https://docs.oracle.com/en-us/iaas/Content/General/Concepts/regions.htm)*.* 10. **OCI user key, base64 encoded** - enter the base64-encoded user key.
This image shows a preview of the correct format for the various device settings.
6. Select **Save**. 7. On the Console access screen, select **No thanks, I will not provide console access** from the dropdown. 8. Select **Save**. 9. Your device should be created successfully within a few seconds. It may take a few hours for alerts to appear in the Alerts Analysis dashboard while we [tune this device](/workbench-reference/alerts/how-expel-alerts-work.md#device-tuning). ## Troubleshooting If you are encountering an error or if OCI is not connecting to Workbench, try checking for some common issues: 1. If you are configuring multiple regions, double check how you named your resources, and whether you configured your policy correctly in [Step 9](#step-9-create-an-expel-log-polling-policy). 2. Is your device failing to connect in Workbench and showing a 404 error? * Did you input your stream ID into the log polling policy correctly in [Step 9](#step-9-create-an-expel-log-polling-policy)? * It may be another permissions error. Check your log polling policy in OCI, and confirm your stream ID and bucket name are referenced. * This may also indicate an issue with your device configuration in Workbench. 3. Is your audit bucket receiving logs? Check using [these instructions](#step-7-confirm-your-bucket-is-receiving-logs). If not, the issue is likely with the Connector configuration in [Step 6](#step-6-create-a-connector). Double check you created a policy allowing the Connector to write to object storage. 4. Verify you are seeing messages hit the stream. In OCI, navigate to **Streaming > select your stream > Metrics** and check the charts. If there is no message activity, check that your Event Rule from [Step 5](#step-5-create-a-rule) was configured properly. ## Reference Below is an example of a log polling policy where a device has been configured in two regions. The second statement indicating "WEST" was added to onboard a second region. ``` Allow group 'Default'/'Expel_Machine_Users' to use stream-pull in tenancy where target.stream.id= '' Allow group 'Default'/'Expel_Machine_Users' to use stream-pull in tenancy where target.stream.id= '' Allow group 'Default'/'Expel_Machine_Users' to read buckets in tenancy where target.bucket.name= 'Expel_Audit_Bucket' Allow group 'Default'/'Expel_Machine_Users' to read objects in tenancy where target.bucket.name= 'Expel_Audit_Bucket' Allow group 'Default'/'Expel_Machine_Users' to read users in tenancy ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.expel.io/connect-your-technology/l-p-integrations/oracle-cloud-infrastructure/oracle-cloud-infrastructure-manual-setup-small-environments.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.