prowler-cloud 5.12.3__py3-none-any.whl → 5.13.0__py3-none-any.whl

prowler/providers/oraclecloud/services/compute/compute_service.py

@@ -0,0 +1,136 @@
+"""OCI Compute Service Module."""
+
+from typing import Optional
+
+import oci
+from pydantic import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.oraclecloud.lib.service.service import OCIService
+
+
+class Compute(OCIService):
+    """OCI Compute Service class to retrieve compute instances."""
+
+    def __init__(self, provider):
+        """
+        Initialize the Compute service.
+
+        Args:
+            provider: The OCI provider instance
+        """
+        super().__init__("compute", provider)
+        self.instances = []
+        self.__threading_call__(self.__list_instances__)
+
+    def __get_client__(self, region):
+        """
+        Get the Compute client for a region.
+
+        Args:
+            region: Region key
+
+        Returns:
+            Compute client instance
+        """
+        client_region = self.regional_clients.get(region)
+        if client_region:
+            return self._create_oci_client(oci.core.ComputeClient)
+        return None
+
+    def __list_instances__(self, regional_client):
+        """
+        List all compute instances in the compartments.
+
+        Args:
+            regional_client: Regional OCI client
+        """
+        try:
+            compute_client = self.__get_client__(regional_client.region)
+            if not compute_client:
+                return
+
+            logger.info(f"Compute - Listing Instances in {regional_client.region}...")
+
+            for compartment in self.audited_compartments:
+                try:
+                    instances = oci.pagination.list_call_get_all_results(
+                        compute_client.list_instances, compartment_id=compartment.id
+                    ).data
+
+                    for instance in instances:
+                        if instance.lifecycle_state not in [
+                            "TERMINATED",
+                            "TERMINATING",
+                        ]:
+                            # Get instance metadata options
+                            metadata_options = (
+                                instance.instance_options.are_legacy_imds_endpoints_disabled
+                                if hasattr(instance, "instance_options")
+                                and hasattr(
+                                    instance.instance_options,
+                                    "are_legacy_imds_endpoints_disabled",
+                                )
+                                else None
+                            )
+
+                            # Get secure boot status
+                            is_secure_boot_enabled = (
+                                instance.platform_config.is_secure_boot_enabled
+                                if hasattr(instance, "platform_config")
+                                and hasattr(
+                                    instance.platform_config, "is_secure_boot_enabled"
+                                )
+                                else False
+                            )
+
+                            # Get in-transit encryption status from launch options
+                            is_pv_encryption_in_transit_enabled = (
+                                instance.launch_options.is_pv_encryption_in_transit_enabled
+                                if hasattr(instance, "launch_options")
+                                and hasattr(
+                                    instance.launch_options,
+                                    "is_pv_encryption_in_transit_enabled",
+                                )
+                                else None
+                            )
+
+                            self.instances.append(
+                                Instance(
+                                    id=instance.id,
+                                    name=(
+                                        instance.display_name
+                                        if hasattr(instance, "display_name")
+                                        else instance.id
+                                    ),
+                                    compartment_id=compartment.id,
+                                    region=regional_client.region,
+                                    lifecycle_state=instance.lifecycle_state,
+                                    are_legacy_imds_endpoints_disabled=metadata_options,
+                                    is_secure_boot_enabled=is_secure_boot_enabled,
+                                    is_pv_encryption_in_transit_enabled=is_pv_encryption_in_transit_enabled,
+                                )
+                            )
+                except Exception as error:
+                    logger.error(
+                        f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+                    continue
+        except Exception as error:
+            logger.error(
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+
+# Service Models
+class Instance(BaseModel):
+    """OCI Compute Instance model."""
+
+    id: str
+    name: str
+    compartment_id: str
+    region: str
+    lifecycle_state: str
+    are_legacy_imds_endpoints_disabled: Optional[bool] = None
+    is_secure_boot_enabled: bool = False
+    is_pv_encryption_in_transit_enabled: Optional[bool] = None

prowler/providers/oraclecloud/services/database/database_autonomous_database_access_restricted/database_autonomous_database_access_restricted.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "oci",
+  "CheckID": "database_autonomous_database_access_restricted",
+  "CheckTitle": "Ensure Oracle Autonomous Shared Database (ADB) access is restricted or deployed within a VCN",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "CIS OCI Foundations Benchmark"
+  ],
+  "ServiceName": "database",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "oci:database:autonomousdatabase",
+  "Severity": "high",
+  "ResourceType": "AutonomousDatabase",
+  "Description": "Autonomous Shared Database instances should either have IP whitelisting configured or be deployed within a VCN to restrict network access and improve security posture.",
+  "Risk": "Public or unrestricted Autonomous Database access increases the attack surface and risk of unauthorized access.",
+  "RelatedUrl": "https://docs.oracle.com/en/cloud/paas/autonomous-database/adbsa/autonomous-private-endpoints.html",
+  "Remediation": {
+    "Code": {
+      "CLI": "oci db autonomous-database create-private-endpoint --autonomous-database-id <adb-ocid> --subnet-id <subnet-ocid>",
+      "NativeIaC": "",
+      "Other": "1. Navigate to Autonomous Database\n2. Select the database instance\n3. Click 'More Actions' → 'Update'\n4. Under Network Access, select 'Private endpoint access only'\n5. Configure VCN and subnet for private endpoint\n6. Alternatively, configure Access Control List (ACL) with specific IP addresses",
+      "Terraform": "resource \"oci_database_autonomous_database\" \"adb\" {\n  compartment_id = var.compartment_id\n  db_name = \"MyADB\"\n  display_name = \"My Autonomous Database\"\n  is_free_tier = false\n  db_workload = \"OLTP\"\n  whitelisted_ips = [\"10.0.0.0/24\"]\n  nsg_ids = [oci_core_network_security_group.adb_nsg.id]\n  subnet_id = oci_core_subnet.private_subnet.id\n}"
+    },
+    "Recommendation": {
+      "Text": "Deploy Autonomous Databases within a VCN using private endpoints or configure strict IP whitelisting to restrict access.",
+      "Url": "https://hub.prowler.com/check/oci/database_autonomous_database_access_restricted"
+    }
+  },
+  "Categories": [
+    "network-security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/oraclecloud/services/database/database_autonomous_database_access_restricted/database_autonomous_database_access_restricted.py

@@ -0,0 +1,40 @@
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.database.database_client import (
+    database_client,
+)
+
+
+class database_autonomous_database_access_restricted(Check):
+    """Ensure Oracle Autonomous Shared Database (ADB) access is restricted or deployed within a VCN (CIS 2.8)"""
+
+    def execute(self):
+        findings = []
+
+        for adb in database_client.autonomous_databases:
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource=adb,
+                region=adb.region,
+                compartment_id=adb.compartment_id,
+                resource_id=adb.id,
+                resource_name=adb.display_name,
+            )
+
+            # Check if database has no whitelisted IPs and no subnet (unrestricted public access)
+            if not adb.whitelisted_ips and not adb.subnet_id:
+                report.status = "FAIL"
+                report.status_extended = f"Autonomous Database {adb.display_name} has unrestricted public access with no whitelisted IPs and is not deployed in a VCN."
+            # Check if database has whitelisted IPs containing 0.0.0.0/0
+            elif adb.whitelisted_ips and "0.0.0.0/0" in adb.whitelisted_ips:
+                report.status = "FAIL"
+                report.status_extended = f"Autonomous Database {adb.display_name} has unrestricted public access with IP range 0.0.0.0/0 in whitelisted IPs."
+            else:
+                report.status = "PASS"
+                if adb.subnet_id:
+                    report.status_extended = f"Autonomous Database {adb.display_name} is deployed within a VCN."
+                else:
+                    report.status_extended = f"Autonomous Database {adb.display_name} has restricted public access with whitelisted IPs."
+
+            findings.append(report)
+
+        return findings

prowler/providers/oraclecloud/services/database/database_client.py

@@ -0,0 +1,6 @@
+"""OCI Database client."""
+
+from prowler.providers.common.provider import Provider
+from prowler.providers.oraclecloud.services.database.database_service import Database
+
+database_client = Database(Provider.get_global_provider())

prowler/providers/oraclecloud/services/database/database_service.py

@@ -0,0 +1,79 @@
+"""OCI Database service."""
+
+from typing import Optional
+
+import oci
+from pydantic import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.oraclecloud.lib.service.service import OCIService
+
+
+class Database(OCIService):
+    """OCI Database service class."""
+
+    def __init__(self, provider):
+        """Initialize Database service."""
+        super().__init__("database", provider)
+        self.autonomous_databases = []
+        self.__threading_call_by_region_and_compartment__(
+            self.__list_autonomous_databases__
+        )
+
+    def __get_client__(self, region: str) -> oci.database.DatabaseClient:
+        """Get OCI Database client for a region."""
+        return self._create_oci_client(
+            oci.database.DatabaseClient, config_overrides={"region": region}
+        )
+
+    def __list_autonomous_databases__(self, region, compartment):
+        """List all autonomous databases in a compartment."""
+        try:
+            region_key = region.key if hasattr(region, "key") else str(region)
+            database_client = self.__get_client__(region_key)
+
+            autonomous_dbs = oci.pagination.list_call_get_all_results(
+                database_client.list_autonomous_databases, compartment_id=compartment.id
+            ).data
+
+            for adb in autonomous_dbs:
+                # Only include databases not in TERMINATED, TERMINATING, or UNAVAILABLE states
+                if adb.lifecycle_state not in [
+                    oci.database.models.AutonomousDatabaseSummary.LIFECYCLE_STATE_TERMINATED,
+                    oci.database.models.AutonomousDatabaseSummary.LIFECYCLE_STATE_TERMINATING,
+                    oci.database.models.AutonomousDatabaseSummary.LIFECYCLE_STATE_UNAVAILABLE,
+                ]:
+                    self.autonomous_databases.append(
+                        AutonomousDatabase(
+                            id=adb.id,
+                            display_name=adb.display_name,
+                            compartment_id=adb.compartment_id,
+                            region=region_key,
+                            lifecycle_state=adb.lifecycle_state,
+                            whitelisted_ips=(
+                                adb.whitelisted_ips if adb.whitelisted_ips else []
+                            ),
+                            subnet_id=adb.subnet_id,
+                            db_name=getattr(adb, "db_name", None),
+                            db_workload=getattr(adb, "db_workload", None),
+                        )
+                    )
+
+        except Exception as error:
+            logger.error(
+                f"{region_key if 'region_key' in locals() else region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+
+class AutonomousDatabase(BaseModel):
+    """OCI Autonomous Database model."""
+
+    id: str
+    display_name: str
+    compartment_id: str
+    region: str
+    lifecycle_state: str
+    whitelisted_ips: list[str]
+    subnet_id: Optional[str]
+    db_name: Optional[str] = None
+    db_workload: Optional[str] = None

prowler/providers/oraclecloud/services/events/events_client.py

@@ -0,0 +1,4 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.oraclecloud.services.events.events_service import Events
+
+events_client = Events(Provider.get_global_provider())

prowler/providers/oraclecloud/services/events/events_notification_topic_and_subscription_exists/events_notification_topic_and_subscription_exists.metadata.json

@@ -0,0 +1,37 @@
+{
+  "Provider": "oci",
+  "CheckID": "events_notification_topic_and_subscription_exists",
+  "CheckTitle": "Create at least one notification topic and subscription to receive monitoring alerts",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "CIS OCI Foundations Benchmark"
+  ],
+  "ServiceName": "events",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "oci:events:rule",
+  "Severity": "medium",
+  "ResourceType": "OciEventsRule",
+  "Description": "At least one notification topic and subscription should exist to receive monitoring alerts.",
+  "Risk": "Without proper event monitoring, security-relevant changes may go unnoticed.",
+  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Events/home.htm",
+  "Remediation": {
+    "Code": {
+      "CLI": "oci events rule create --display-name <name> --condition <event-condition> --actions <notification-actions>",
+      "NativeIaC": "",
+      "Other": "1. Navigate to Observability & Management > Events Service\n2. Create a new rule\n3. Configure the event condition\n4. Add notification action\n5. Save the rule",
+      "Terraform": "resource \"oci_events_rule\" \"example\" {\n  display_name = \"rule\"\n  is_enabled = true\n  condition = jsonencode({\n    eventType = [\"com.oraclecloud.*\"]\n  })\n  actions {\n    actions {\n      action_type = \"ONS\"\n      topic_id = var.topic_id\n    }\n  }\n}"
+    },
+    "Recommendation": {
+      "Text": "Create at least one notification topic and subscription to receive monitoring alerts",
+      "Url": "https://hub.prowler.com/check/oci/events_notification_topic_and_subscription_exists"
+    }
+  },
+  "Categories": [
+    "logging",
+    "monitoring"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/oraclecloud/services/events/events_notification_topic_and_subscription_exists/events_notification_topic_and_subscription_exists.py

@@ -0,0 +1,53 @@
+"""Check Create at least one notification topic and subscription to receive monitoring alerts."""
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.events.events_client import events_client
+
+
+class events_notification_topic_and_subscription_exists(Check):
+    """Check Create at least one notification topic and subscription to receive monitoring alerts."""
+
+    def execute(self) -> Check_Report_OCI:
+        """Execute the events_notification_topic_and_subscription_exists check."""
+        findings = []
+
+        # Check if at least one topic with subscriptions exists
+        has_topic_with_subscription = any(
+            len(topic.subscriptions) > 0 for topic in events_client.topics
+        )
+
+        # Create a single report for tenancy-level check
+        # Use the first topic's region if available, otherwise use the first audited region
+        region = "global"
+        if events_client.topics:
+            region = events_client.topics[0].region
+        elif events_client.audited_regions:
+            # audited_regions contains OCIRegion objects, extract the key
+            first_region = events_client.audited_regions[0]
+            region = (
+                first_region.key if hasattr(first_region, "key") else str(first_region)
+            )
+
+        report = Check_Report_OCI(
+            metadata=self.metadata(),
+            resource={},
+            region=region,
+            resource_name="Notification Service",
+            resource_id=events_client.audited_tenancy,
+            compartment_id=events_client.audited_tenancy,
+        )
+
+        if has_topic_with_subscription:
+            report.status = "PASS"
+            report.status_extended = (
+                "At least one notification topic with active subscriptions exists."
+            )
+        else:
+            report.status = "FAIL"
+            report.status_extended = (
+                "No notification topics with active subscriptions found."
+            )
+
+        findings.append(report)
+
+        return findings

prowler/providers/oraclecloud/services/events/events_rule_cloudguard_problems/events_rule_cloudguard_problems.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "oci",
+  "CheckID": "events_rule_cloudguard_problems",
+  "CheckTitle": "Ensure a notification is configured for Oracle Cloud Guard problems detected",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "CIS OCI Foundations Benchmark"
+  ],
+  "ServiceName": "events",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "oci:events:rule",
+  "Severity": "medium",
+  "ResourceType": "OciEventRule",
+  "Description": "Ensure a notification is configured for Oracle Cloud Guard problems detected",
+  "Risk": "Without Cloud Guard, security threats may not be detected and remediated.",
+  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/cloud-guard/home.htm",
+  "Remediation": {
+    "Code": {
+      "CLI": "oci cloud-guard configuration update --compartment-id <tenancy-ocid> --status ENABLED --reporting-region <region>",
+      "NativeIaC": "",
+      "Other": "1. Navigate to Security > Cloud Guard\n2. Enable Cloud Guard\n3. Select reporting region\n4. Configure detectors and responders",
+      "Terraform": "resource \"oci_cloud_guard_cloud_guard_configuration\" \"example\" {\n  compartment_id = var.tenancy_ocid\n  reporting_region = var.region\n  status = \"ENABLED\"\n}"
+    },
+    "Recommendation": {
+      "Text": "Ensure a notification is configured for Oracle Cloud Guard problems detected",
+      "Url": "https://hub.prowler.com/check/oci/cloudguard_notification_configured"
+    }
+  },
+  "Categories": [
+    "monitoring"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/oraclecloud/services/events/events_rule_cloudguard_problems/events_rule_cloudguard_problems.py

@@ -0,0 +1,90 @@
+"""Check Ensure a notification is configured for Oracle Cloud Guard problems detected."""
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.cloudguard.cloudguard_client import (
+    cloudguard_client,
+)
+from prowler.providers.oraclecloud.services.events.events_client import events_client
+from prowler.providers.oraclecloud.services.events.lib.helpers import (
+    check_event_rule_has_notification_actions,
+    filter_rules_by_event_types,
+)
+
+
+class events_rule_cloudguard_problems(Check):
+    """Check Ensure a notification is configured for Oracle Cloud Guard problems detected."""
+
+    def execute(self) -> Check_Report_OCI:
+        """Execute the events_rule_cloudguard_problems check."""
+        findings = []
+
+        # Required event types for Cloud Guard notifications
+        required_event_types = [
+            "com.oraclecloud.cloudguard.problemdetected",
+            "com.oraclecloud.cloudguard.problemdismissed",
+            "com.oraclecloud.cloudguard.problemremediated",
+        ]
+
+        # Get Cloud Guard reporting region (if Cloud Guard is configured)
+        reporting_region = None
+        if cloudguard_client.configuration:
+            reporting_region = cloudguard_client.configuration.reporting_region
+
+        # Filter rules that monitor Cloud Guard problems
+        matching_rules = filter_rules_by_event_types(
+            events_client.rules, required_event_types
+        )
+
+        # If reporting region is set, filter rules to only those in that region
+        if reporting_region:
+            matching_rules = [
+                (rule, condition)
+                for rule, condition in matching_rules
+                if rule.region == reporting_region
+            ]
+
+        # Create findings for each matching rule
+        for rule, _ in matching_rules:
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource=rule,
+                region=rule.region,
+                resource_name=rule.name,
+                resource_id=rule.id,
+                compartment_id=rule.compartment_id,
+            )
+
+            # Check if the rule has notification actions
+            if check_event_rule_has_notification_actions(rule):
+                report.status = "PASS"
+                report.status_extended = f"Event rule '{rule.name}' is configured to monitor Cloud Guard problems with notifications."
+                if reporting_region:
+                    report.status_extended += (
+                        f" (Cloud Guard reporting region: {reporting_region})"
+                    )
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"Event rule '{rule.name}' monitors Cloud Guard problems but does not have notification actions configured."
+
+            findings.append(report)
+
+        # If no matching rules found, create a single FAIL finding
+        if not findings:
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource={},
+                region=reporting_region if reporting_region else "global",
+                resource_name="Cloud Guard Problem Notifications",
+                resource_id=events_client.audited_tenancy,
+                compartment_id=events_client.audited_tenancy,
+            )
+            report.status = "FAIL"
+            region_note = (
+                f" in Cloud Guard reporting region '{reporting_region}'"
+                if reporting_region
+                else ""
+            )
+            report.status_extended = f"No event rules configured{region_note} to monitor Cloud Guard problems (detected, dismissed, remediated)."
+            findings.append(report)
+
+        return findings

prowler/providers/oraclecloud/services/events/events_rule_iam_group_changes/events_rule_iam_group_changes.metadata.json

@@ -0,0 +1,37 @@
+{
+  "Provider": "oci",
+  "CheckID": "events_rule_iam_group_changes",
+  "CheckTitle": "Ensure a notification is configured for IAM group changes",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "CIS OCI Foundations Benchmark"
+  ],
+  "ServiceName": "events",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "oci:events:rule",
+  "Severity": "medium",
+  "ResourceType": "OciEventsRule",
+  "Description": "Event rules should be configured to notify on IAM group changes.",
+  "Risk": "Without proper event monitoring, security-relevant changes may go unnoticed.",
+  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Events/home.htm",
+  "Remediation": {
+    "Code": {
+      "CLI": "oci events rule create --display-name <name> --condition <event-condition> --actions <notification-actions>",
+      "NativeIaC": "",
+      "Other": "1. Navigate to Observability & Management > Events Service\n2. Create a new rule\n3. Configure the event condition\n4. Add notification action\n5. Save the rule",
+      "Terraform": "resource \"oci_events_rule\" \"example\" {\n  display_name = \"rule\"\n  is_enabled = true\n  condition = jsonencode({\n    eventType = [\"com.oraclecloud.*\"]\n  })\n  actions {\n    actions {\n      action_type = \"ONS\"\n      topic_id = var.topic_id\n    }\n  }\n}"
+    },
+    "Recommendation": {
+      "Text": "Ensure a notification is configured for IAM group changes",
+      "Url": "https://hub.prowler.com/check/oci/events_rule_iam_group_changes"
+    }
+  },
+  "Categories": [
+    "logging",
+    "monitoring"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/oraclecloud/services/events/events_rule_iam_group_changes/events_rule_iam_group_changes.py

@@ -0,0 +1,67 @@
+"""Check Ensure a notification is configured for IAM group changes."""
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.events.events_client import events_client
+from prowler.providers.oraclecloud.services.events.lib.helpers import (
+    check_event_rule_has_notification_actions,
+    filter_rules_by_event_types,
+)
+
+
+class events_rule_iam_group_changes(Check):
+    """Check Ensure a notification is configured for IAM group changes."""
+
+    def execute(self) -> Check_Report_OCI:
+        """Execute the events_rule_iam_group_changes check."""
+        findings = []
+
+        # Required event types for IAM group changes
+        required_event_types = [
+            "com.oraclecloud.identitycontrolplane.creategroup",
+            "com.oraclecloud.identitycontrolplane.deletegroup",
+            "com.oraclecloud.identitycontrolplane.updategroup",
+        ]
+
+        # Filter rules that monitor IAM group changes
+        matching_rules = filter_rules_by_event_types(
+            events_client.rules, required_event_types
+        )
+
+        # Create findings for each matching rule
+        for rule, _ in matching_rules:
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource=rule,
+                region=rule.region,
+                resource_name=rule.name,
+                resource_id=rule.id,
+                compartment_id=rule.compartment_id,
+            )
+
+            # Check if the rule has notification actions
+            if check_event_rule_has_notification_actions(rule):
+                report.status = "PASS"
+                report.status_extended = f"Event rule '{rule.name}' is configured to monitor IAM group changes with notifications."
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"Event rule '{rule.name}' monitors IAM group changes but does not have notification actions configured."
+
+            findings.append(report)
+
+        # If no matching rules found, create a single FAIL finding
+        if not findings:
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource={},
+                region="global",
+                resource_name="IAM Group Changes Event Rule",
+                resource_id=events_client.audited_tenancy,
+                compartment_id=events_client.audited_tenancy,
+            )
+            report.status = "FAIL"
+            report.status_extended = (
+                "No event rules configured to monitor IAM group changes."
+            )
+            findings.append(report)
+
+        return findings