Oracle Cloud Infrastructure (via Codeless Connector Framework)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | OracleCloudInfraConnector |
| Publisher | Microsoft |
| Used in Solutions | Oracle Cloud Infrastructure |
| Collection Method | CCF |
| Connector Definition Files | OCI_DataConnector_DataConnectorDefinition.json |
| DCR Definition Files | OCI_DataConnector_DCR.json |
| CCF Configuration | OCI_DataConnector_PollingConfig.json |
| CCF Capabilities | OCI, Oracle |
| Ingestion API | Log Ingestion API — Sibling ARM template declares DCR / Log Ingestion API resources |
| Custom Log V1 Tables | Yes 🔶 — ingests into tables with type-suffixed columns |
| Microsoft Learn | View on Learn |
The Oracle Cloud Infrastructure (OCI) data connector provides the capability to ingest OCI Logs from OCI Stream into Microsoft Sentinel using the OCI Streaming REST API.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
OCI_LogsV2_CL 🔶 |
✓ | ✓ | ✓ |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read and Write permissions are required.
Custom Permissions:
- OCI Streaming API access: Access to the OCI Streaming API through a API Signing Keys is required.
- OCI IAM Policy: The OCI user associated with the API signing key must have sufficient IAM permissions to consume data from the OCI Stream. The API key provides authentication only; an IAM policy is required for authorization. At minimum, configure: Allow group
to use stream-pull in compartment .
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Connect to OCI Streaming API to start collecting Event logs in Microsoft Sentinel
- Log in to the OCI console and access the navigation menu.
- In the navigation menu, go to "Analytics & AI" -> "Streaming".
- Click "Create Stream".
- Select an existing "Stream Pool" or create a new one.
- Enter the following details:
- "Stream Name"
- "Retention"
- "Number of Partitions"
- "Total Write Rate"
- "Total Read Rate" (based on your data volume)
- In the navigation menu, go to "Logging" -> "Service Connectors".
- Click "Create Service Connector".
- Enter the following details:
- "Connector Name"
- "Description"
- "Resource Compartment"
- Select the "Source": "Logging".
- Select the "Target": "Streaming".
- (Optional) Configure "Log Group", "Filters", or use a "custom search query" to stream only the required logs.
- Configure the "Target" by selecting the previously created stream.
- Click "Create".
- Follow the documentation to create a Private Key and API Key Configuration File. Save the Pem File, pass phrase (Optional, it is not set when using the OCI console to generate the API signing key pair) and fingerprint in a secured place for use when connect. Connector Management Interface
This section is an interactive interface in the Microsoft Sentinel portal that allows you to manage your data collectors.
📊 View Existing Collectors: A management table displays all currently configured data collectors with the following information:
- Tenant Id
- Stream
- Cursor Type
- Partition / GroupName
➕ Add New Collector: Click the "Add new collector" button to configure a new data collector (see configuration form below).
🔧 Manage Collectors: Use the actions menu to delete or modify existing collectors.
💡 Portal-Only Feature: This configuration interface is only available when viewing the connector in the Microsoft Sentinel portal. You cannot configure data collectors through this static documentation.
Add Oracle Cloud Infrastructure Data Stream
Connect to Oracle Cloud Infrastructure Data
When you click the "Add stream" button in the portal, a configuration form will open. You'll need to provide:
- Stream OCID (required): Provide the OCI Stream OCID (E.g. ocid1.stream.oc1..xxxxxxEXAMPLExxxxxx)
- Public Message Endpoint of the stream (Service Endpoint Base URL) (required): Provide the Service Endpoint Base URL: (https://cell-1.streaming.ap-hyderabad-1.oci.oraclecloud.com)
- Cursor Type (required): Select from available options
- Individual Cursor
- Group Cursor (preview)
- Partition Id / Group name (required): Individual Cursor - Partition Id (E.g. 0 or 1 or 2), Group Cursor - Group name
- Tenant ID (required): OCI Tenant ID (E.g. ocid1.tenancy.oc1..xxxxxxEXAMPLExxxxxx)
- User ID (required): Provide the User Id. (E.g. ocid1.user.oc1..xxxxxxEXAMPLExxxxxx)
- Pem File Content (required): Provide the Pem File content.
- Fingerprint (required): Provide the fingerprint for the Pem File Content. (E.g. 12:34:56:78:90:AB:CD:EF:GH:IJ:KL:MN:OP)
- Pem File Pass Phrase (Optional) (optional): Just Leave blank If not encrypted)
💡 Portal-Only Feature: This configuration form is only available in the Microsoft Sentinel portal.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊