Integration of Oracle Cloud Audit with Google SecOps

[manoj610]

Hello Team,

I recently integrated Oracle Cloud Audit logs via an S3 bucket. The logs are in JSON format, and while SecOps is successfully pulling them, I’m encountering an issue with the log format. The logs are breaking incorrectly—either after each line, comma, or curly brace {}—resulting in improper ingestion.

I’ve already verified the basics but haven’t been able to identify the root cause.

Could someone help me troubleshoot this issue, or suggest alternative methods to ingest Oracle Cloud Audit logs into SecOps?

Thanks in advance for your help!

[matthewnichols]

Hi @manoj610 There are two log labels for the Oracle cloud audit logs. It could be using the wrong one. I would take one of the raw logs and confirm that it parses correctly. You can do this by creating a duplicate parser and paste the raw log you have into the raw log section after clicking the edit button that looks like a pencil. Then you can preview the UDM. This will allow you to find out which parser(and log label) works for the logs you have. You don't save the duplicate parser. It's just for testing. 

[manoj610]

Hi @matthewnichols 

Thanks for your response.

I have tested both log labels for the Oracle Cloud audit logs, but the logs are not being parsed.

The primary issue seems to be with ingestion from S3 to SecOps—the logs are being ingested line by line. Could you confirm if there’s an issue or suggest an alternative method for ingesting Oracle logs into SecOps?

Looking forward to your insights.

Thanks,

[ipninichuck]

Hello,

I have looked over our internal guidelines on this topic. I concur with my colleagues that using a webhook will provide a method to get around the json formatting that is causing the problem when you ingest multiple logs from the S3 bucket. I researched the issue from the Oracle side to see what options there were with the json, but they don't have any specific configuration changes that can assist in this situation.