Lab:70 Vulnerability Scanning - TanveeKhanDB/OCI GitHub Wiki

“OCI Vulnerability Scanning is a managed security service that continuously scans Compute instances and container images for known vulnerabilities, missing patches, open ports, configuration weaknesses and CIS benchmark violations. We configure a scan recipe, associate it with a target containing one or multiple VMs, and review the generated findings by risk level with remediation guidance. However, it has platform and coverage limitations, so it should complement—not replace—other security and compliance tools.”

Configure Oracle Cloud Infrastructure (OCI) Vulnerability Scanning for a Compute instance, then review its host findings. The lab uses the OCI agent to check operating-system vulnerabilities, CIS benchmark compliance, and open ports.

Lab objectives

By the end of this lab, you will be able to:

  • Create a Compute scan recipe with the OCI agent.
  • Create a target for a selected Compute instance.
  • Review host scan, vulnerability, CIS benchmark, and port results.
  • Identify follow-up actions without assuming that every reported port is publicly reachable.

Scope and prerequisites

This walkthrough scans one authorized, non-production Compute instance. Vulnerability Scanning reports findings; it does not patch the instance or change its network rules.

Before you begin, make sure you have:

  • Access to an OCI tenancy and the region where the instance runs.
  • A running Compute instance in a lab compartment, using an OS supported by Vulnerability Scanning.
  • Oracle Cloud Agent installed and running, with the Vulnerability Scanning plugin enabled on the instance.
  • Permission to manage Vulnerability Scanning resources in the lab compartment. An administrator may need to add the policies below.
  • For an instance on a private subnet or without a public IP, a service gateway and route rule that let the VCN reach Oracle services.

Keep the scan target limited to systems you are authorized to assess. Use the same region and lab compartment throughout this exercise.

1. Configure IAM policies

An administrator should confirm that the lab operator can create recipes, targets, and view reports. For example, replace the group and compartment names with your own:

Allow group <vss-admin-group> to manage vss-family in compartment <lab-compartment>

Agent-based scans also require the Vulnerability Scanning service to deploy the Oracle Cloud Agent and read the instance's VNIC information. Scope the service policy to the instance and VNIC compartments. If the VNIC is in the same compartment as the instance, use that compartment for both examples:

Allow service vulnerability-scanning-service to manage instances in compartment <instance-compartment>
Allow service vulnerability-scanning-service to read compartments in compartment <instance-compartment>
Allow service vulnerability-scanning-service to read vnics in compartment <vnic-compartment>
Allow service vulnerability-scanning-service to read vnic-attachments in compartment <vnic-compartment>

To update it for root level use tanancy instead of root:

Allow group SecurityAdmins to manage vss-family in tenancy
Allow service vulnerability-scanning-service to manage instances in tenancy
Allow service vulnerability-scanning-service to read compartments in tenancy
Allow service vulnerability-scanning-service to read vnics in tenancy
Allow service vulnerability-scanning-service to read vnic-attachments in tenancy

If VNICs are in a separate network compartment, grant the VNIC read permissions in that compartment as well. See Required IAM Policies for Compute Scanning Recipes.

2. Create a Compute scan recipe

  1. In the OCI Console, open the navigation menu and go to Identity & Security → Scanning.
  2. Open Scan recipes, select the Hosts tab, and choose Create scan recipe.
  3. Confirm the recipe type is Compute. Enter a name such as Lab71-Compute-Scan and select the lab compartment.
  4. Select the OCI agent for agent-based scanning. Keep agent-based scanning enabled so the service can check OS vulnerabilities and CIS benchmarks.
  5. Enable CIS benchmark scanning and keep the Medium profile for this exercise.
  6. To include a public-IP port scan, select Light (the 100 most common ports). This network scan checks public IP addresses. Agent-based port checks, when enabled, can inspect attached VNICs with public and private IPs.
  7. Choose a Daily schedule and create the recipe.

The scan recipe defines what to check and how often. The OCI agent can report OS vulnerabilities, CIS benchmark results, and port information; public-IP scanning is configured separately. See Creating a Compute Scan Recipe with an OCI Agent.

3. Create a target

  1. From Scanning, open Targets and select the Hosts tab.
  2. Select Create target and confirm the target type is Compute.
  3. Enter a name such as Lab71-Host-Target and a short description.
  4. Select the scan recipe created in the previous step.
  5. For the target compartment, choose the compartment containing your lab instance. For this exercise, create the target in the lab compartment too.
  6. Choose Selected compute instances and select only your lab instance.
  7. Create the target.

If the instance is on a private subnet or has no public IP, verify that its VCN has a service gateway and a route rule for Oracle services. See Creating a Compute Target.

4. View and assess scan results

  1. Allow time for the first scan. Results are often available after about 15 minutes, but the first scan can take up to 24 hours depending on the schedule and configuration.
  2. In the Console, go to Identity & Security → Scanning → Scanning Reports and open the Hosts tab.
  3. Select the compartment where you created the Vulnerability Scanning target. Results are stored with the target, so this can differ from the instance's compartment.
  4. Open the report for your instance. Review the severity summary and inspect the vulnerability, CIS benchmark, and port details that are available.
  5. Record the scan time, the highest severity, and the finding or benchmark details that need follow-up.

Prioritize Critical and High findings, then review the listed package, CVE, and remediation guidance. Validate suggested updates in your normal change process before applying them. For open ports, confirm whether each service is required and review the instance's NSGs and security lists before changing access rules.

An open-port finding is an observation, not a statement that the port is reachable from the public Internet. Firewalls, NSGs, and security lists can block access. See How Port Scans Work.

Expected result

  • The Compute recipe and target are present in the selected region and compartment.
  • A host scan report for the selected instance appears after scanning completes.
  • The report shows findings by severity and includes CIS or port details when those checks are enabled.
  • You can identify an appropriate next action for each finding. A report with no vulnerabilities is also a valid result; the exact findings depend on the instance image and patch level.

Troubleshooting

  • No report yet: Confirm the selected region and target compartment, then allow up to 24 hours for the first scan.
  • Agent findings are missing: Confirm agent-based scanning is enabled in the recipe and the Vulnerability Scanning plugin is enabled and running in Oracle Cloud Agent.
  • Target creation or scan is denied: Ask an administrator to check both the operator's Vulnerability Scanning permissions and the service policies for the instance and VNIC compartments.
  • Private instance is not reporting: Verify the service gateway and route rule for Oracle services in the VCN.
  • Port appears open: Check the host listener and OCI network controls. A scan result alone does not prove Internet reachability.

For additional cases, see Troubleshooting the Vulnerability Scanning Service.

⭐ Interview Answer

🧠 Remember this flow

Recipe = WHAT to scan

Target = WHERE to scan

Scan = FIND vulnerabilities

Report = UNDERSTAND risk

Remediation = FIX the issue

Oracle Docs