You are part of an organization with thousands of users accessing Oracle Cloud Infrastructure (OCI). An unknown user action was executed, resulting in configuration errors. You are tasked to quickly identify the details of all users who were active in the last six hours along with any REST API calls that were executed. Which OCI service would you use?
Correct answer:
E
To investigate user activity and REST API calls over the last six hours, the OCI Audit service is the appropriate tool.
Audit (E): This service automatically records all API operations (including REST API calls) performed on OCI resources. It provides detailed logs with user details, timestamps, and actions, ideal for security and compliance investigations. You can filter audit logs by time range (e.g., last six hours) and user attributes.
Why not A, B, C, or D?
Notifications (A): Sends alerts but doesn't store or analyze API call details.
Service Connectors (B): Moves data between services, not for auditing.
Management Agent (C): Collects metrics/logs from resources, not API audit data.
Logging (D): Handles application and system logs, not API activity tracking.
Audit logs are retained for 90 days by default, making this a perfect fit.