Skip to main content
Connect your Oracle Cloud Infrastructure (OCI) tenancies to Kestrel for cloud resource inventory, security monitoring, and VCN Flow Log analysis.

​
Prerequisites

  • Organization Admin role in Kestrel
  • OCI tenancy with permissions to create API keys and policies
  • Access to the OCI Console or OCI CLI

​
Setup

1

Create an API key in OCI

  1. In the OCI Console, navigate to Identity → Users → Your User → API Keys
  2. Click Add API Key
  3. Download the private key file
  4. Note the fingerprint displayed after adding the key
2

Create an OCI policy (recommended)

Grant Kestrel read access to your tenancy resources:
Allow group KestrelGroup to read all-resources in tenancy
Allow group KestrelGroup to manage vcn in tenancy
Allow group KestrelGroup to manage flow-log-configs in tenancy
3

Connect in Kestrel

  1. Navigate to Integrations → Cloud in your Kestrel dashboard
  2. Click Connect OCI Tenancy
  3. Fill in the connection form:
    • Connection Name: A friendly name (e.g., “Production”)
    • Tenancy OCID: Found in OCI Console → Tenancy Details
    • User OCID: Found in OCI Console → User Settings
    • Fingerprint: The API key fingerprint from Step 1
    • Private Key: Paste the contents of the private key PEM file
    • Region: Select your OCI home region
  4. Click Verify & Connect
Kestrel validates the credentials and begins discovering your cloud resources.

​
VCN Flow Logs

After connecting:
  1. Navigate to the connected tenancy in the Cloud Integrations page
  2. Expand the VCN Flow Logs section
  3. Click Enable to start collecting flow logs across your VCNs
  4. Kestrel creates the necessary log groups and flow log configurations
You can manage flow logs per-VCN.

​
How It’s Used

​
In Workflows

  • Trigger blocks: OCI Audit events, security list changes, VCN configuration changes
  • Action blocks: Query OCI resources, describe instances, check security lists, generate Terraform fixes

​
In Incident Response

  • Cloud security monitoring — detects misconfigurations across compute instances, object storage, VCNs, and IAM
  • Terraform fix generation — generates IaC remediation targeting connected repositories
  • VCN Flow Log analysis — analyzes traffic patterns for anomalous network behavior

​
In Cloud AI Copilot

  • Ask questions about your OCI resources: What compute instances are publicly accessible?
  • Investigate security findings across tenancies
  • Query resource configurations and compliance posture

​
Managing Connections

  • Refresh: Re-sync connection status and resource inventory
  • Delete: Removes the connection from Kestrel. Clean up the API key and policy in OCI separately.