OCI Event Rule and Notification does not exist for network gateways changes
This policy identifies the OCI compartments which do not have an Event Rule and Notification that gets triggered for Network Gateways changes. This policy includes Internet Gateways, Dynamic Routing Gateways, Service Gateways, Local Peering Gateways, and NAT Gateways. Monitoring and alerting on changes to Network Gateways will help in identifying changes to the security posture. It is recommended that an Event Rule and Notification be configured to catch changes made to Network Gateways.
NOTE: 
1. Event Rules are compartment scoped and will detect events in child compartments, it is recommended to create the Event rule at the root compartment level.
2. This policy will trigger alert if you have at least one Event Rule and Notification, even if OCI has single or multi compartments.
This is applicable to oci cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to the OCI Console
2. Type the Event into the Search box at the top of the Console.
3. Click the Event Service from the Services submenu
4. Select the compartment that should host the rule
5. Click Create Rule
6. Provide a Display Name and Description
7. Create a Rule Condition by selecting Networking in the Service Name Drop-down and selecting DRG – Create, DRG – Delete, DRG – Update, DRG Attachment – Create, DRG Attachment – Delete, DRG Attachment – Update, Internet Gateway – Create, Internet Gateway – Delete, Internet Gateway – Update, Internet Gateway – Change Compartment, Local Peering Gateway – Create, Local Peering Gateway – Delete, Local Peering Gateway – Update, Local Peering Gateway – Change Compartment, NAT Gateway – Create, NAT Gateway – Delete, NAT Gateway – Update, NAT Gateway – Change Compartment, Service Gateway – Create, Service Gateway – Delete Begin, Service Gateway – Delete End, Service Gateway – Update, Service Gateway – Attach Service, Service Gateway – Detach Service, Service Gateway – Change Compartment
8. In the Actions section select Notifications as Action Type
9. Select the Compartment that hosts the Topic to be used.
10. Select the Topic to be used
11. Optionally add Tags to the Rule
12. Click Create Rule.

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-events-rule' AND json.rule = '(isEnabled equals true) and (actions.actions[?any( actionType equals ONS and isEnabled equals true and lifecycleState equals ACTIVE)] exists) and (condition.eventType[*] contains com.oraclecloud.virtualnetwork.createdrg and condition.eventType[*] contains com.oraclecloud.virtualnetwork.deletedrg and condition.eventType[*] contains com.oraclecloud.virtualnetwork.updatedrg and condition.eventType[*] contains com.oraclecloud.virtualnetwork.createdrgattachment and condition.eventType[*] contains com.oraclecloud.virtualnetwork.deletedrgattachment and condition.eventType[*] contains com.oraclecloud.virtualnetwork.updatedrgattachment and condition.eventType[*] contains com.oraclecloud.virtualnetwork.changeinternetgatewaycompartment and condition.eventType[*] contains com.oraclecloud.virtualnetwork.createinternetgateway and condition.eventType[*] contains com.oraclecloud.virtualnetwork.deleteinternetgateway and condition.eventType[*] contains com.oraclecloud.virtualnetwork.updateinternetgateway and condition.eventType[*] contains com.oraclecloud.virtualnetwork.changelocalpeeringgatewaycompartment and condition.eventType[*] contains com.oraclecloud.virtualnetwork.createlocalpeeringgateway and condition.eventType[*] contains com.oraclecloud.virtualnetwork.deletelocalpeeringgateway and condition.eventType[*] contains com.oraclecloud.virtualnetwork.updatelocalpeeringgateway and condition.eventType[*] contains com.oraclecloud.natgateway.changenatgatewaycompartment and condition.eventType[*] contains com.oraclecloud.natgateway.createnatgateway and condition.eventType[*] contains com.oraclecloud.natgateway.deletenatgateway and condition.eventType[*] contains com.oraclecloud.natgateway.updatenatgateway and condition.eventType[*] contains com.oraclecloud.servicegateway.attachserviceid and condition.eventType[*] contains com.oraclecloud.servicegateway.changeservicegatewaycompartment and condition.eventType[*] contains com.oraclecloud.servicegateway.createservicegateway and condition.eventType[*] contains com.oraclecloud.servicegateway.deleteservicegateway.begin and condition.eventType[*] contains com.oraclecloud.servicegateway.deleteservicegateway.end and condition.eventType[*] contains com.oraclecloud.servicegateway.detachserviceid and condition.eventType[*] contains com.oraclecloud.servicegateway.updateservicegateway ) and actions.actions[*].topicId exists' as X; count(X) less than 1```