Scheduled Function/SIEM audit query → Notifications topic

Hi Team,

Sign-on Policy changes are Identity Domain configuration events. OCI Audit remains the authoritative record, but the required event type may not always be available as a direct OCI Events rule in every tenancy or region.

Requirement	Recommended method
Required event type is available in OCI Events Console	Events rule → Notifications topic
Identity Domain Sign-on Policy event is visible in Audit but not available in Events	Scheduled Function/SIEM audit query → Notifications topic
Need alert message to include actor, IP, resource, and request details	Scheduled Function/SIEM audit query is preferred

Can you please detail on configuring Scheduled Function/SIEM audit query → Notifications topic