...
Source | Destination | Port | Description |
LCP | AWS WAF | 443 (TCP) | Default port |
Configuring AWS WAF
Follow the below steps to configure the AWS WAF.
| Table of Contents | ||||
|---|---|---|---|---|
|
...
MxDR supports log collection using S3 via SQS.
Prerequisite:
S3 bucket is created. Please refer the following page to create a S3 bucket. https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html
Device Configuration Steps:
1. Enable Logging for WEB ACL to S3 Bucket.
Log in to the AWS Console.
Navigate to AWS WAF and select Web ACL from
...
side pane.
Select the Web ACL's from the list and click Enable Logging button.
Note : Admin access required for perform the Logging changes
...
...
If Kinesis Firehose stream is already created then select the Amazon Kinesis Firehose stream which is configured as the desired S3 Bucket for log storage.
...
If it is not created, follow steps from
...
Creating Amazon Kinesis Firehose
...
...
...
In order to send the logs to S3 Bucket, we need to create an Amazon Kinesis Data Firehose.
2. Creating Amazon Kinesis Firehose
Navigate to Kinesis Dashboard and click on Create Delivery stream.
...
...
Provide the New delivery stream name
...
Select Direct PUT or other Sources from Source.
...
Click Next.
...
...
Keep Record Transformation and Record format conversion as Disabled and click Next.
...
...
Select Destination as Amazon S3.
...
...
Select the S3 Destination bucket name from drop-down.
...
Note: Leave the S3 Prefix and Error Prefix configuration textbox as unchanged. 8.
Use the default preset for Buffer Condition Settings.
...
...
Set S3 Compression and S3 Encryption as Disabled
...
...
Select Enabled for Error logging.
...
Add the IAM role inorder to enable the Firehose to Stream logs to S3.
a. Click Create new or choose.
...
b. Select Create a new IAM Role from IAM role drop-down menu.
c. Add the Role Name as firehose_delivery_role.
...
d. Keep the Policy name to Create a new Role policy and click Allow.
Note: It will automatically create a Policy and enable it. The policy name will be appear similar asoneClickto oneClick_firehose_delivery_role_12312342123
...
e. Click Next and review the configurations on the Review page.
f. Click Create Delivery Stream to create the Kinesis Firehose Delivery Stream.
...
Enable loging for WEBACL to AWS WAF.
3. Select the created Firehose Data Stream from Amazon Kinesis Data Firehose drop-down menu
...
Click Create
...
and click Create.
...
3 4. Logging has will be enabled once it is created.
...
...
Refer the document To create SQS and attach it with S3 please refer https://docsmdrkb.awsatlassian.amazon.comnet/AmazonS3wiki/latest/dev/NotificationHowTo.html to configure S3 to send event notification to SQS.
Note: Prerequisite: Following is the IAM user policies required for CloudWatch, SQS and S3:
IAM User Permission - SQS
{“Action”: [“sqs:GetQueueAttributes”,“sqs:GetQueueUrl”,“sqs:ReceiveMessage”,“sqs:DeleteMessage”,“sqs:ListQueues"],“Effect”: “Allow”,“Resource”: “arn:aws:sqs:region:accountID:SQSName”}
IAM User Permission - CloudWatch
{"Effect": "Allow","Action": ["logs:describeLogGroups","logs:describeLogStreams","logs:filterLogEvents","logs:getLogEvents"],"Resource": ["arn:aws:logs:region:accountID:log-group:specificLogGroupName"]}
IAM User Permission – S3
{"Effect": "Allow","Action": ["s3:ListBucket","s3:GetObject"],"Resource": ["arn:aws:s3:::bucketname", "arn:aws:s3:::bucketname/*"],"Condition": {}}x/AQCeEQ
Note: Please refer below page to check required IAM user and KMS Key policies for S3, SQS and KMS
https://mdrkb.atlassian.net/wiki/x/hoCdEQ
Note: Below are the URL details which we need to allow for connectivity (Please identify URLs by referring AWS document according to your services and regions):
IAM: For any logging source IAM URL should be allowed
https://docs.aws.amazon.com/general/latest/gr/iam-service.html
S3: For S3 or SQS logging source, S3 URL should be allowed.
https://docs.aws.amazon.com/general/latest/gr/s3.html
SQS: For SQS logging source, SQS URL should be allowed.
https://docs.aws.amazon.com/general/latest/gr/sqs-service.html
LCP Configuration Parameters
Table 1-2: The AWS WAF event collector (API - 3896) properties to be configured by MDR are given in the table.
...
Property
...
Default Value
...
Description
...
AWS Region
...
Custom Value
...
AWS Region mentioned in the Pre-Installation Questionnaire (PIQ).
...
AWS Secret Access ID
...
Custom Value
...
AWS Secret Access ID mentioned in the Pre-Installation Questionnaire (PIQ).
Note: Based on the Account ID. The IAM user must be part of the appropriate role that has required permissions to access/read the AWS.
...
AWS Secret Access Key
...
Custom Value
...
AWS Secret Access Key mentioned in the PIQ.
...
Logging source
...
SQS
...
Select Cloudwatch or SQS mentioned in the PIQ
MxDR supports log collection using role based access control (RBAC) or access key ID and secret method.
To create access key ID and secret please refer https://docs.aws.amazon.com/powershell/latest/userguide/pstools-appendix-sign-up.html
To support log collection using RBAC please refer Accenture MDR Quick Start Guide for Role Based Access Control in AWS Generic Sensor
...
Property | Access Key and Secret | RBAC |
|---|---|---|
Region | Enter region (Eg: us-west-2) | Enter region (Eg: us-west-2) |
AWS Access Key ID Or Role ARN | Enter Access Key | Provide Role ARN |
AWS Secret Access Key Or External ID | Enter Secret | Enter external ID |
Logging Source | Cloudwatch or SQS | Cloudwatch or SQS |
S3 Bucket/Log Group(s)/SQS |
Custom Value
SQS URL or Cloudwatch Log group name mentioned in the Pre-Installation Questionnaire (PIQ).
Queue URL | Provide cloudwatch log group or SQS URL | Provide cloudwatch log group or SQS URL |
Bucket Prefix Path(s) | Leave Empty | Leave Empty |