Page Comparison

This quick start guide will help Accenture MDR customers configure AWS WAF to send logs to the Log collection Platform (LCP).

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication. 

Configuring AWS WAF

MxDR supports log collection using S3 via SQS.

Prerequisite:

• S3 bucket is created. Please refer the following page to create a S3 bucket.  https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html

Device Configuration Steps:

 1. Enable Logging for WEB ACL to S3 Bucket.

• Log in to the AWS Console.

• Navigate to AWS WAF and select Web ACL from side pane.

• Select the Web ACL's from the list and click Enable Logging button.

 Note : Admin access required for perform the Logging changes

• If Kinesis Firehose stream is already created then select the Amazon Kinesis Firehose stream which is configured as the desired S3 Bucket for log storage. 

• If it is not created, follow steps from Creating Amazon Kinesis Firehose

• In order to send the logs to S3 Bucket, we need to create an Amazon Kinesis Data Firehose. 

2. Creating Amazon Kinesis Firehose

• Navigate to Kinesis Dashboard and click on Create Delivery stream.

• Provide the New delivery stream name

• Select Direct PUT or other Sources from Source.

• Click Next.

• Keep Record Transformation and Record format conversion as Disabled and click Next.

• Select Destination as Amazon S3.

• Select the S3 Destination bucket name from drop-down.

Image Removed

Image Added

Note: Leave the S3 Prefix and Error Prefix configuration textbox as unchanged.

• Use the default preset for Buffer Condition Settings.

• Set S3 Compression and S3 Encryption as Disabled

• Select Enabled for Error logging.

• Add the IAM role inorder to enable the Firehose to Stream logs to S3.

a. Click Create new or choose.​

b. Select Create a new IAM Role from IAM role drop-down menu.

c. Add the Role Name as firehose_delivery_role.

d. Keep the Policy name to Create a new Role policy and click Allow.

Note: It will automatically create a Policy and enable it. The policy name will be appear similar to oneClick_firehose_delivery_role_12312342123

e. Click Next and review the configurations on the Review page.

f. Click Create Delivery Stream to create the Kinesis Firehose Delivery Stream.​

Image Removed

Image Added

3. Select the created Firehose Data Stream from Amazon Kinesis Data Firehose drop-down menu and click Create.

4. Logging will be enabled once it is created.

To create SQS and attach it with S3 please refer https://mdrkb.atlassian.net/wiki/x/AQCeEQ

Note: Please refer below page to check required IAM user and KMS Key policies for S3, SQS and KMS

https://mdrkb.atlassian.net/wiki/x/hoCdEQ

Note: Below are the URL details which we need to allow for connectivity (Please identify URLs by referring AWS document according to your services and regions):

IAM: For any logging source IAM URL should be allowed

https://docs.aws.amazon.com/general/latest/gr/iam-service.html

S3: For S3 or SQS logging source, S3 URL should be allowed.

https://docs.aws.amazon.com/general/latest/gr/s3.html

SQS: For SQS logging source, SQS URL should be allowed.

https://docs.aws.amazon.com/general/latest/gr/sqs-service.html

LCP Configuration Parameters

MxDR supports log collection using role based access control (RBAC) or access key ID and secret method.

• To create access key ID and secret please refer https://docs.aws.amazon.com/powershell/latest/userguide/pstools-appendix-sign-up.html

• To support log collection using RBAC please refer Accenture MDR Quick Start Guide for Role Based Access Control in AWS Generic Sensor

Table 1-2: The AWS WAF event collector (API - 3896) properties to be configured by MDR are given in table.