About The Device
Protect and monitor the SaaS environment for your businesses. The SaaS Security Management platform that lets you Scan, Secure, and Monitor your SaaS applications like Box, Dropbox, Salesforce, etc.
Device Information
Entity | Particulars |
|---|---|
Vendor Name | AppOmni |
Product Name | AppOmni |
Type of Device | Cloud |
Collection Method
Log Type | Ingestion label | Preferred Logging Protocol - Format | Log Collection Method | Data Source |
|---|---|---|---|---|
AppOmni | APPOMNI | Webhook - JSON | C2C - Push | N/A |
Device Configuration
AppOmni Integration with Webhook (Recommended)
Log into your AppOmni console
Navigate to Threat detection > Destinations
Click Add Destination
search for Webhook and click on that.
Click Continue.
Fill below details and rest everything should have default value.
a. Name - Provide the name
b. Description (Optional) - Provide description
c. URL Endpoint - Contact with On-boarding engineer for this URL
d. HTTP Method - Select Post
e. Delivery Format - Select JSON Lines
Click Save.
Once the destination is created, check if it is enabled. If it is not enabled, enable it.
AppOmni Integration with AWS S3 (Alternative)
Create S3 Bucket
Click Create Bucket
Provide a name for the S3 bucket
Select a Region
Click Create Bucket
Create an IAM User
Create an IAM user with upload access to the bucket. Please reference the AWS documentation, Controlling access to a bucket with user policies, for instructions on performing this step.
Follow below document for IAM user permission:
Accenture MDR Quick Start Guide in Configuring IAM User and KMS Key Policies
Retrieve access key and access key ID
Login to AWS console with the user created in above step.
In the AWS console, select your account name and, in the drop-down menu, select Security credentials
In the Access keys panel, select Create access key. After creation, copy the keys from the Access key and Secret access key fields.
Configure destination as AWS S3 in AppOmni console
Log into your AppOmni console
Navigate to Threat detection > Destinations
Click on Add Destination
.png?version=1&modificationDate=1724829389451&cacheVersion=1&api=v2&width=760&height=201)
Search for Amazon Web Services and click on that
5.Click on Continue
Fill below details and rest everything should be default.
a. Name - Mention the name
b. Description (Optional)- Mention the description
c. AWS region name - Provide the AWS S3 bucket region
d. AWS access key - Provide the Secret Access key which we have created in previous steps
e. AWS access key ID - Provide the Access Key which we have created in previous steps
f. AWS bucket name - Provide the S3 bucket name where you want to store the logs
g. Delivery Format - Select JSON lines
Click on Save
Once the destination has created, check if it is enabled or not. If it is not enabled than enable it.
Review the JSON files in the S3 bucket.
Create SQS and attach with S3:
Refer this document: Configuring AWS Simple Queue Service (SQS) with S3 Storage
Follow below page for IAM user policies which are required for SQS & S3:
If SQS is encrypted, please add below policy in KMS. This policy is required to make s3 events notify SQS:
KMS Policy:
***********
{
"Sid": "example-statement-ID",
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": [
"kms:GenerateDataKey",
],
"Resource": "*"
}
Integration Parameters
Parameters required from customer for Integration.
Property | Default Value | Description |
|---|---|---|
REGION | Custom Value | Select the region of your S3 bucket |
QUEUE NAME | Custom Value | The SQS queue name. |
ACCOUNT NUMBER | Custom Value | The account number for the SQS queue and S3 bucket. |
QUEUE ACCESS KEY ID | Custom Value | This is the 20 character ID associated with your Amazon IAM account. |
QUEUE SECRET ACCESS KEY | Custom Value | This is the 40 character access key associated with your Amazon IAM account. |
SOURCE DELETION OPTION | Custom Value | Whether to delete source files after they have been transferred to Chronicle. This reduces storage costs. Valid values are:
|