AppOmni

1 About The Device
2 Device Information
3 Collection Method
4 Device Configuration
5 Integration Parameters

About The Device

Protect and monitor the SaaS environment for your businesses. The SaaS Security Management platform that lets you Scan, Secure, and Monitor your SaaS applications like Box, Dropbox, Salesforce, etc.

Device Information

Entity	Particulars

Entity	Particulars
Vendor Name	AppOmni
Product Name	AppOmni
Type of Device	Cloud

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method	Data Source

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method	Data Source
AppOmni	APPOMNI	Webhook - JSON	C2C - Push	N/A

Device Configuration

AppOmni Integration with Webhook (Recommended)

Log into your AppOmni console
Navigate to Threat detection > Destinations
Click Add Destination

search for Webhook and click on that.

Click Continue.

Fill below details and rest everything should have default value.

a. Name - Provide the name

b. Description(Optional) - Provide description

c. URL Endpoint - Contact with On-boarding engineer for this URL and API Key. You need to append URL with API key. Eg: - https://us-chronicle.googleapis.com/v1alpha/projects/12345/locations/us/instances/123-abc/feeds/abc123-123:importPushLogs?key={API Key}

d. HTTP Method - Select Post

e. Delivery Format - Select JSON Lines

f. Token Header - Mention “X-Webhook-Access-Key”

g. Token - Contact with On-boarding engineer for Token(Secret Key)

Click Save.
Once the destination is created, check if it is enabled. If it is not enabled, enable it.

AppOmni Integration with AWS S3 (Alternative)

Create S3 Bucket

Go to https://s3.console.aws.amazon.com/
Click Create Bucket
Provide a name for the S3 bucket
Select a Region
Click Create Bucket

Create an IAM User

Create an IAM user with upload access to the bucket. Please reference the AWS documentation, Controlling access to a bucket with user policies, for instructions on performing this step.

Follow below document for IAM user permission:
Accenture MDR Quick Start Guide in Configuring IAM User and KMS Key Policies

Retrieve access key and access key ID

Login to AWS console with the user created in above step.
In the AWS console, select your account name and, in the drop-down menu, select Security credentials

In the Access keys panel, select Create access key. After creation, copy the keys from the Access key and Secret access key fields.

Configure destination as AWS S3 in AppOmni console

Log into your AppOmni console
Navigate to Threat detection > Destinations
Click on Add Destination

Search for Amazon Web Services and click on that

5.Click Continue

Fill below details and rest everything should be default.

a. Name - Mention the name

b. Description (Optional)- Mention the description

c. AWS region name - Provide the AWS S3 bucket region

d. AWS access key - Provide the Secret Access key which we have created in previous steps

e. AWS access key ID - Provide the Access Key which we have created in previous steps

f. AWS bucket name - Provide the S3 bucket name where you want to store the logs

g. Delivery Format - Select JSON lines

Click Save

Once the destination has created, check if it is enabled or not. If it is not enabled than enable it.
Review the JSON files in the S3 bucket.

Create SQS and attach with S3:

Refer this document: Configuring AWS Simple Queue Service (SQS) with S3 Storage

Follow below page for IAM user policies which are required for SQS & S3:

IAM User and KMS Key Policies Required for AWS

If SQS is encrypted, please add below policy in KMS. This policy is required to make s3 events notify SQS:

KMS Policy:
***********
{
  "Sid": "example-statement-ID",
  "Effect": "Allow",
  "Principal": {
    "Service": "s3.amazonaws.com"
  },
  "Action": [
    "kms:GenerateDataKey",
  ],
  "Resource": "*"
}

Integration Parameters

Integration via Webhook

Configure Webhook on Google Chronicle instance and copy a Endpoint URL & Secret key.

Integration via AWS SQS

Property	Default Value	Description

Property	Default Value	Description
REGION	Custom Value	Select the region of your S3 bucket
QUEUE NAME	Custom Value	The SQS queue name.
ACCOUNT NUMBER	Custom Value	The account number for the SQS queue and S3 bucket.
QUEUE ACCESS KEY ID	Custom Value	This is the 20 character ID associated with your Amazon IAM account.
QUEUE SECRET ACCESS KEY	Custom Value	This is the 40 character access key associated with your Amazon IAM account.
SOURCE DELETION OPTION	Custom Value	Whether to delete source files after they have been transferred to Chronicle. This reduces storage costs. Valid values are: `SOURCE_DELETION_NEVER`: Never delete files from the source. `SOURCE_DELETION_ON_SUCCESS`:Delete files and empty directories from the source after successful ingestion. `SOURCE_DELETION_ON_SUCCESS_FILES_ONLY`:Delete files from the source after successful ingestion.
S3 BUCKET ACCESS KEY ID	N/A	This is the 20 character ID associated with your Amazon IAM account. Only specify if using a different access key for the S3 bucket.
S3 BUCKET SECRET ACCESS KEY	N/A	This is the 40 character access key associated with your Amazon IAM account. Only specify if using a different access key for the S3 bucket.
ASSET NAMESPACE	N/A	To assign an asset namespace to all events that are ingested from a particular feed, set the `"namespace"` field within `details`. The `namespace` field is a string.