Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 3 Next »

About The Device

Protect and monitor the SaaS environment for your businesses. The SaaS Security Management platform that lets you Scan, Secure, and Monitor your SaaS applications like Box, Dropbox, Salesforce, etc. 

Device Information

 Entity

Particulars

Vendor Name

AppOmni

Product Name

AppOmni

Type of Device

Cloud

Collection Method

 Log Type

Ingestion label

Preferred Logging Protocol

Log Collection Method

Data Source

 APPOMNI

 JSON

 C2C

https://cloud.google.com/chronicle/docs/reference/feed-management-api#cortex-xdr

Device Configuration

1 - AWS S3 Configuration

Creation of S3 bucket

  1. Navigate to https://s3.console.aws.amazon.com/

  2. Click Create Bucket

  3. Provide a name for the S3 bucket

  4. Select a Region

  5. Click Create Bucket

image-20240226-052110 (1).png

Setup API Gateway Role

  1. Navigate to https://console.aws.amazon.com/iam

  2. Click Roles

  3. Click Create role

  4. Select S3 as your use case

  5. Click Next: Permissions

image-20240226-052303.png

  1. Select AmazonS3FullAccess

  2. Click Next: Tags

  3. Click Next: Review

  4. Provide a Role Name

  5. Click Create Role

image-20240226-052430.png

  1. Click or Open the role you created in the previous step

  2. Click Trust relationships tab

  3. Click Edit trust relationship

  4. Paste the following into the policy document

{
 
"Version": "2012-10-17",
 
"Statement": [
 
{
 
"Effect": "Allow",
 
"Principal": {
 
"Service": "apigateway.amazonaws.com"
 
},
 
"Action": "sts:AssumeRole"
 
}
 
]
 
}
image-20240226-052634.png

  1. Click Save or Update Trust Policy

  2. Copy the Role ARN for this role, you’ll need it later

Create API GW

  1. Navigate to API Management - Amazon API Gateway - AWS

  2. Click Create API

  3. Click the Build button in the Rest API section

  4. Select New API

  5. Provide an API name and Description

  6. Click Create API

image-20240226-054220.png

  1. Click Actions dropdown

  2. Select Create Method

  3. Select PUT, and click the check box to save

  4. Select AWS Service

  5. Set AWS Region to the region where the S3 bucket was created

  6. Set AWS Service to Simple Storage Service (S3)

  7. Leave AWS Subdomain empty

  8. HTTP method PUT

  9. Set Action Type to Use path override

  10. Set Path override (optional) to the following:

<name_of_your_s3_bucket>/{key}

  1. Set Execution Role to the ARN of the role created in Step #2

  2. Click Save

image-20240226-054513.png

  1. Click Integration Request

  2. Expand Mapping Templates

  3. Select When there are no templates defined (recommended)

  4. Click Add Mapping template

  5. Set it to application/json, and click the save

  6. Insert the below into the Template 

#set($context.requestOverride.path.key = $context.requestId)
$input.body

  1. Click Save

image-20240226-054648.png

  1. Scroll to the top

  2. Click the <- Method Execution

  3. Select your PUT method

  4. Click on Actions drop down

  5. Click Deploy API

  6. Set Deployment stage to [New Stage]

  7. Set Stage Name to the name of your S3 bucket

  8. Set Stage Description to the name of your S3 bucket

  9. Click Deploy

image-20240226-054812.png

  1. Click Usage Plans on the left side

  2. Click Create

  3. Provide Name

  4. Disable Enable throttling

  5. Disable Enable quota

  6. Click Next

image-20240226-054910.png

  1. Click Add API Stage

  2. In the API dropdown list select the API you created above

  3. In the Stage dropdown list select the Stage you created above

  4. Click Save

  5. Click Next

  6. Click Done

image-20240226-055009.png

  1. Click API Keys

  2. Click Create API Key and add to Usage Plan

  3. Provide an API Key Name

  4. Select Auto Generate

  5. Click Save

image-20240226-055101 (1).png

  1. Click Key to open the key

  2. Click the Show option and copy the key (you’ll need it later)

  3. Navigate back to the API PUT method

  4. Click the Method Request

  5. Set API Key Required to True

image-20240226-055206.png

  1. Expand the HTTP Request Headers.

  2. Insert x-api-key, select Required and click Save

image-20240226-055247.png

  1. Select your PUT method

  2. Select Actions - Deploy API dropdown

  3. Select the Deployment Stage you created earlier

  4. Click Deploy

image-20240226-055334.png

  1. Click Stages on the left and select the Stage you configured above.

  2. Copy the Invoke URL, which you’ll need later

image-20240226-055412.png

  1. Navigate back to the API PUT method

  2. Click Test

  3. Insert x-api-key:<insert API key from previous steps>

  4. Click Test

  5. Verify that you get Status 200 response (test succeeded)

image-20240226-055459.png

2. Configure S3 Bucket in AppOmni - Alerts Dashboard

  1. Log into your AppOmni console

  2. Navigate to Monitor - Alert Dashboard

image-20240226-055651.png

  1. Click the + sign to add a new AppOmni Data Sink.

image-20240226-055729.png

  1. Provide a name for the Data Sink

  2. Select Event Format as Condensed ECS

  3. Set Max Event Size in Bytes to 0 (zero)

  4. Data Sink = HTTP

  5. Insert the Invoke URL from Create API GW step above in the Endpoint section

  6. Set the Token Header to x-api-key

  7. Insert the API key from Create API GW step above in the Token Section

  8. Method = PUT

  9. Delivery Format = JSON Array

image-20240226-055829.png

  1. Click Test Data Sink Configuration to ensure all parameters are correct.

  2. Click Create New Data Sink to save the Data Sink settings

image-20240226-055915.png

  1. Review the JSON files in the S3 bucket, they contain the normalized AppOmni SaaS audit logs and detection alerts.

image-20240226-055943.png

3. Configure S3 Bucket in AppOmni - Workflows

  1. Log into your AppOmni console

  2. Navigate to Monitor - Workflows

  3. Click the Add Workflow +

  4. Provide a Workflow Name

  5. Select the Environment Tags to include in the Workflow

  6. Click Webhook Notifications for New/Reopened Events on Policy Scans (PUT)

  7. Insert the Invoke URL from Create API GW step above in the Endpoint section

image-20240226-060050.png

  1. Click Next

  2. Set HeaderName to x-api-key

  3. Insert the API key from Create API GW step above in the HeaderValue Section

  4. Click Finish

image-20240226-060130.png

  1. Click Add Workflow

image-20240226-060214.png

4. Configure AppOmni policies to leverage the S3 bucket workflow

  1. Open your AppOmni policy

  2. Click Manage

  3. Select the configured S3 Bucket in the workflow section

  4. Click Add to Policy

image-20240226-060836.pngimage-20240226-060916.png

  1. AppOmni findings for this policy will now be send to the configured S3 bucket

  2. The JSON files in the S3 bucket contain the AppOmni findings from the policy/policies configured to send findings to the S3 bucket.

image-20240226-060950.png

5. Create SQS

For Internal Reference: Configuring Amazon Simple Queue Service (SQS) with S3 Storage

6. Attaching Created SQS with S3

  1. Navigate to S3 Dashboard and select the S3 Bucket created in Section 1 above which needs to be monitored for Notifications.

image-20240226-061247 (1).png

  1. Navigate to Properties Tab

image-20240226-061314 (1).png

  1. Under event notification. Click Create event notification

image-20240226-061346.png

  1. Provide a desired name to the notification and select the Event which has to be notified.

image-20240226-061412 (1).png

Select All Objects create events as we need to be notified for every new entry in the Bucket.

  1. Add Prefix 

Prefix is necessary in such cases if any single object has to be monitored. The prefix is the name of the directory created in the bucket. In case every directory in the Bucket has to be monitored for notifications, leave the prefix blank.

  1. Select SQS queue as destination and Select Choose from your SQS queue.

image-20240226-061529.png

  1. Select the SQS queue from the dropdown which you have created earlier

  2. Click Save

Follow below page for IAM user policies which are required for SQS & S3:

IAM User and KMS Key Policies Required for AWS

If SQS is encrypted, please add below policy in KMS. This policy is required to make s3 events notify SQS:

KMS Policy:
***********
{
  "Sid": "example-statement-ID",
  "Effect": "Allow",
  "Principal": {
    "Service": "s3.amazonaws.com"
  },
  "Action": [
    "kms:GenerateDataKey",
     
  ],
  "Resource": "*"
}

Integration Parameters

Parameters required from customer for Integration.

Property

Default Value

Description

REGION

Custom Value

The region where the S3 bucket resides. For a list of regions, see Amazon S3 regions.

S3 URI

Custom Value

The S3 URI to ingest.

ACCESS KEY ID

Custom Value

The value obtained from above configuration.

SECRET ACCESS KEY

Custom Value

The value obtained from above configuration.

  • No labels

About Accenture:
Accenture is a leading global professional services company that helps the world’s leading businesses, governments and other organizations build their digital core, optimize their operations, accelerate revenue growth and enhance citizen services—creating tangible value at speed and scale. We are a talent and innovation led company with 738,000 people serving clients in more than 120 countries. Technology is at the core of change today, and we are one of the world’s leaders in helping drive that change, with strong ecosystem relationships. We combine our strength in technology with unmatched industry experience, functional expertise and global delivery capability. We are uniquely able to deliver tangible outcomes because of our broad range of services, solutions and assets across Strategy & Consulting, Technology, Operations, Industry X and Accenture Song. These capabilities, together with our culture of shared success and commitment to creating 360° value, enable us to help our clients succeed and build trusted, lasting relationships. We measure our success by the 360° value we create for our clients, each other, our shareholders, partners and communities. Visit us at www.accenture.com.

About Accenture Security
Accenture Security is a leading provider of end-to-end cybersecurity services, including advanced cyber defense, applied cybersecurity solutions and managed security operations. We bring security innovation, coupled with global scale and a worldwide delivery capability through our network of Advanced Technology and Intelligent Operations centers. Helped by our team of highly skilled professionals, we enable clients to innovate safely, build cyber resilience and grow with confidence. Follow us @AccentureSecure on Twitter or visit us at www.accenture.com/security.

Legal notice: Accenture, the Accenture logo, and other trademarks, service marks, and designs are registered or unregistered trademarks of Accenture and its subsidiaries in the United States and in foreign countries. All trademarks are properties of their respective owners. This document is intended for general informational purposes only and does not take into account the reader’s specific circumstances, and may not reflect the most current developments. Accenture disclaims, to the fullest extent permitted by applicable law, any and all liability for the accuracy and completeness of the information in this presentation and for any acts or omissions made based on such information. Accenture does not provide legal, regulatory, audit, or tax advice. Readers are responsible for obtaining such advice from their own legal counsel or other licensed professionals.