AWS VPC Flow

1 About the Device
2 Device Information
3 Collection Method
4 Device Configuration
5 Integration parameters

About the Device

A virtual private cloud (VPC) is a virtual network dedicated to your AWS account. You can launch your AWS resources, such as Amazon EC2 instances, into your VPC. Amazon VPC provides features like Security groups, Network access control lists (ACLs) and Flow logs. "VPC Flow Logs" is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC.

Device Information

Entity	Particulars

Entity	Particulars
Vendor Name	Amazon Web Services
Product Name	VPC Flow
Type of Device	Cloud

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method	Data Source

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method	Data Source
AWS VPC Flow	AWS_VPC_FLOW	API Pull	C2C - Storage	https://cloud.google.com/chronicle/docs/reference/feed-management-api#amazon_s3

Device Configuration

Prerequisite:

S3 bucket is created. Please refer the following page to create a S3 bucket. https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html

Creation of flow logs for network interface, subnets and VPCs

After you have created and configured your Amazon S3 bucket, you can create flow logs for your network interfaces, subnets, and VPCs.

To create a flow log for a network interface :
1. Open the Amazon EC2 console
2. In the navigation pane, choose Network Interfaces
3. Select one or more network interfaces
4. Choose Actions, Create flow log
5. Configure the flow log settings [Please see, Step 4]
To create a flow log for a subnet :
1. Open the Amazon VPC console
2. In the navigation pane, choose Subnets.
3. Select one or more subnets.
4. Choose Actions, Create flow log.
5. Configure the flow log settings [Please see, Step 4]
To create a flow log for a VPC:
1. Open the Amazon VPC console
2. In the navigation pane, choose your VPCs.
3. Select one or more VPCs.
4. Choose Actions, Create flow log.
5. Configure the flow log settings [Please see, Step 4]
To configure flow log settings:
1. Select All in Filter

b. Select 1 minute for Maximum aggregation interval

c. Select Send to an Amazon S3 bucket in Destination

d. Provide S3 bucket ARN [Please see, prerequisites]

e. Select AWS default format

If you want to use Custom format, you can also use that, but the format should be in below mentioned sequential order. Both log formats are supported by Adaptive MxDR.

f. Select Text (default) in Log file format

g. Don’t enable Hive-compatible S3 prefixes

h. Select Every 1 hour (60 mins) in partition logs by time.

i. To add a tag to the flow log [optional config] - if you want to add a tag, select Add new tag and specify the tag key and value.

j. Click Create Flow Log

Create SQS and attach with S3

Please refer Configuring AWS Simple Queue Service (SQS) with S3 Storage

Integration Parameter details: Please refer below page to get credentials for Chronicle feed.
Get Credentials for AWS Storage

IAM user policies: Please refer below page to check required IAM user policies:

IAM User and KMS Key Policies Required for AWS

Integration parameters

Property	Default Value	Description

Property	Default Value	Description
REGION	N/A	Select the region of your S3 bucket
S3 URI	N/A	The S3 URI to ingest. (It will be a combination of S3 bucket name and prefix. Example: S3://<S3 bucket name>/<prefix>)
URI IS A	N/A	The type of file indicated by the URI. Valid values are: `FILES`: The URI points to a single file which will be ingested with each execution of the feed. `FOLDERS`: The URI points to a directory. All files contained within the directory will be ingested with each execution of the feed. `FOLDERS_RECURSIVE`: The URI points to a directory. All files and directories contained within the indicated directory will be ingested, including all files and directories within those directories, and so on.
SOURCE DELETION OPTION	N/A	Whether to delete source files after they have been transferred to Chronicle. This reduces storage costs. Valid values are: `SOURCE_DELETION_NEVER`: Never delete files from the source. `SOURCE_DELETION_ON_SUCCESS`:Delete files and empty directories from the source after successful ingestion. `SOURCE_DELETION_ON_SUCCESS_FILES_ONLY`:Delete files from the source after successful ingestion.
ACCESS KEY ID	N/A	This is the 20 character ID associated with your Amazon IAM account.
SECRET ACCESS KEY	N/A	This is the 40 character access key associated with your Amazon IAM account.

SQS:

Property	Default value	Description

Property	Default value	Description
REGION	N/A	Select the region of your S3 bucket
QUEUE NAME	N/A	The SQS queue name.
ACCOUNT NUMBER	N/A	The account number for the SQS queue and S3 bucket.
QUEUE ACCESS KEY ID	N/A	This is the 20 character ID associated with your Amazon IAM account.
QUEUE SECRET ACCESS KEY	N/A	This is the 40 character access key associated with your Amazon IAM account.
SOURCE DELETION OPTION	N/A	Whether to delete source files after they have been transferred to Chronicle. This reduces storage costs. Valid values are: `SOURCE_DELETION_NEVER`: Never delete files from the source. `SOURCE_DELETION_ON_SUCCESS`:Delete files and empty directories from the source after successful ingestion. `SOURCE_DELETION_ON_SUCCESS_FILES_ONLY`:Delete files from the source after successful ingestion.