AWS CloudTrail

1 About the Device
2 Device Information
3 Collection Method
4 Device Configuration
5 Integration Parameters

About the Device

AWS CloudTrail helps you enable operational and risk auditing, governance, and compliance of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Events include actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs.

Device Information

Entity	Particulars

Entity	Particulars
Vendor Name	Amazon Web Services
Product Name	CloudTrail
Type of Device	Cloud

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method	Data Source

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method	Data Source
AWS Cloudtrail	AWS_CLOUDTRAIL	API Pull	C2C - Storage	https://cloud.google.com/chronicle/docs/reference/feed-management-api#amazon_s3

Device Configuration

Adaptive MxDR supports log collection either using S3 or SQS.

Prerequisite

S3 bucket should be created. Please refer the following page to create a S3 bucket. https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html

To configure your AWS CloudTrail account to store the CloudTrail log files from single account into a single S3 bucket or from multiple accounts into a single or multiple S3 bucket(s), perform the following steps:

Sign in to the AWS Console using the account where the CloudTrail log files will be stored.
In homepage, in Services tab, select the CloudTrail service.

Load the Region where you want to enable CloudTrail. Navigate to Trails and click Create Trail

Provide the Trail name. In storage location, choose the destination bucket. If you want to provide prefix for cloudtrail logs, provide it in Log file prefix. Log location will be /AWSLogs/Account-ID/CloudTrail/region

Click Create trail.

If you face problem (snapshot below) with bucket policy, refer the link below to fix policy with cloudtrail. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-s3-bucket-policy-for-cloudtrail.html

Configuring using SQS

Follow all the steps provided above to store logs in S3 bucket
Create SQS and attach it with S3. Please refer Configuring AWS Simple Queue Service (SQS) with S3 Storage

Please refer below page to check required IAM user policies.

IAM User and KMS Key Policies Required for AWS

For more details on how to get required credentials for integration parameters please refer:

Get Credentials for AWS Storage

Below are the URL details which we need to allow for connectivity (Please identify URLs by referring AWS document according to your services and regions)

IAM: For any logging source IAM URL should be allowed

S3: For S3 or SQS logging source, S3 URL should be allowed.

SQS: For SQS logging source, SQS URL should be allowed.

Integration Parameters

S3

Property	Default Value	Description

Property	Default Value	Description
REGION	N/A	Select the region of your S3 bucket
S3 URI	N/A	The S3 URI to ingest. (It will be a combination of S3 bucket name and prefix. Example: S3://<S3 bucket name>/<prefix>)
URI IS A	N/A	The type of file indicated by the URI. Valid values are: `FILES`: The URI points to a single file which will be ingested with each execution of the feed. `FOLDERS`: The URI points to a directory. All files contained within the directory will be ingested with each execution of the feed. `FOLDERS_RECURSIVE`: The URI points to a directory. All files and directories contained within the indicated directory will be ingested, including all files and directories within those directories, and so on.
SOURCE DELETION OPTION	N/A	Whether to delete source files after they have been transferred to Chronicle. This reduces storage costs. Valid values are: `SOURCE_DELETION_NEVER`: Never delete files from the source. `SOURCE_DELETION_ON_SUCCESS`:Delete files and empty directories from the source after successful ingestion. `SOURCE_DELETION_ON_SUCCESS_FILES_ONLY`:Delete files from the source after successful ingestion.
ACCESS KEY ID	N/A	This is the 20 character ID associated with your Amazon IAM account.
SECRET ACCESS KEY	N/A	This is the 40 character access key associated with your Amazon IAM account.

SQS

Property	Default value	Description

Property	Default value	Description
REGION	N/A	Select the region of your S3 bucket
QUEUE NAME	N/A	The SQS queue name.
ACCOUNT NUMBER	N/A	The account number for the SQS queue and S3 bucket.
QUEUE ACCESS KEY ID	N/A	This is the 20 character ID associated with your Amazon IAM account.
QUEUE SECRET ACCESS KEY	N/A	This is the 40 character access key associated with your Amazon IAM account.
SOURCE DELETION OPTION	N/A	Whether to delete source files after they have been transferred to Chronicle. This reduces storage costs. Valid values are: `SOURCE_DELETION_NEVER`: Never delete files from the source. `SOURCE_DELETION_ON_SUCCESS`:Delete files and empty directories from the source after successful ingestion. `SOURCE_DELETION_ON_SUCCESS_FILES_ONLY`:Delete files from the source after successful ingestion.