AWS CloudFront

1 About The Device
2 Device Information
3 Collection Method
4 Device Configuration
5 Integration Parameters

About The Device

Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files to users. Amazon CloudFront delivers your content through a worldwide network of data centers called edge locations. When a user requests content that you're serving with Amazon CloudFront, the user is routed to the edge location that provides the lowest latency (time delay), so that content is delivered with the best possible performance.

Device Information

Entity	Particulars

Entity	Particulars
Vendor Name	Amazon Web Services
Product Name	CloudFront
Type of Device	Cloud

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method	Data Source

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method	Data Source
AWS CloudFront	AWS_CLOUDFRONT	Cloud Storage - Structured	C2C	https://cloud.google.com/chronicle/docs/reference/feed-management-api#amazon_s3

Device Configuration

Adaptive MxDR supports log collection using S3 or SQS.

S3:

Prerequisite:

S3 bucket is created. Please refer the following link to create a S3 bucket. https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html

Device Configuration:

Log in to AWS Console.
Navigate to the CloudFront service
Click Create a CloudFront distribution
While creating CloudFront distribution, there is an option to enable logging. If you want CloudFront to log information about each request for an object and store the log files in an Amazon S3 bucket, select On, and specify the bucket and an optional prefix for the names of the log files.

Don't choose an Amazon S3 bucket with S3 Object Ownership set to bucket owner enforced. That setting disables ACLs for the bucket and the objects in it, which prevents CloudFront from delivering log files to the bucket.

For more details on S3 and key policy for SSE-KMS buckets please refer: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html

SQS:

Follow all the steps provided above to enable logging to S3.
Create SQS and attach it with S3. Please refer:

Please refer below page to check required IAM user and KMS Key policies for S3, SQS and KMS

For more details on how to get required credentials for integration parameters please refer:

Below are the URL details which we need to allow for connectivity (Please identify URLs by referring AWS document according to your services and regions):

IAM: For any logging source IAM URL should be allowed

S3: For S3 or SQS logging source, S3 URL should be allowed.

SQS: For SQS logging source, SQS URL should be allowed.

Integration Parameters

S3

Property	Default Value	Description

Property	Default Value	Description
REGION	N/A	Select the region of your S3 bucket
S3 URI	N/A	The S3 URI to ingest. (It will be a combination of S3 bucket name and prefix. Eg- S3://<S3 bucket name>/<prefix>)
URI IS A	N/A	The type of file indicated by the URI. Valid values are: `FILES`: The URI points to a single file which will be ingested with each execution of the feed. `FOLDERS`: The URI points to a directory. All files contained within the directory will be ingested with each execution of the feed. `FOLDERS_RECURSIVE`: The URI points to a directory. All files and directories contained within the indicated directory will be ingested, including all files and directories within those directories, and so on.
SOURCE DELETION OPTION	N/A	Whether to delete source files after they have been transferred to Chronicle. This reduces storage costs. Valid values are: `SOURCE_DELETION_NEVER`: Never delete files from the source. `SOURCE_DELETION_ON_SUCCESS`:Delete files and empty directories from the source after successful ingestion. `SOURCE_DELETION_ON_SUCCESS_FILES_ONLY`:Delete files from the source after successful ingestion.
ACCESS KEY ID	N/A	This is the 20 character ID associated with your Amazon IAM account.
SECRET ACCESS KEY	N/A	This is the 40 character access key associated with your Amazon IAM account.

SQS

Property	Default value	Description

Property	Default value	Description
REGION	N/A	Select the region of your S3 bucket
QUEUE NAME	N/A	The SQS queue name.
ACCOUNT NUMBER	N/A	The account number for the SQS queue and S3 bucket.
QUEUE ACCESS KEY ID	N/A	The 20 character ID associated with your Amazon IAM account.
QUEUE SECRET ACCESS KEY	N/A	The 40 character access key associated with your Amazon IAM account.
SOURCE DELETION OPTION	N/A	Whether to delete source files after they have been transferred to Chronicle. This reduces storage costs. Valid values are: `SOURCE_DELETION_NEVER`: Never delete files from the source. `SOURCE_DELETION_ON_SUCCESS`:Delete files and empty directories from the source after successful ingestion. `SOURCE_DELETION_ON_SUCCESS_FILES_ONLY`:Delete files from the source after successful ingestion.
S3 BUCKET ACCESS KEY ID	No	This is the 20 character ID associated with your Amazon IAM account. Only specify if using a different access key for the S3 bucket.
S3 BUCKET SECRET ACCESS KEY	No	This is the 40 character access key associated with your Amazon IAM account. Only specify if using a different access key for the S3 bucket.
ASSET NAMESPACE	No	To assign an asset namespace to all events that are ingested from a particular feed, set the `"namespace"` field within `details`. The `namespace` field is a string.