Amazon Data Firehose to Chronicle: C2C-Push

1 Create Amazon Data Firehose
2 Update IAM role attached to Firehose Stream
3 Create Amazon EventBridge Rule

This page will help you push events of AWS services to Google Chronicle using Amazon Data Firehose.

Please follow below steps to configure Amazon Data Firehose:

Create Amazon Data Firehose

Go to Amazon Kinesis
Navigate to Amazon Data Firehose
Click Create Firehose Stream

Provide the Source as Direct PUT
Select Destination as HTTP Endpoint
Provide Firehose stream name
In Destination settings enter the URL provided by onboarding engineer. Please note that we need to append access key at the end of the URL before entering.

URL format would be: <URL_shared_by_onboarding_eng>?key=<access_key>

In Authentication, keep use access key
Provide the secret in Access key

Select Content encoding as GZIP
Provide Retry duration as per your organization policy
In Backup settings, provide what data you want to back up as per organization policy. Select S3 bucket and provide prefix (optional).
In Advanced settings, enable server-side encryption.
In Amazon CloudWatch error logging, choose Enabled if you want Amazon Data Firehose to log record delivery errors to CloudWatch Logs.
In Service access, select Create or update IAM role if role is not available already. If continuing with the existing role, select Choose existing IAM role.
Add tags as per organization policy.
Create Firehose Stream.

Update IAM role attached to Firehose Stream

Once the stream is created, open the stream and navigate to configuration.

In configuration > Service access, click service role, it will open in a new window.

Ensure that along with the existing policy, below is also included

{
            "Effect": "Allow",
            "Action": [
                "firehose:PutRecord",
                "firehose:PutRecordBatch"
            ],
            "Resource": "arn:aws:firehose:<REGION>:<ACCOUNT_NUMBER>:deliverystream/<STREAM_NAME>"
        }

Create Amazon EventBridge Rule

Go to Amazon EventBridge
Click Create Rule
Provide Rule Name and Description
Select Rule type as Rule with an event pattern
Click Next

In Event source, select AWS events or EventBridge partner events.

In Event pattern, select appropriate AWS Service and Event Type. For example, here we are selecting AWS Security Hub.

Click Next.
In Select a Target, choose Firehose Stream.
In Stream, choose previously created stream.
Select Create a new role.

Click Next
Provide tags as per organization policy
Review and create rule

After these configuration AWS service that we select as event source in eventbridge rule will start forwarding logs to HTTP endpoint we configure in Firehose Stream.