AWS Windows Event

1 About the Device
2 Device Information
3 Collection Method
4 Device Configuration
5 Integration Parameters

About the Device

Windows Server provides a stable and secure platform for managing network infrastructure, data storage, and application deployment. Key features include Active Directory for centralized user management, Group Policy for configuration consistency, and Hyper-V for virtualization. It supports a variety of server roles such as file server, web server, and domain controller, allowing organizations to tailor their server environment to meet specific requirements. With features like Remote Desktop Services, Windows Server facilitates remote access and administration. Additionally, it incorporates advanced security measures, such as Windows Defender and BitLocker, to safeguard data and systems. As a versatile and scalable solution, Windows Server plays a crucial role in powering the infrastructure of diverse businesses and enterprises.

Device Information

Entity	Particulars

Entity	Particulars
Vendor Name	Amazon Web Services
Product Name	Windows
Type of Device	Cloud

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method	Data Source

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method	Data Source
Windows Event	WINEVTLOG	XML	C2C - Storage	https://cloud.google.com/chronicle/docs/reference/feed-management-api#amazon_sqs

Device Configuration

Pre-requisites

S3 Bucket - https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html
An AWS account that you can sign in to.
A user who's a Global Administrator or AWS EC2, System Manager, CloudWatch, IAM Administrator.

Below steps are specifically for EC2 Instance based Windows Deployments.

To Configure Unified CloudWatch Agent to fetch logs from the EC2 Windows instances

Setup IAM instance profile roles for Systems Manager.
1. Create IAM Role.

b. Attach all the policies displayed in below image and save the Role.

c. Attach the Role created to Windows EC2 server.

To install Cloud Watch Agent on Windows server,

a. Navigate to AWS Systems Manager > Run Command

b. Select AWS-ConfigureAWSPackage

c. In Command Parameter, in Name, enter AmazonCloudWatchAgent.

d. Select target Windows machine(s) where you want to install AWS CloudWatch Agent.

e. Scroll down and click on Run.

f. Once the command gets executed. Select the instance id and view the output. There should not be any error in output.

Creating Configurations file and saving it to AWS Systems Parameter Store.

a. Login to the Instance which has been selected as the target for CloudWatchAgent installation in the previous step and verify the installation of the Agent in C:\Program Files\Amazon\AmazonCloudWatchAgent.

b. Open command prompt run amazon-cloudwatch-agent-config-wizard.exe file and provide parameters as shown in below screenshots.

c. Provide the response to every query asked on the config_wizard as shown in below screenshots.

In the below snapshots, the windows log name should be selected as Security, System and Application one after another to enable logging from all relevant Windows Channels. To accomplish this, you will need to perform the same steps from config_wizard to configure logging from these Channels. We have included all possible screenshots with all possible selections.

Once done, the Systems Manager Parameter store can be checked for the newly created configuration file with the parameters provided as an input.

a. Navigate to AWS Systems Manager > Parameter Store

b. Copy the newly created Parameter Store name.

Start the Agent while pointing to the configuration file using AWS Systems Manager.

a. In order to start the newly configured Cloud Watch Agents on the instances, we need to use Run Command.

b. Navigate to AWS Systems Manager > Run Command

c. Navigate to next Page and search for the specific Command using the search box.

d. Search for "AmazonCloudWatch-ManageAgent".

e. Specify the name of newly created Parameter Store Configuration file.

f. Select target (EC2 Windows Machine) where you want run the command and click Run.

g. For Other Parameters, use default Values (i.e., timeout time is 600 Seconds by default).

h. Retain default values for Rate Control.

i. Since we're not currently sending any events to the S3 bucket, please leave it unchecked.

j. SNS notifications are not currently enabled. Once they are enabled, you can configure them with the SNS details. For now, please keep it unchecked.

k. The AWS Command Line Interface command has not been modified and is using the default value.

l. After completing above configurations, click RUN > Systems manager will start the CloudWatch Agent on the instance and the log Flow will start.

Navigate to CloudWatch > Logs to see the logs getting collected. The newly created Log Groups will automatically be created once the logs are getting shipped through the instance by the agents.

Configure continuous export of CloudWatch Logs to S3 bucket

Once you are done creating CloudWatch Log Groups, kindly follow below guide to automate continuous export of logs from CloudWatch Log group to S3 bucket using lambda.

AWSMSWIN: Cloudwatch Log Group to S3 Bucket Export Automation using Lambda

Configure SQS

Once you followed the above guide and the continuous export of logs are available in the S3 bucket then we need to create SQS and attach it with S3. Kindly follow the below guide.

Important Links:

For more details on how to get required credentials for integration parameters please refer:
Please refer below page to check required IAM user and KMS Key policies for S3, SQS and KMS:
Below are the URL details which we need to allow for connectivity (Please identify URLs by referring AWS document according to your services and regions):
- IAM: For any logging source IAM URL should be allowed :
- S3: For S3 or SQS logging source, S3 URL should be allowed:
- SQS: For SQS logging source, SQS URL should be allowed:

Integration Parameters

SQS

Parameter	Default Value	Description

Parameter	Default Value	Description
REGION	N/A	Select the region of your S3 bucket
QUEUE NAME	N/A	The SQS queue name.
ACCOUNT NUMBER	N/A	The account number for the SQS queue and S3 bucket.
QUEUE ACCESS KEY ID	N/A	This is the 20 character ID associated with your Amazon IAM account.
QUEUE SECRET ACCESS KEY	N/A	This is the 40 character access key associated with your Amazon IAM account.
SOURCE DELETION OPTION	N/A	Whether to delete source files after they have been transferred to Chronicle. This reduces storage costs. Valid values are: `SOURCE_DELETION_NEVER`: Never delete files from the source. `SOURCE_DELETION_ON_SUCCESS`:Delete files and empty directories from the source after successful ingestion. `SOURCE_DELETION_ON_SUCCESS_FILES_ONLY`:Delete files from the source after successful ingestion.
S3 BUCKET ACCESS KEY ID	No	This is the 20 character ID associated with your Amazon IAM account. Only specify if using a different access key for the S3 bucket.
S3 BUCKET SECRET ACCESS KEY	No	This is the 40 character access key associated with your Amazon IAM account. Only specify if using a different access key for the S3 bucket.
ASSET NAMESPACE	No	To assign an asset namespace to all events that are ingested from a particular feed, set the `"namespace"` field within `details`. The `namespace` field is a string.