Accenture MDR Quick Start Guide for Amazon Web Services (AWS) Web Application Firewall (WAF)

This quick start guide will help Accenture MDR customers configure AWS WAF to send logs to the Log collection Platform (LCP).

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication. 

Configuring AWS WAF

MxDR supports log collection using S3 via SQS.

Prerequisite:

• S3 bucket is created. Please refer the following page to create a S3 bucket.  https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html

Device Configuration Steps:

 1. Enable Logging for WEB ACL to S3 Bucket.

• Log in to the AWS Console.

• Navigate to AWS WAF and select Web ACL from side pane.

• Select the Web ACL's from the list and click Enable Logging button.

 Note : Admin access required for perform the Logging changes

Open

• If Kinesis Firehose stream is already created then select the Amazon Kinesis Firehose stream which is configured as the desired S3 Bucket for log storage. 

• If it is not created, follow steps from Creating Amazon Kinesis Firehose

Open

• In order to send the logs to S3 Bucket, we need to create an Amazon Kinesis Data Firehose. 

2. Creating Amazon Kinesis Firehose

• Navigate to Kinesis Dashboard and click on Create Delivery stream.

• Provide the New delivery stream name

• Select Direct PUT or other Sources from Source.

• Click Next.

• Keep Record Transformation and Record format conversion as Disabled and click Next.

• Select Destination as Amazon S3.

• Select the S3 Destination bucket name from drop-down.

Note: Leave the S3 Prefix and Error Prefix configuration textbox as unchanged.

• Use the default preset for Buffer Condition Settings.

• Set S3 Compression and S3 Encryption as Disabled

• Select Enabled for Error logging.

• Add the IAM role inorder to enable the Firehose to Stream logs to S3.

a. Click Create new or choose.​

d. Keep the Policy name to Create a new Role policy and click Allow.

Note: It will automatically create a Policy and enable it. The policy name will be appear similar to oneClick_firehose_delivery_role_12312342123

e. Click Next and review the configurations on the Review page.

f. Click Create Delivery Stream to create the Kinesis Firehose Delivery Stream.​

3. Select the created Firehose Data Stream from Amazon Kinesis Data Firehose drop-down menu and click Create.

4. Logging will be enabled once it is created.

To create SQS and attach it with S3 please refer https://mdrkb.atlassian.net/wiki/x/AQCeEQ

Note: Please refer below page to check required IAM user and KMS Key policies for S3, SQS and KMS

https://mdrkb.atlassian.net/wiki/x/hoCdEQ

Note: Below are the URL details which we need to allow for connectivity (Please identify URLs by referring AWS document according to your services and regions):

IAM: For any logging source IAM URL should be allowed

https://docs.aws.amazon.com/general/latest/gr/iam-service.html

S3: For S3 or SQS logging source, S3 URL should be allowed.

https://docs.aws.amazon.com/general/latest/gr/s3.html

SQS: For SQS logging source, SQS URL should be allowed.

https://docs.aws.amazon.com/general/latest/gr/sqs-service.html

LCP Configuration Parameters

MxDR supports log collection using role based access control (RBAC) or access key ID and secret method.

• To create access key ID and secret please refer https://docs.aws.amazon.com/powershell/latest/userguide/pstools-appendix-sign-up.html

• To support log collection using RBAC please refer Accenture MDR Quick Start Guide for Role Based Access Control in AWS Generic Sensor

Table 1-2: The AWS WAF event collector (API - 3896) properties to be configured by MDR are given in table.