![]() The script will prompt you to enter your Workspace ID. Copy the command from the connector page (under "Run script to set up the environment") and paste it in your command line. See AWS Command Line Interface | Configuration basics for details. Set up your AWS environment, expand Setup with PowerShell script (recommended).įollow the on-screen instructions to download and extract the AWS S3 Setup Script (link downloads a zip file containing the main setup script and helper scripts) from the connector page.īefore running the script, run the aws configure command from your PowerShell command line, and enter the relevant information as prompted. In the details pane for the connector, select Open connector page. If you don't see the connector, install the Amazon Web Services solution from the Content Hub in Microsoft Sentinel. Select Amazon Web Services S3 from the data connectors gallery. To run the script to set up the connector, use the following steps:įrom the Microsoft Sentinel navigation menu, select Data connectors. Installation instructions for the AWS CLI.Installation instructions for PowerShell.You must have PowerShell and the AWS CLI on your machine. For more information, see Discover and manage Microsoft Sentinel out-of-the-box content (Public preview). Install the Amazon Web Services solution from the Content Hub in Microsoft Sentinel. If necessary, creates that S3 bucket and that SQS queue for this purpose.Ĭonfigures any necessary IAM permissions policies and applies them to the IAM role created above. To simplify the onboarding process, Microsoft Sentinel has provided a PowerShell script to automate the setup of the AWS side of the connector - the required AWS resources, credentials, and permissions.Ĭreates an IAM assumed role with the minimal necessary permissions, to grant Microsoft Sentinel access to your logs in a given S3 bucket and SQS queue.Įnables specified AWS services to send logs to that S3 bucket, and notification messages to that SQS queue. You must have write permission on your Microsoft Sentinel workspace. Similarly, the Microsoft Sentinel workspace ID is embedded in the AWS configuration, so there is in effect two-way authentication. The AWS credentials are configured with a role and a permissions policy giving them access to those resources. To connect to the SQS queue and the S3 bucket, Microsoft Sentinel uses AWS credentials and connection information embedded in the AWS S3 connector's configuration. The connector reads the message with the path, then fetches the files from the S3 bucket. If there is a message in the queue, it will contain the path to the log files. The Microsoft Sentinel AWS S3 connector polls the SQS queue at regular, frequent intervals. The S3 bucket sends notification messages to the SQS (Simple Queue Service) message queue whenever it receives new logs. This graphic and the following text show how the parts of this connector solution interact.ĪWS services are configured to send their logs to S3 (Simple Storage Service) storage buckets. See the instructions for automatic setup later in this document. We have made available, in our GitHub repository, a script that automates the AWS side of this process. This sharing creates secure communication. See the instructions below.Įach side's process produces information used by the other side. Enable and configure the AWS S3 Connector in the Microsoft Sentinel portal.If you need to convert your logs to this format, you can use this CloudWatch lambda function.Ĭonfigure your AWS service(s) to send logs to an S3 bucket.Ĭreate a Simple Queue Service (SQS) queue to provide notification.Ĭreate an assumed role to grant permissions to your Microsoft Sentinel account (external ID) to access your AWS resources.Īttach the appropriate IAM permissions policies to grant Microsoft Sentinel access to the appropriate resources (S3 bucket, SQS). csv file in a GZIP format without a header. Amazon GuardDuty: json-line and GZIP formats.csv file in GZIP format with headers delimiter: space. Make sure that the logs from your selected AWS service use the format accepted by Microsoft Sentinel: The process of setting it up has two parts: the AWS side and the Microsoft Sentinel side. This article explains how to configure the new AWS S3 connector.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |