Cloud logs collection

[usmanaa10]

Hi Friends,
I have infrastructure on the cloud and I think it cost me more if I deploy a security onion solution over there. What did you guys suggest?
If I want to collect logs from AWS cloud to on-prem security onion setup what should I do and addition I will need to do, Kindly guide me with proper configuration?

Thanks

[weslambert]

If you are referring to collecting logs only, you could consider using the AWS Filbeat module:
https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-aws.html
https://docs.securityonion.net/en/latest/filebeat.html#modules

If you are referring to actually monitoring traffic in AWS and feeding that back to your on-prem stack, you could consider running a sensor in AWS, and your manager and search node(s) locally:
https://docs.securityonion.net/en/latest/cloud-ami.html