You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/integrations/amazon-aws/amazon-elastic-block-store.md
+62-7Lines changed: 62 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,15 +12,70 @@ Amazon Elastic Block Store (Amazon EBS) provides block level storage volumes for
12
12
13
13
Amazon EBS is recommended for data that must be quickly accessible and requires long-term persistence. EBS volumes are particularly well-suited for use as the primary storage for file systems, databases, or for any applications that require fine granular updates and access to raw, unformatted, block-level storage. Amazon EBS is well suited to both database-style applications that rely on random reads and writes, and to throughput-intensive applications that perform long, continuous reads and writes. For more details, refer to the [AWS documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AmazonEBS.html).
For [CloudTrail log](https://docs.aws.amazon.com/ebs/latest/userguide/logging-ebs-apis-using-cloudtrail.html), Amazon EBS and Amazon EC2 are tightly integrated services. Most EBS-related events are captured and reflected as part of EC2 events, since EBS volumes are typically attached to EC2 instances for storage and compute operations. See the [Amazon EC2 app](https://help.sumologic.com/docs/integrations/amazon-aws/ec2-cloudwatch-metrics/#events) for EBS related captured events.
20
+
:::
19
21
20
22
## Setup
21
-
You can collect the logs and metrics for Sumo Logic's Amazon Elastic Block Store (Amazon EBS) integration by following the below steps.
23
+
You can collect the metrics for Sumo Logic's Amazon Elastic Block Store (Amazon EBS) integration by following the below steps.
22
24
23
-
### Configure metrics collection
24
-
* Collect **CloudWatch Metrics** with namespace `AWS/EBS` using the [AWS Kinesis Firehose for Metrics](/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-metrics-source/) source. For `AWS/EBS` metrics and dimensions, refer to [Amazon Elastic Block Store (Amazon EBS) CloudWatch metrics](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using_cloudwatch_ebs.html).
25
-
### Configure logs collection
26
-
* Collect [AWS CloudTrail Logs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html) using [AWS CloudTrail](/docs/send-data/hosted-collectors/amazon-aws/aws-cloudtrail-source/) source. Amazon EC2 and Amazon EBS are integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or AWS service in Amazon EC2 and Amazon EBS. CloudTrail captures all API calls for Amazon EC2 and Amazon EBS as events, including calls from the console and from code calls to the APIs. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for Amazon EC2 and Amazon EBS. Using the information collected by CloudTrail, you can determine the request that was made to Amazon EC2 and Amazon EBS, the IP address from which the request was made, who made the request, when it was made, and additional details.
25
+
### Collect CloudWatch Metrics
26
+
27
+
Sumo Logic supports collecting metrics using two source types:
28
+
29
+
* Configure an [AWS Kinesis Firehose for Metrics Source](/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-metrics-source) (recommended); or
30
+
* Configure an [Amazon CloudWatch Source for Metrics](/docs/send-data/hosted-collectors/amazon-aws/amazon-cloudwatch-source-metrics)
31
+
32
+
* The namespace for **Amazon Elastic Block Store** Service is **AWS/EBS**.
33
+
* **Metadata**. Add an **account** field to the source and assign it a value that is a friendly name/alias to your AWS account from which you are collecting metrics. Metrics can be queried via the “account field”.
34
+
35
+
## Installing the Elastic Block Store app
36
+
37
+
Now that you have set up a collection for **Amazon Elastic Block Store**, install the Sumo Logic app to use the pre-configured [dashboards](#viewing-the-elastic-block-store-dashboards) that provide visibility into your environment for real-time analysis of overall usage.
38
+
39
+
import AppInstall from '../../reuse/apps/app-install-v2.md';
40
+
41
+
<AppInstall/>
42
+
43
+
## Viewing the Elastic Block Store dashboards
44
+
45
+
We highly recommend you view these dashboards in the [AWS Observability view](/docs/dashboards/explore-view/#aws-observability) of the AWS Observability solution.
46
+
47
+
:::note
48
+
Most Amazon EBS metrics shown on the dashboard depend on the volume type and usage conditions. For more details, refer to [CloudWatch Metrics](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using_cloudwatch_ebs.html).
49
+
:::
50
+
51
+
### Overview
52
+
53
+
The **Amazon EBS - Overview** dashboard offers a comprehensive view of the performance and utilization throughout the lifecycle of your EBS volumes. It allows you to monitor essential metrics such as volume activity, data throughput, and latency.
54
+
55
+
Use this dashboard to:
56
+
* Monitor EBS volume performance metrics like IOPS, throughput, and latency.
57
+
* Track burst balance and queue depth to assess I/O efficiency.
The **Amazon EBS - Performance** dashboard provides detail visibility into the performance and utilization of your EBS volumes, fast snapshot restore capabilities, and snapshot lifecycle. It enables monitoring of key metrics related to volume activity, latency.
64
+
65
+
Use this dashboard to:
66
+
* Monitor EBS volume performance metrics like latency, time spent on operations.
67
+
* Track burst balance and queue depth to assess I/O efficiency.
68
+
* Monitor status checks to detect degraded or impaired volumes and snapshot copy progress.
69
+
* Track Fast Snapshot Restore readiness and available restore credits.
The **Amazon EBS - Throughput and IOPS** dashboard provides detail visibility into the Throughput and IOPS utilization of your EBS volumes, It enables monitoring of key metrics related to volume IOPS activity, data throughput.
74
+
75
+
Use this dashboard to:
76
+
* Monitor EBS volume performance metrics like IOPS, throughput.
77
+
* Monitor status checks to detect degraded or impaired volumes.
78
+
* Track data transfer activity to understand read/write patterns over time.
Copy file name to clipboardExpand all lines: docs/manage/deletion-requests.md
+2-1Lines changed: 2 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -30,7 +30,8 @@ After a data deletion request is approved, data will be deleted from the organiz
30
30
:::
31
31
32
32
:::note
33
-
During the data deletion process, existing messages may temporarily appear duplicated for a few seconds. These duplicated messages will automatically disappear once the data deletion is complete.
33
+
- During the data deletion process, existing messages may temporarily appear duplicated for a few seconds. These duplicated messages will automatically disappear once the data deletion is complete.
34
+
- Pinned queries may continue to display data identified for deletion for up to 24 hours from the initial run, prior to the data deletion request approval.
Copy file name to clipboardExpand all lines: docs/platform-services/automation-service/app-central/integrations/aws-waf.md
+220-6Lines changed: 220 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,72 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
9
9
***Version: 1.1
10
10
Updated: March 26, 2025***
11
11
12
+
## Overview
13
+
14
+
### Purpose
15
+
12
16
AWS WAF is a web application firewall that helps protect web applications from attacks by allowing you to configure rules that allow, block, or monitor (count) web requests based on conditions that you define.
17
+
This integration is designed to manage and retrieve WAF security configurations, including IP sets, regex pattern sets, rule groups, and web access control lists (web ACLs). It enables you to define, update, delete, and retrieve security rule assets that inspect and control web request traffic.
18
+
19
+
### Use cases
20
+
21
+
* Creating and managing IP allowlists/denylists
22
+
* Defining regex-based pattern rules for request inspection
23
+
* Grouping multiple rules in custom rule groups
24
+
* Fetching details and summaries of rule components
25
+
* Updating existing rules in response to new threats
26
+
27
+
### Supported versions
28
+
29
+
This integration supports WAFv2 API actions and works with resources.
30
+
It is compatible with all standard environments where WAFv2 actions are supported.
* Proper region selection for WAFv2 API calls (`regional` or `global` scope)
41
+
* API credentials with sufficient access
42
+
43
+
### Limitations
44
+
45
+
* Regex complexity may be limited by the WAF regex engine's constraints.
46
+
* All changes require propagation time before taking effect (~1-2 minutes).
47
+
48
+
## Configure AWS WAF in Automation Service and Cloud SOAR
49
+
50
+
import IntegrationsAuth from '../../../../reuse/integrations-authentication.md';
51
+
52
+
<IntegrationsAuth/>
53
+
54
+
### Installation
55
+
56
+
[Install](/docs/platform-services/automation-service/automation-service-app-central/#install-an-integration-from-app-central) the AWS WAF application from App Central.
57
+
58
+
### Configuration
59
+
60
+
After installing the AWS WAF application, create an AWS WAF resource to begin executing actions.
61
+
62
+
Refer to the image below for guidance on creating an AWS WAF resource.
#### Delete IP Set / Regex Pattern Set / Rule Group
176
+
* Method: POST
177
+
* Action: Delete (Type)
178
+
* Required Parameters:
179
+
* Name, ID, Scope, Region
180
+
181
+
### Enrichment APIs
182
+
183
+
#### Get IP Set / Rule Group / Web ACL / Managed Rule Set
184
+
* Method: GET
185
+
* Action: Get (Type) ex: Get IP Set/Get Rule Group
186
+
* Required Parameters:
187
+
* Id, Name, Scope
188
+
189
+
#### List IP Sets / Regex Pattern Sets / Rule Groups / Web ACLs / Managed Rule Sets
190
+
* Method: GET
191
+
* Action: List (Type)s
192
+
* Optional Parameters: Limit, NextMarker
193
+
194
+
#### List Resources for Web ACLs
195
+
* Method: GET
196
+
* Action: ListResourcesForWebACL
197
+
* Required Parameters:
198
+
* WebACLArn
199
+
200
+
### Rate limits and quotas
201
+
202
+
| API type | Quota/rate limit |
203
+
| :-- | :-- |
204
+
| IP sets per region | 100 |
205
+
| Regex sets per region | 100 |
206
+
| Rule groups per region | 100 |
207
+
| API transactions (TPS) |~5-10 TPS per account per API |
208
+
209
+
Limits may vary by region and can be increased via AWS Support.
210
+
211
+
## Troubleshooting
212
+
213
+
### Common issues
214
+
215
+
| Issue | Description | Solution |
216
+
| :-- | :-- | :-- |
217
+
| WAFNonexistentItemException | Occurs when trying to access or delete a non-existent resource. | Double-check the ID, Name, and Scope. Use List APIs to confirm existence. |
218
+
| WAFOptimisticLockException | Indicates a stale or missing LockToken when updating or deleting resources. | Always fetch the latest LockToken using Get API before performing updates/deletes. |
219
+
| WAFInvalidParameterException | One or more parameters are invalid or missing. | Verify that all required parameters are included and correctly formatted (for example, CIDR for IP sets). |
220
+
| AccessDeniedException | Occurs when permissions are insufficient. | Check IAM roles and policies assigned to the user or service making the request. Ensure `wafv2:*` permissions are included. |
221
+
| Resource still appears after deletion. | A deleted IPSet, RuleGroup, etc. still seems accessible in the UI or APIs. | Allow a few seconds for propagation. Use Get `<action-type>` or List `<action-type>` to confirm removal. |
222
+
| IP addresses not being blocked. | Traffic from listed IPs still reaches the application. | Ensure the IPSet is attached to a WebACL and the WebACL is associated with the resource (for example, CloudFront or ALB). |
223
+
224
+
225
+
### FAQs
226
+
227
+
#### Can I reuse an IPSet in different rule groups?
228
+
229
+
Yes, an IPSet can be used in several rule groups or WebACLs. You don’t need to create a new one for each use.
230
+
231
+
#### What’s the difference between REGIONAL and CLOUDFRONT scopes?
232
+
233
+
REGIONAL is used for AWS services like Application Load Balancers, API Gateway, and App Runner.
234
+
235
+
CLOUDFRONT is specifically for CloudFront distributions and must be managed in the US East (N. Virginia) region.
236
+
237
+
#### Why aren’t my changes showing up right away?
238
+
239
+
Updates can take a few moments to fully apply within AWS. Try retrieving the latest configuration using the appropriate Get API call to confirm.
240
+
241
+
#### What if the IP address I provide isn’t in CIDR format?
242
+
243
+
If the IP isn’t formatted correctly (for example, missing the CIDR suffix), AWS WAF will return a WAFInvalidParameterException. Make sure IPs follow the CIDR notation like 192.0.2.0/24.
0 commit comments