You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/integrations/amazon-aws/cloudtrail-pci-compliance.md
+11-15Lines changed: 11 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,45 +1,41 @@
1
1
---
2
2
id: cloudtrail-pci-compliance
3
3
title: PCI Compliance For AWS CloudTrail
4
-
description: The Sumo Logic App for Payment Card Industry (PCI) Compliance for AWS CloudTrail App offers dashboards to monitor systems, account and users activity to ensure that login activity and privileged users are within the expected ranges.
4
+
description: The Sumo Logic app for Payment Card Industry (PCI) Compliance for AWS CloudTrail app offers dashboards to monitor systems, account and users activity to ensure that login activity and privileged users are within the expected ranges.
The Sumo Logic App for Payment Card Industry (PCI) Compliance for AWS CloudTrail App offers dashboards to monitor systems, account and users activity to ensure that login activity and privileged users are within the expected ranges. The PCI Compliance for AWS CloudTrail App covers PCI requirements 02, 07, 08 and 10.
11
+
The Sumo Logic app for Payment Card Industry (PCI) Compliance for AWS CloudTrail app offers dashboards to monitor systems, account and users activity to ensure that login activity and privileged users are within the expected ranges. The PCI Compliance for AWS CloudTrail app covers PCI requirements 02, 07, 08 and 10.
12
12
13
13
14
+
## Collecting logs for the PCI Compliance for AWS CloudTrail app
14
15
15
-
## Collecting logs for the PCI Compliance for AWS CloudTrail App
16
-
17
-
This section provides instructions for collecting logs for the the PCI Compliance for AWS CloudTrail App.
16
+
This section provides instructions for collecting logs for the the PCI Compliance for AWS CloudTrail app.
18
17
19
18
To configure an AWS CloudTrail Source, do the following:
20
19
1.[Grant Sumo Logic access](/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product) to an Amazon S3 bucket.
21
20
2.[Configure CloudTrail](http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html) in your AWS account.
22
21
3. Confirm that logs are being delivered to the Amazon S3 bucket.
23
22
4. Add an [AWS CloudTrail Source](/docs/send-data/hosted-collectors/amazon-aws/aws-cloudtrail-source) to Sumo Logic.
24
-
5. Install the Sumo Logic App for [PCI Compliance for AWS CloudTrail](#installing-the-pci-compliance-for-aws-cloudtrail-app).
23
+
5. Install the Sumo Logic app for [PCI Compliance for AWS CloudTrail](#installing-the-pci-compliance-for-aws-cloudtrail-app).
25
24
26
25
27
-
## Installing the PCI Compliance for AWS CloudTrail App
26
+
## Installing the PCI Compliance for AWS CloudTrail app
28
27
29
-
Now that you have set up collection, install the Sumo Logic App for PCI Compliance for AWS CloudTrail to use the preconfigured searches and [dashboards](#viewing-pci-compliance-for-aws-cloudtrail-dashboards) that provide insight into your data.
28
+
Now that you have set up collection, install the Sumo Logic app for PCI Compliance for AWS CloudTrail to use the preconfigured searches and [dashboards](#viewing-pci-compliance-for-aws-cloudtrail-dashboards) that provide insight into your data.
30
29
31
-
import AppInstall from '../../reuse/apps/app-install.md';
30
+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
32
31
33
-
<AppInstall/>
32
+
<AppInstallV2/>
34
33
35
34
## Viewing PCI Compliance for AWS CloudTrail Dashboards
36
35
37
-
The Sumo Logic PCI Compliance for AWS CloudTrail App provides dashboards and sample queries that you can modify for your specific compliance needs.
38
-
* Access Monitoring
39
-
* Login Activity
40
-
* Account and System Monitoring
41
-
* Privileged Activity
36
+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
Copy file name to clipboardExpand all lines: docs/integrations/amazon-aws/cloudtrail.md
+17-16Lines changed: 17 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -138,49 +138,50 @@ Your search results should look similar to:
138
138
139
139
Now that you have set up collection for AWS CloudTrail, install the Sumo Logic App for CloudTrail to use the pre-configured searches and dashboards that provide visibility into your environment.
140
140
141
-
import AppInstall from '../../reuse/apps/app-install.md';
141
+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
142
142
143
-
<AppInstall/>
143
+
<AppInstallV2/>
144
144
145
145
:::info
146
146
147
147
<details>
148
148
<summary><strong>What if my data isn't displaying in all Panels?</strong></summary>
149
149
150
-
### Scan interval issues
150
+
####Scan interval issues
151
151
152
152
Amazon S3 buckets are scanned for new files according to the Scan Interval you set when configuring the S3 Source used for AWS CloudTrail logs. Even if you set a shorter Scan Interval, say five minutes, if no new files are found, the Scan Interval is automatically doubled, up to 24 hours (you can read more in [Set the S3 Source Scan Interval](#viewing-aws-cloudtrail-dashboards)). If the Scan Interval increases, it means that a Panel set to a 60-minute time range may not find any data to display, because no files have uploaded to Sumo Logic. This isn't to say that no data is being collected from your S3 bucket; you can confirm that data is being collected on the Status page.
153
153
154
154
Additionally, you can change the time range of a Panel. Even though these have been preconfigured, they can be edited just like any other Panel. You'll find instructions in [Changing the Time Range of a Panel](/docs/dashboards/set-custom-time-ranges).
155
155
156
-
### AWS Admin activity not tracked
156
+
####AWS Admin activity not tracked
157
157
158
158
To track Admin activity in your AWS account, and to provide data for all Administrator Activity Panels in the User Monitoring Dashboard, you need to supply a list of admin users to Sumo. For instructions see [Enable Sumo to Track AWS Admin Activity](#enable-sumo-logic-to-track-aws-admin-activity)
159
159
160
160
</details>
161
161
162
162
:::
163
163
164
-
165
-
## Configuring the AWS CloudTrail App in Multiple Environments
164
+
## Configuring the AWS CloudTrail app in multiple environments
166
165
167
166
If you have more than one environment that generates CloudTrail data (such as ops, dev, and so on) you’ll need to configure a separate S3 Source for each environment.
168
167
169
168
This way, you’ll have the three app dashboards for each environment.
170
169
171
170
To avoid confusion, and in order to identify which environment is generating data, you should name each S3 Source with the environment's name. For example, you might name your Sources as something like: `CloudTrail-prod`, `CloudTrail-dev`, `CloudTrail-test`, etc.
172
171
173
-
Finally, make copies of each Panel in the CloudTrail Dashboards, and modify the search logic in each Panel so that you select the appropriate source for each environment.
172
+
Finally, make copies of each panel in the CloudTrail dashboards, and modify the search logic in each Panel so that you select the appropriate source for each environment.
174
173
175
-
For example, for a production environment, you will add the string: `_source=CloudTrail-production` to the beginning of each search. Edit the names of the Panels as needed. This means if you have three environments then you will have three copies of the application for each of them (nine dashboards in total).
174
+
For example, for a production environment, you will add the string: `_source=CloudTrail-production` to the beginning of each search. Edit the names of the panels as needed. This means if you have three environments then you will have three copies of the application for each of them (nine dashboards in total).
176
175
176
+
## Viewing AWS CloudTrail dashboards
177
177
178
+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
178
179
179
-
## Viewing AWS CloudTrail Dashboards
180
+
<ViewDashboards/>
180
181
181
-
### AWS CloudTrail - Overview
182
+
### Overview
182
183
183
-
See an overview of your AWS users, resources, network and security events. The panels present information about top 10 users, failed logins, user locations, and resource creation and deletion.
184
+
See an overview of your AWS users, resources, network, and security events. The panels present information about top 10 users, failed logins, user locations, and resource creation and deletion.
@@ -197,7 +198,7 @@ See an overview of your AWS users, resources, network and security events. The p
197
198
**Created and Deleted Network and Security Events**. Displays a pie chart of created or deleted events for the past 24 hours.
198
199
199
200
200
-
### AWS CloudTrail - User Monitoring
201
+
### User Monitoring
201
202
202
203
See information about your AWS users, including user locations, administrative activities, and instance launch and termination by users.
203
204
@@ -216,7 +217,7 @@ See information about your AWS users, including user locations, administrative a
216
217
**Recent Activity by Administrative Users**. Activity over the last three hours are displayed by the name of the event (CreateUser, PutUserPolicy, and so on) and by the user’s name and location.
217
218
218
219
219
-
### AWS CloudTrail - Network and Security
220
+
### Network and Security
220
221
221
222
See information about network and security events, authorization failures, security group and network ACL changes, and short lived critical operations.
222
223
@@ -239,7 +240,7 @@ See information about network and security events, authorization failures, secur
239
240
**Short Lived Critical Operations**. The search behind this Panel watches for users, groups, or policies that are created and then deleted within a span of 10 minutes.
240
241
241
242
242
-
### AWS CloudTrail - Operations
243
+
### Operations
243
244
244
245
See information about operations activity in your AWS account, including action events, requested AWS services, events by AWS region, created and deleted resources, and elastic IP address operations.
245
246
@@ -258,7 +259,7 @@ See information about operations activity in your AWS account, including action
258
259
**Deleted Resources Over Time**. Displays the resources deleted every hour over the past 24 hours.
259
260
260
261
261
-
### AWS CloudTrail - Console Logins
262
+
### Console Logins
262
263
263
264
See information about CloudTrail console logins, including location of users, login events by user, logins from multiple IP address, logins from outside the US, and logins without multi-factor authentication.
264
265
@@ -283,7 +284,7 @@ See information about CloudTrail console logins, including location of users, lo
283
284
**Logins without MFA**. Shows users who have logged in without using multi-factor authentication (MFA) in an aggregation table, including the user name, login result status, and count for the last 24 hours.
284
285
285
286
286
-
### AWS CloudTrail - S3 Public Objects and Buckets
287
+
### S3 Public Objects and Buckets
287
288
288
289
See information about S3 public objects and buckets, including counts of new public objects, public buckets, and modified public objects.
Copy file name to clipboardExpand all lines: docs/integrations/amazon-aws/config.md
+7-4Lines changed: 7 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -154,16 +154,19 @@ To create a partition, follow the instructions to [Create a Partition](/docs/man
154
154
155
155
Now that you have configured AWS Config, install the Sumo Logic App for AWS Config to take advantage of the pre-configured searches and dashboards to analyze your AWS Config data.
156
156
157
-
import AppInstall from '../../reuse/apps/app-install.md';
157
+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
158
158
159
-
<AppInstall/>
159
+
<AppInstallV2/>
160
160
161
161
## Viewing AWS Config Dashboards
162
162
163
-
This section describes the dashboards provided by the AWS Config app. For general information about dashboards, see [About Dashboards](/docs/dashboards/about).
163
+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
164
164
165
-
The AWS Config app is an older application, implemented when Sumo dashboards could not be toggled back and forth between Live and Interactive mode. For this reason, the app provides two versions of the AWS Config Overview dashboard, one that runs in Live mode, and one that runs in Interactive mode.
165
+
<ViewDashboards/>
166
166
167
+
:::info
168
+
The AWS Config app is an older application, implemented when Sumo Logic dashboards could not be toggled back and forth between Live and Interactive mode. For this reason, the app provides two versions of the AWS Config Overview dashboard, one that runs in Live mode, and one that runs in Interactive mode.
Copy file name to clipboardExpand all lines: docs/integrations/amazon-aws/guardduty.md
+7-10Lines changed: 7 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -225,19 +225,22 @@ In this step, you deploy the events processor. This will create the AWS resource
225
225
226
226
Now that you have set up collection for Amazon GuardDuty, install the Sumo Logic App to use the pre-configured searches and dashboards that provide visibility into your environment for real-time analysis of overall usage.
227
227
228
-
import AppInstall from '../../reuse/apps/app-install.md';
228
+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
229
229
230
-
<AppInstall/>
230
+
<AppInstallV2/>
231
231
232
-
## Viewing Amazon GuardDuty Dashboards
232
+
## Viewing Amazon GuardDuty dashboards
233
+
234
+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
235
+
236
+
<ViewDashboards/>
233
237
234
238
### Overview
235
239
236
240
See the overview of GuardDuty threats including the severity, threat purpose, resource type, threat name, account ID, and region.
**GuardDuty Threat Map**. See the count of threats on a world map in the last 24 hours.
242
245
243
246
**High Severity Threats Table**. See the details of high severity threats in the last 24 hours including the time, account ID, region, resource type, description, and link, displayed in a table.
@@ -254,15 +257,12 @@ See the overview of GuardDuty threats including the severity, threat purpose, re
254
257
255
258
**Severity and ResourceType**. See the count of severity levels in the last 24 hours by resource type on a bar chart.
256
259
257
-
258
260
### CloudTrail Details
259
261
260
-
261
262
See the details of GuardDuty CloudTrail threats including the count, title, the trend, and action type.
**CloudTrail Threats.** See the count of CloudTrail threats in the last 24 hours.
267
267
268
268
**CloudTrail Threats by Title Trend**. See the count of CloudTrail threats by title in the last 24 hours on a pie chart.
@@ -273,10 +273,8 @@ See the details of GuardDuty CloudTrail threats including the count, title, the
273
273
274
274
**CloudTrail Threats by Title, ActionType**. See the details of CloudTrail threats in the last 24 hours including the account ID, region, title, accesskey ID, principal ID, action type, severity, and count, displayed in a table.
275
275
276
-
277
276
### Details
278
277
279
-
280
278
See the GuardDuty threat details including the count, account-region trend, threat purpose, severity, resource type, and security group.
Copy file name to clipboardExpand all lines: docs/integrations/amazon-aws/network-firewall.md
+5-8Lines changed: 5 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -124,18 +124,15 @@ _sourceCategory=aws/vanta/*
124
124
125
125
This section provides instructions for installing the Sumo Logic App for AWS Network Firewall.
126
126
127
-
import AppInstall from '../../reuse/apps/app-install.md';
127
+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
128
128
129
-
<AppInstall/>
129
+
<AppInstallV2/>
130
130
131
-
## Viewing AWS Network Firewall Dashboards
131
+
## Viewing AWS Network Firewall dashboards
132
132
133
-
This section offers descriptions and examples for each of the pre-configured app dashboards.
134
-
135
-
:::tip Filter with template variables
136
-
Template variables provide dynamic dashboards that can rescope data on the fly. As you apply variables to troubleshoot through your dashboard, you view dynamic changes to the data for a quicker resolution to the root cause. You can use template variables to drill down and examine the data on a granular level. For more information, see [Filter with template variables](/docs/dashboards/filter-template-variables.md).
137
-
:::
133
+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
Copy file name to clipboardExpand all lines: docs/integrations/amazon-aws/security-hub.md
+5-7Lines changed: 5 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -277,17 +277,15 @@ To deploy an AWS Security Hub App collector:
277
277
278
278
Now that you have set up ingestion and collected findings for AWS Security Hub, you can install the Sumo Logic App for AWS Security Hub and use the preconfigured searches and dashboards that provide insight into your data.
279
279
280
-
import AppInstall from '../../reuse/apps/app-install.md';
280
+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
281
281
282
-
<AppInstall/>
282
+
<AppInstallV2/>
283
283
284
-
## Viewing AWS Security Hub Dashboards
284
+
## Viewing AWS Security Hub dashboards
285
285
286
-
**Each dashboard has a set of filters** that you can apply to the entire dashboard, as shown in the following example. Click the funnel icon in the top dashboard menu bar to display a scrollable list of filters that narrow search results across the entire dashboard.
287
-
288
-
289
-
**Each panel has a set of filters** that are applied to the results for that panel only, as shown in the following example. Click the funnel icon in the top panel menu bar to display a list of panel-specific filters.
286
+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
Copy file name to clipboardExpand all lines: docs/integrations/amazon-aws/threat-intel.md
+3-4Lines changed: 3 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,15 +37,14 @@ The Sumo Logic Threat Intel lookup database is only available with Sumo Logic En
37
37
38
38
Now that you have set up collection, install the Sumo Logic App for Threat Intel for AWS to use the preconfigured searches and [Dashboards](/docs/integrations/amazon-aws/threat-intel#viewing-threat-intel-dashboards) that provide insight into your data.
39
39
40
-
import AppInstall from '../../reuse/apps/app-install.md';
40
+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
41
41
42
-
<AppInstall/>
42
+
<AppInstallV2/>
43
43
44
-
## Viewing Threat Intel Dashboards
44
+
## Viewing Threat Intel dashboards
45
45
46
46
All Dashboards include filters that you can use in Interactive Mode for further analysis of your Threat Intel data.
47
47
48
-
49
48
### Overview
50
49
51
50
High-level view of the threats identified by Threat Intel in your AWS CloudTrail, VPC Flow Logs, and ELB systems.
## Installing the PCI Compliance for Amazon VPC Flow Logs app
40
41
41
-
## Installing the PCI Compliance for Amazon VPC Flow Logs App
42
+
Now that you have set up collection, install the Sumo Logic app for PCI Compliance For Amazon VPC Flow to use the preconfigured searches and dashboards that provide insight into your data.
42
43
43
-
Now that you have set up collection, install the Sumo Logic App for PCI Compliance For Amazon VPC Flow App to use the preconfigured searches and dashboards that provide insight into your data.
44
+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
44
45
45
-
import AppInstall from '../../reuse/apps/app-install.md';
46
+
<AppInstallV2/>
46
47
47
-
<AppInstall/>
48
+
## Viewing the PCI VPC dashboards
48
49
49
-
## Viewing the PCI VPC Dashboards
50
+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
50
51
51
-
The Sumo Logic App for Payment Card Industry (PCI) Compliance for Amazon VPC Flow App offers dashboards to help you monitor that network traffic, network activities, and network security are within your expected ranges. The PCI Compliance for Amazon VPC Flow App covers PCI requirements 01, 02 and 04.
52
+
<ViewDashboards/>
52
53
54
+
:::note
55
+
The PCI Compliance for Amazon VPC Flow App covers PCI requirements 01, 02, and 04.
Copy file name to clipboardExpand all lines: docs/integrations/amazon-aws/vpc-flow-logs.md
+6-3Lines changed: 6 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -180,12 +180,15 @@ json "message" as _rawvpc nodrop
180
180
181
181
Now that you have configured Amazon VPC Flow Logs, install the Sumo Logic App for Amazon VPC Flow Logs to take advantage of the preconfigured searches and dashboards to analyze your data.
182
182
183
-
import AppInstall from '../../reuse/apps/app-install.md';
183
+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
184
184
185
-
<AppInstall/>
185
+
<AppInstallV2/>
186
186
187
-
## Viewing Amazon VPC Flow Logs Dashboards
187
+
## Viewing Amazon VPC Flow Logs dashboards
188
188
189
+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
0 commit comments