Skip to content

Commit a235682

Browse files
JV0812jpipkin1
andauthored
V1 to V2 app migration (#5409)
* V1 to V2 app migration * Update docs/integrations/amazon-aws/cloudtrail.md Co-authored-by: John Pipkin (Sumo Logic) <[email protected]> * Update docs/integrations/cloud-security-monitoring-analytics/aws-waf.md Co-authored-by: John Pipkin (Sumo Logic) <[email protected]> * Update docs/integrations/cloud-security-monitoring-analytics/aws-security-hub.md Co-authored-by: John Pipkin (Sumo Logic) <[email protected]> * Update docs/integrations/cloud-security-monitoring-analytics/amazon-vpc-flow.md Co-authored-by: John Pipkin (Sumo Logic) <[email protected]> * Update docs/integrations/cloud-security-monitoring-analytics/amazon-guardduty.md Co-authored-by: John Pipkin (Sumo Logic) <[email protected]> * Update docs/integrations/amazon-aws/vpc-flow-logs-pci-compliance.md Co-authored-by: John Pipkin (Sumo Logic) <[email protected]> * Update docs/integrations/amazon-aws/security-hub.md Co-authored-by: John Pipkin (Sumo Logic) <[email protected]> * Update docs/integrations/amazon-aws/network-firewall.md Co-authored-by: John Pipkin (Sumo Logic) <[email protected]> * Update docs/integrations/amazon-aws/cloudtrail.md Co-authored-by: John Pipkin (Sumo Logic) <[email protected]> * Update docs/integrations/amazon-aws/guardduty.md Co-authored-by: John Pipkin (Sumo Logic) <[email protected]> --------- Co-authored-by: John Pipkin (Sumo Logic) <[email protected]>
1 parent bb90e39 commit a235682

File tree

16 files changed

+96
-92
lines changed

16 files changed

+96
-92
lines changed

docs/integrations/amazon-aws/cloudtrail-pci-compliance.md

Lines changed: 11 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,41 @@
11
---
22
id: cloudtrail-pci-compliance
33
title: PCI Compliance For AWS CloudTrail
4-
description: The Sumo Logic App for Payment Card Industry (PCI) Compliance for AWS CloudTrail App offers dashboards to monitor systems, account and users activity to ensure that login activity and privileged users are within the expected ranges.
4+
description: The Sumo Logic app for Payment Card Industry (PCI) Compliance for AWS CloudTrail app offers dashboards to monitor systems, account and users activity to ensure that login activity and privileged users are within the expected ranges.
55
---
66

77
import useBaseUrl from '@docusaurus/useBaseUrl';
88

99
<img src={useBaseUrl('img/integrations/pci-compliance/pci-logo.png')} alt="Thumbnail icon" width="90"/>
1010

11-
The Sumo Logic App for Payment Card Industry (PCI) Compliance for AWS CloudTrail App offers dashboards to monitor systems, account and users activity to ensure that login activity and privileged users are within the expected ranges. The PCI Compliance for AWS CloudTrail App covers PCI requirements 02, 07, 08 and 10.
11+
The Sumo Logic app for Payment Card Industry (PCI) Compliance for AWS CloudTrail app offers dashboards to monitor systems, account and users activity to ensure that login activity and privileged users are within the expected ranges. The PCI Compliance for AWS CloudTrail app covers PCI requirements 02, 07, 08 and 10.
1212

1313

14+
## Collecting logs for the PCI Compliance for AWS CloudTrail app
1415

15-
## Collecting logs for the PCI Compliance for AWS CloudTrail App
16-
17-
This section provides instructions for collecting logs for the the PCI Compliance for AWS CloudTrail App.
16+
This section provides instructions for collecting logs for the the PCI Compliance for AWS CloudTrail app.
1817

1918
To configure an AWS CloudTrail Source, do the following:
2019
1. [Grant Sumo Logic access](/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product) to an Amazon S3 bucket.
2120
2. [Configure CloudTrail](http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html) in your AWS account.
2221
3. Confirm that logs are being delivered to the Amazon S3 bucket.
2322
4. Add an [AWS CloudTrail Source](/docs/send-data/hosted-collectors/amazon-aws/aws-cloudtrail-source) to Sumo Logic.
24-
5. Install the Sumo Logic App for [PCI Compliance for AWS CloudTrail](#installing-the-pci-compliance-for-aws-cloudtrail-app).
23+
5. Install the Sumo Logic app for [PCI Compliance for AWS CloudTrail](#installing-the-pci-compliance-for-aws-cloudtrail-app).
2524

2625

27-
## Installing the PCI Compliance for AWS CloudTrail App
26+
## Installing the PCI Compliance for AWS CloudTrail app
2827

29-
Now that you have set up collection, install the Sumo Logic App for PCI Compliance for AWS CloudTrail to use the preconfigured searches and [dashboards](#viewing-pci-compliance-for-aws-cloudtrail-dashboards) that provide insight into your data.
28+
Now that you have set up collection, install the Sumo Logic app for PCI Compliance for AWS CloudTrail to use the preconfigured searches and [dashboards](#viewing-pci-compliance-for-aws-cloudtrail-dashboards) that provide insight into your data.
3029

31-
import AppInstall from '../../reuse/apps/app-install.md';
30+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
3231

33-
<AppInstall/>
32+
<AppInstallV2/>
3433

3534
## Viewing PCI Compliance for AWS CloudTrail Dashboards
3635

37-
The Sumo Logic PCI Compliance for AWS CloudTrail App provides dashboards and sample queries that you can modify for your specific compliance needs.
38-
* Access Monitoring
39-
* Login Activity
40-
* Account and System Monitoring
41-
* Privileged Activity
36+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
4237

38+
<ViewDashboards/>
4339

4440
### PCI Req 01 - Access Monitoring
4541

docs/integrations/amazon-aws/cloudtrail.md

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -138,49 +138,50 @@ Your search results should look similar to:
138138

139139
Now that you have set up collection for AWS CloudTrail, install the Sumo Logic App for CloudTrail to use the pre-configured searches and dashboards that provide visibility into your environment.
140140

141-
import AppInstall from '../../reuse/apps/app-install.md';
141+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
142142

143-
<AppInstall/>
143+
<AppInstallV2/>
144144

145145
:::info
146146

147147
<details>
148148
<summary><strong>What if my data isn't displaying in all Panels?</strong></summary>
149149

150-
### Scan interval issues
150+
#### Scan interval issues
151151

152152
Amazon S3 buckets are scanned for new files according to the Scan Interval you set when configuring the S3 Source used for AWS CloudTrail logs. Even if you set a shorter Scan Interval, say five minutes, if no new files are found, the Scan Interval is automatically doubled, up to 24 hours (you can read more in [Set the S3 Source Scan Interval](#viewing-aws-cloudtrail-dashboards)). If the Scan Interval increases, it means that a Panel set to a 60-minute time range may not find any data to display, because no files have uploaded to Sumo Logic. This isn't to say that no data is being collected from your S3 bucket; you can confirm that data is being collected on the Status page.
153153

154154
Additionally, you can change the time range of a Panel. Even though these have been preconfigured, they can be edited just like any other Panel. You'll find instructions in [Changing the Time Range of a Panel](/docs/dashboards/set-custom-time-ranges).
155155

156-
### AWS Admin activity not tracked
156+
#### AWS Admin activity not tracked
157157

158158
To track Admin activity in your AWS account, and to provide data for all Administrator Activity Panels in the User Monitoring Dashboard, you need to supply a list of admin users to Sumo. For instructions see [Enable Sumo to Track AWS Admin Activity](#enable-sumo-logic-to-track-aws-admin-activity)
159159

160160
</details>
161161

162162
:::
163163

164-
165-
## Configuring the AWS CloudTrail App in Multiple Environments
164+
## Configuring the AWS CloudTrail app in multiple environments
166165

167166
If you have more than one environment that generates CloudTrail data (such as ops, dev, and so on) you’ll need to configure a separate S3 Source for each environment.
168167

169168
This way, you’ll have the three app dashboards for each environment.
170169

171170
To avoid confusion, and in order to identify which environment is generating data, you should name each S3 Source with the environment's name. For example, you might name your Sources as something like: `CloudTrail-prod`, `CloudTrail-dev`, `CloudTrail-test`, etc.
172171

173-
Finally, make copies of each Panel in the CloudTrail Dashboards, and modify the search logic in each Panel so that you select the appropriate source for each environment.
172+
Finally, make copies of each panel in the CloudTrail dashboards, and modify the search logic in each Panel so that you select the appropriate source for each environment.
174173

175-
For example, for a production environment, you will add the string: `_source=CloudTrail-production` to the beginning of each search. Edit the names of the Panels as needed. This means if you have three environments then you will have three copies of the application for each of them (nine dashboards in total).
174+
For example, for a production environment, you will add the string: `_source=CloudTrail-production` to the beginning of each search. Edit the names of the panels as needed. This means if you have three environments then you will have three copies of the application for each of them (nine dashboards in total).
176175

176+
## Viewing AWS CloudTrail dashboards
177177

178+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
178179

179-
## Viewing AWS CloudTrail Dashboards
180+
<ViewDashboards/>
180181

181-
### AWS CloudTrail - Overview
182+
### Overview
182183

183-
See an overview of your AWS users, resources, network and security events. The panels present information about top 10 users, failed logins, user locations, and resource creation and deletion.
184+
See an overview of your AWS users, resources, network, and security events. The panels present information about top 10 users, failed logins, user locations, and resource creation and deletion.
184185

185186
<img src={useBaseUrl('img/integrations/amazon-aws/cloudtrail-overview.png')} alt="AWS CloudTrail" width="900"/>
186187

@@ -197,7 +198,7 @@ See an overview of your AWS users, resources, network and security events. The p
197198
**Created and Deleted Network and Security Events**. Displays a pie chart of created or deleted events for the past 24 hours.
198199

199200

200-
### AWS CloudTrail - User Monitoring
201+
### User Monitoring
201202

202203
See information about your AWS users, including user locations, administrative activities, and instance launch and termination by users.
203204

@@ -216,7 +217,7 @@ See information about your AWS users, including user locations, administrative a
216217
**Recent Activity by Administrative Users**. Activity over the last three hours are displayed by the name of the event (CreateUser, PutUserPolicy, and so on) and by the user’s name and location.
217218

218219

219-
### AWS CloudTrail - Network and Security
220+
### Network and Security
220221

221222
See information about network and security events, authorization failures, security group and network ACL changes, and short lived critical operations.
222223

@@ -239,7 +240,7 @@ See information about network and security events, authorization failures, secur
239240
**Short Lived Critical Operations**. The search behind this Panel watches for users, groups, or policies that are created and then deleted within a span of 10 minutes.
240241

241242

242-
### AWS CloudTrail - Operations
243+
### Operations
243244

244245
See information about operations activity in your AWS account, including action events, requested AWS services, events by AWS region, created and deleted resources, and elastic IP address operations.
245246

@@ -258,7 +259,7 @@ See information about operations activity in your AWS account, including action
258259
**Deleted Resources Over Time**. Displays the resources deleted every hour over the past 24 hours.
259260

260261

261-
### AWS CloudTrail - Console Logins
262+
### Console Logins
262263

263264
See information about CloudTrail console logins, including location of users, login events by user, logins from multiple IP address, logins from outside the US, and logins without multi-factor authentication.
264265

@@ -283,7 +284,7 @@ See information about CloudTrail console logins, including location of users, lo
283284
**Logins without MFA**. Shows users who have logged in without using multi-factor authentication (MFA) in an aggregation table, including the user name, login result status, and count for the last 24 hours.
284285

285286

286-
### AWS CloudTrail - S3 Public Objects and Buckets
287+
### S3 Public Objects and Buckets
287288

288289
See information about S3 public objects and buckets, including counts of new public objects, public buckets, and modified public objects.
289290

docs/integrations/amazon-aws/config.md

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -154,16 +154,19 @@ To create a partition, follow the instructions to [Create a Partition](/docs/man
154154

155155
Now that you have configured AWS Config, install the Sumo Logic App for AWS Config to take advantage of the pre-configured searches and dashboards to analyze your AWS Config data.
156156

157-
import AppInstall from '../../reuse/apps/app-install.md';
157+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
158158

159-
<AppInstall/>
159+
<AppInstallV2/>
160160

161161
## Viewing AWS Config Dashboards
162162

163-
This section describes the dashboards provided by the AWS Config app. For general information about dashboards, see [About Dashboards](/docs/dashboards/about).
163+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
164164

165-
The AWS Config app is an older application, implemented when Sumo dashboards could not be toggled back and forth between Live and Interactive mode. For this reason, the app provides two versions of the AWS Config Overview dashboard, one that runs in Live mode, and one that runs in Interactive mode.
165+
<ViewDashboards/>
166166

167+
:::info
168+
The AWS Config app is an older application, implemented when Sumo Logic dashboards could not be toggled back and forth between Live and Interactive mode. For this reason, the app provides two versions of the AWS Config Overview dashboard, one that runs in Live mode, and one that runs in Interactive mode.
169+
:::
167170

168171
### AWS Config Overview
169172

docs/integrations/amazon-aws/guardduty.md

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -225,19 +225,22 @@ In this step, you deploy the events processor. This will create the AWS resource
225225

226226
Now that you have set up collection for Amazon GuardDuty, install the Sumo Logic App to use the pre-configured searches and dashboards that provide visibility into your environment for real-time analysis of overall usage.
227227

228-
import AppInstall from '../../reuse/apps/app-install.md';
228+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
229229

230-
<AppInstall/>
230+
<AppInstallV2/>
231231

232-
## Viewing Amazon GuardDuty Dashboards
232+
## Viewing Amazon GuardDuty dashboards
233+
234+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
235+
236+
<ViewDashboards/>
233237

234238
### Overview
235239

236240
See the overview of GuardDuty threats including the severity, threat purpose, resource type, threat name, account ID, and region.
237241

238242
<img src={useBaseUrl('img/integrations/amazon-aws/AWS_GuardDuty-Overview2.png')} alt="Amazon GuardDuty dashboards" />
239243

240-
241244
**GuardDuty Threat Map**. See the count of threats on a world map in the last 24 hours.
242245

243246
**High Severity Threats Table**. See the details of high severity threats in the last 24 hours including the time, account ID, region, resource type, description, and link, displayed in a table.
@@ -254,15 +257,12 @@ See the overview of GuardDuty threats including the severity, threat purpose, re
254257

255258
**Severity and ResourceType**. See the count of severity levels in the last 24 hours by resource type on a bar chart.
256259

257-
258260
### CloudTrail Details
259261

260-
261262
See the details of GuardDuty CloudTrail threats including the count, title, the trend, and action type.
262263

263264
<img src={useBaseUrl('img/integrations/amazon-aws/CloudTrailDetails.png')} alt="Amazon GuardDuty dashboards" />
264265

265-
266266
**CloudTrail Threats.** See the count of CloudTrail threats in the last 24 hours.
267267

268268
**CloudTrail Threats by Title Trend**. See the count of CloudTrail threats by title in the last 24 hours on a pie chart.
@@ -273,10 +273,8 @@ See the details of GuardDuty CloudTrail threats including the count, title, the
273273

274274
**CloudTrail Threats by Title, ActionType**. See the details of CloudTrail threats in the last 24 hours including the account ID, region, title, accesskey ID, principal ID, action type, severity, and count, displayed in a table.
275275

276-
277276
### Details
278277

279-
280278
See the GuardDuty threat details including the count, account-region trend, threat purpose, severity, resource type, and security group.
281279

282280
<img src={useBaseUrl('img/integrations/amazon-aws/Amazon-GD-Details.png')} alt="Amazon GuardDuty dashboards" />
@@ -295,7 +293,6 @@ See the GuardDuty threat details including the count, account-region trend, thre
295293

296294
**Threats by SecurityGroup**. See the count and percentage of threats in the last 24 hours by security group on a pie chart.
297295

298-
299296
### VPCs, Subnets, Security Group Details
300297

301298
See the details of GuardDuty threats by VPC, security group, and subnet ID.

docs/integrations/amazon-aws/network-firewall.md

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -124,18 +124,15 @@ _sourceCategory=aws/vanta/*
124124

125125
This section provides instructions for installing the Sumo Logic App for AWS Network Firewall.
126126

127-
import AppInstall from '../../reuse/apps/app-install.md';
127+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
128128

129-
<AppInstall/>
129+
<AppInstallV2/>
130130

131-
## Viewing AWS Network Firewall Dashboards
131+
## Viewing AWS Network Firewall dashboards
132132

133-
This section offers descriptions and examples for each of the pre-configured app dashboards.
134-
135-
:::tip Filter with template variables
136-
Template variables provide dynamic dashboards that can rescope data on the fly. As you apply variables to troubleshoot through your dashboard, you view dynamic changes to the data for a quicker resolution to the root cause. You can use template variables to drill down and examine the data on a granular level. For more information, see [Filter with template variables](/docs/dashboards/filter-template-variables.md).
137-
:::
133+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
138134

135+
<ViewDashboards/>
139136

140137
### Netflow Overview
141138

docs/integrations/amazon-aws/security-hub.md

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -277,17 +277,15 @@ To deploy an AWS Security Hub App collector:
277277

278278
Now that you have set up ingestion and collected findings for AWS Security Hub, you can install the Sumo Logic App for AWS Security Hub and use the preconfigured searches and dashboards that provide insight into your data.
279279

280-
import AppInstall from '../../reuse/apps/app-install.md';
280+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
281281

282-
<AppInstall/>
282+
<AppInstallV2/>
283283

284-
## Viewing AWS Security Hub Dashboards
284+
## Viewing AWS Security Hub dashboards
285285

286-
**Each dashboard has a set of filters** that you can apply to the entire dashboard, as shown in the following example. Click the funnel icon in the top dashboard menu bar to display a scrollable list of filters that narrow search results across the entire dashboard.
287-
288-
289-
**Each panel has a set of filters** that are applied to the results for that panel only, as shown in the following example. Click the funnel icon in the top panel menu bar to display a list of panel-specific filters.
286+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
290287

288+
<ViewDashboards/>
291289

292290
### Overview
293291

docs/integrations/amazon-aws/threat-intel.md

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,15 +37,14 @@ The Sumo Logic Threat Intel lookup database is only available with Sumo Logic En
3737

3838
Now that you have set up collection, install the Sumo Logic App for Threat Intel for AWS to use the preconfigured searches and [Dashboards](/docs/integrations/amazon-aws/threat-intel#viewing-threat-intel-dashboards) that provide insight into your data.
3939

40-
import AppInstall from '../../reuse/apps/app-install.md';
40+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
4141

42-
<AppInstall/>
42+
<AppInstallV2/>
4343

44-
## Viewing Threat Intel Dashboards
44+
## Viewing Threat Intel dashboards
4545

4646
All Dashboards include filters that you can use in Interactive Mode for further analysis of your Threat Intel data.
4747

48-
4948
### Overview
5049

5150
High-level view of the threats identified by Threat Intel in your AWS CloudTrail, VPC Flow Logs, and ELB systems.

docs/integrations/amazon-aws/vpc-flow-logs-pci-compliance.md

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -37,19 +37,23 @@ json "logStream", "logGroup", "message", "direction" as logStream, logGroup, msg
3737
| parse field=msg "* * * * * * * * * * * * * *" as version,accountID,interfaceID,src_ip,dest_ip,src_port,dest_port,Protocol,Packets,bytes,StartSample,EndSample,Action,status nodrop
3838
```
3939

40+
## Installing the PCI Compliance for Amazon VPC Flow Logs app
4041

41-
## Installing the PCI Compliance for Amazon VPC Flow Logs App
42+
Now that you have set up collection, install the Sumo Logic app for PCI Compliance For Amazon VPC Flow to use the preconfigured searches and dashboards that provide insight into your data.
4243

43-
Now that you have set up collection, install the Sumo Logic App for PCI Compliance For Amazon VPC Flow App to use the preconfigured searches and dashboards that provide insight into your data.
44+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
4445

45-
import AppInstall from '../../reuse/apps/app-install.md';
46+
<AppInstallV2/>
4647

47-
<AppInstall/>
48+
## Viewing the PCI VPC dashboards
4849

49-
## Viewing the PCI VPC Dashboards
50+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
5051

51-
The Sumo Logic App for Payment Card Industry (PCI) Compliance for Amazon VPC Flow App offers dashboards to help you monitor that network traffic, network activities, and network security are within your expected ranges. The PCI Compliance for Amazon VPC Flow App covers PCI requirements 01, 02 and 04.
52+
<ViewDashboards/>
5253

54+
:::note
55+
The PCI Compliance for Amazon VPC Flow App covers PCI requirements 01, 02, and 04.
56+
:::
5357

5458
### PCI Req 01 - Accepted and Rejected Traffic
5559

docs/integrations/amazon-aws/vpc-flow-logs.md

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -180,12 +180,15 @@ json "message" as _rawvpc nodrop
180180

181181
Now that you have configured Amazon VPC Flow Logs, install the Sumo Logic App for Amazon VPC Flow Logs to take advantage of the preconfigured searches and dashboards to analyze your data.
182182

183-
import AppInstall from '../../reuse/apps/app-install.md';
183+
import AppInstallV2 from '../../reuse/apps/app-install-v2.md';
184184

185-
<AppInstall/>
185+
<AppInstallV2/>
186186

187-
## Viewing Amazon VPC Flow Logs Dashboards
187+
## Viewing Amazon VPC Flow Logs dashboards
188188

189+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
190+
191+
<ViewDashboards/>
189192

190193
### Overview
191194

0 commit comments

Comments
 (0)