|
1 | 1 | --- |
2 | 2 | id: aws-network-firewall |
3 | | -title: AWS Network Firewall - Cloud SIEM |
| 3 | +title: Ingest AWS Network Firewall Data into Cloud SIEM |
4 | 4 | sidebar_label: AWS Network Firewall |
5 | 5 | description: Configure collection and ingestion of AWS Network Firewall log messages from an S3 bucket to be parsed by Cloud SIEM's AWS Network Firewall system parser. |
6 | 6 | --- |
7 | 7 |
|
8 | 8 | import useBaseUrl from '@docusaurus/useBaseUrl'; |
9 | 9 |
|
10 | | -This section has instructions for collecting AWS Network Firewall log messages from AWS S3 and sending them to Sumo Logic to be ingested by Cloud SIEM. |
11 | | - |
12 | | -## Step 1: Enable AWS Network Firewall logs |
13 | | - |
14 | | -1. Follow AWS instructions on [firewall log delivery](https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-logging.html) for [S3](https://docs.aws.amazon.com/network-firewall/latest/developerguide/logging-s3.html). |
15 | | -1. Before configuring collection, you need to grant Sumo Logic permission to access your AWS data. For instructions see [Grant Access to an AWS Product](/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product/). |
16 | | - |
17 | | -## Step 2: Configure collection |
18 | | - |
19 | | -In this step, you configure an HTTP Source to collect AWS Network Firewall messages. You can configure the source on an existing Hosted Collector or create a new collector. If you’re going to use an existing collector, jump to [Configure an AWS S3 Source](#configure-an-aws-s3-source) below. Otherwise, create a new collector as described in [Configure a hosted collector](#configure-a-hosted-collector) below, and then create the HTTP Source on the collector. |
20 | | - |
21 | | -### Configure a Hosted Collector |
22 | | - |
23 | | -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**. |
24 | | -1. Click **Add Collector**. |
25 | | -1. Click **Hosted Collector.** |
26 | | -1. The **Add Hosted Collector ** popup appears.< br/><img src={useBaseUrl('img/cse/add-hosted-collector.png')} alt="Add hosted collector" style={{border: '1px solid gray'}} width="600"/> |
27 | | -1. **Name**. Provide a Name for the Collector. |
28 | | -1. **Description**. (Optional) |
29 | | -1. **Category**. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called `_sourceCategory`. |
30 | | -1. **Fields**. |
31 | | - 1. If you are planning that all the sources you add to this collector will forward log messages to Cloud SIEM, click the **+Add Field** link, and add a field whose name is `_siemForward` and value is *true*. This will cause the collector to forward all of the logs collected by all of the sources on the collector to Cloud SIEM. |
32 | | - 1. If all sources in this collector will be AWS Network Firewall sources, add an additional field with key `_parser` and value `/Parsers/System/AWS/AWS Network Firewall`. |
33 | | - |
34 | | -:::note |
35 | | -It’s also possible to configure individual sources to forward to Cloud SIEM, as described in the following section. |
36 | | -::: |
37 | | - |
38 | | -### Configure an AWS S3 Source |
39 | | - |
40 | | -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**. |
41 | | -1. Navigate to the Hosted Collector where you want to create the source. |
42 | | -1. On the **Collectors** page, click **Add Source** next to a Hosted Collector. |
43 | | -1. Select Amazon S3. |
44 | | -1. The page refreshes.< br/><img src={useBaseUrl('img/cse/s3-source.png')} alt="S3 source" style={{border: '1px solid gray'}} width="600"/> |
45 | | -1. **Name**. Enter a name for the source. |
46 | | -1. **Description**. (Optional) |
47 | | -1. **S3 Region**. Choose the AWS Region the S3 bucket resides in. |
48 | | -1. **Bucket Name**. The name of your organizations S3 bucket as it appears in AWS. |
49 | | -1. **Path Expression**. The path expression of the log file(s) in S3, can contain wildcards to include multiple log files. |
50 | | -1. **Source Category**. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called `_sourceCategory`. |
51 | | -1. **Fields**. |
52 | | - 1. If you are not forwarding all sources in the hosted collector to Cloud SIEM, click the **+Add Field** link, and add a field whose name is `_siemForward` and value is *true*. This will ensure all logs for this source are forwarded to Cloud SIEM. |
53 | | - 1. If you are not parsing all sources in the hosted collector with the same parser, add an additional field named `_parser` with value */Parsers/System/AWS/AWS Network Firewall*. |
54 | | -1. **AWS Access**. For AWS Access you have two Access Method options. Select **Role-based access** or **Key access** based on the AWS authentication you are providing. Role-based access is preferred. Sumo Logic access to AWS (instructions are provided above in [Step 1](#step-1-enable-aws-network-firewall-logs)) is a prerequisite for role-based access. |
55 | | - - **Role-based access **. Enter the Role ARN that was provided by AWS after creating the role.< br/><img src={useBaseUrl('img/cse/role-arn.png')} alt="Role ARN" style={{border: '1px solid gray'}} width="600"/> |
56 | | - - **Key access**. Enter the Access Key ID and Secret Access Key. See [AWS Access Key ID](http://docs.aws.amazon.com/STS/latest/UsingSTS/UsingTokens.html#RequestWithSTS) and [AWS Secret Access Key](https://aws.amazon.com/iam/) for details. |
57 | | -14. In the **Advanced Options for Logs** section, uncheck the **Detect messages spanning multiple lines** option. |
58 | | -15. Click **Save**. |
59 | | - |
60 | | -## Step 3: Verify ingestion |
61 | | - |
62 | | -In this step, you verify that your logs are successfully making it into Cloud SIEM. |
63 | | - |
64 | | -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. |
65 | | -1. On the **Log Mappings** tab search for "AWS Network Firewall " and check the **Records** columns. |
66 | | -1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for AWS Network Firewall security records. < br/><img src={useBaseUrl('img/cse/AWS-network-firewall-search.png')} alt="AWS Firewall search" style={{border: '1px solid gray'}} width="600"/> |
67 | | - |
68 | | - |
69 | | - |
| 10 | +To ingest AWS Network Firewall data into Cloud SIEM: |
| 11 | +1. Enable AWS Network Firewall logs: |
| 12 | + 1. Follow AWS instructions on [firewall log delivery](https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-logging.html) for [S3](https://docs.aws.amazon.com/network-firewall/latest/developerguide/logging-s3.html). |
| 13 | + 1. Before configuring collection, you need to grant Sumo Logic permission to access your AWS data. For instructions see [Grant Access to an AWS Product](/docs/send-data/hosted-collectors/amazon-aws/grant-access-aws-product/). |
| 14 | +1. [Create an Amazon S3 source](/docs/send-data/hosted-collectors/amazon-aws/aws-s3-source/#create-an-amazons3-source) on a collector. When you configure the source, do the following: |
| 15 | + 1. Click the **+Add Field** link, and add a field whose name is `_siemForward` and value is *true*. This will ensure all logs for this source are forwarded to Cloud SIEM. |
| 16 | + 1. Add another field named `_parser` with value `/Parsers/System/AWS/AWS Network Firewall`. |
| 17 | +1. To verify that your logs are successfully making it into Cloud SIEM: |
| 18 | + 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. |
| 19 | + 1. On the **Log Mappings** tab search for "AWS Network Firewall " and check the **Records** columns. |
| 20 | + 1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for AWS Network Firewall security records. < br/><img src={useBaseUrl('img/cse/AWS-network-firewall-search.png')} alt="AWS Firewall search" style={{border: '1px solid gray'}} width="600"/> |
0 commit comments