Skip to content

Commit c753bae

Browse files
himsharma01himsharma01
authored
Merge pull request #199 from SumoLogic/fy25q2awso
AWSO v2.9.0
2 parents 0ea182f + 47c08fa commit c753bae

File tree

61 files changed

+2718
-1270
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

61 files changed

+2718
-1270
lines changed

‎.github/workflows/cf-test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414

1515
- name: Print the Cloud Formation Linter Version & run Linter.
1616
run: |
17-
cfn-lint aws-observability/**/*.yaml --ignore-templates aws-observability/**/*TestTemplate.yaml
17+
cfn-lint aws-observability/**/*.yaml --ignore-templates aws-observability/**/*TestTemplate.yaml --ignore-checks W3011
1818
1919
CFSecurityChecksCheckovt:
2020
name: "Security Checks (checkov)"

‎aws-observability-terraform/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,14 @@
55
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.0 |
66
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.16.2, < 6.0.0 |
77
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 3.1.0 |
8-
| <a name="requirement_sumologic"></a> [sumologic](#requirement\_sumologic) | >= 2.28.3, < 3.0.0 |
8+
| <a name="requirement_sumologic"></a> [sumologic](#requirement\_sumologic) | >= 2.31.0, < 3.0.0 |
99
| <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.11.1 |
1010

1111
## Providers
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_sumologic"></a> [sumologic](#provider\_sumologic) | 2.28.3 |
15+
| <a name="provider_sumologic"></a> [sumologic](#provider\_sumologic) | 2.31.0 |
1616
| <a name="provider_time"></a> [time](#provider\_time) | 0.11.1 |
1717

1818
## Modules

‎aws-observability-terraform/app-modules/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
|------|---------|
55
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.0 |
66
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 2.1 |
7-
| <a name="requirement_sumologic"></a> [sumologic](#requirement\_sumologic) | >= 2.28.3, < 3.0.0 |
7+
| <a name="requirement_sumologic"></a> [sumologic](#requirement\_sumologic) | >= 2.31.0, < 3.0.0 |
88

99
## Providers
1010

1111
| Name | Version |
1212
|------|---------|
13-
| <a name="provider_sumologic"></a> [sumologic](#provider\_sumologic) | >= 2.28.3, < 3.0.0 |
13+
| <a name="provider_sumologic"></a> [sumologic](#provider\_sumologic) | >= 2.31.0, < 3.0.0 |
1414
| <a name="provider_time"></a> [time](#provider\_time) | n/a |
1515

1616
## Modules

‎aws-observability-terraform/app-modules/rds/app.tf‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -519,6 +519,74 @@ module "rds_module" {
519519
group_notifications = var.group_notifications
520520
connection_notifications = var.connection_notifications
521521
email_notifications = var.email_notifications
522+
},
523+
"RdsMSSQLHighAuthFailureByClientIPsOnDB" = {
524+
monitor_name = "Amazon RDS MSSQL - Database observing authentication failures from multiple client IPs"
525+
monitor_description = "This alert fires when we detect more than or equal to 10 client IPs attempting authentication failures on the database over a 15-minute period."
526+
monitor_monitor_type = "Logs"
527+
monitor_parent_id = var.monitor_folder_id
528+
monitor_is_disabled = var.monitors_disabled
529+
monitor_evaluation_delay = "0m"
530+
queries = {
531+
A = "account=* region=* namespace=aws/rds dbidentifier=* _sourceHost=/aws/rds/*Error Logon Login failed for user\n| json \"message\" nodrop | if (_raw matches \"{*\", message, _raw) as message\n| parse field=message \"* Logon Login failed for user '*'. Reason: * [CLIENT: *]\" as time, user, reason, client_ip\n| count_distinct(client_ip) as unique_client_ip by dbidentifier\n| 10 as threshold\n| where unique_client_ip >= threshold\n| sort by unique_client_ip\n| fields - threshold"
532+
}
533+
triggers = [
534+
{
535+
detection_method = "LogsStaticCondition",
536+
time_range = "-15m",
537+
trigger_type = "Critical",
538+
threshold = 1,
539+
threshold_type = "GreaterThanOrEqual",
540+
occurrence_type = "ResultCount",
541+
trigger_source = "AllResults"
542+
},
543+
{
544+
detection_method = "LogsStaticCondition",
545+
time_range = "-15m",
546+
trigger_type = "ResolvedCritical",
547+
threshold = 1,
548+
threshold_type = "LessThan",
549+
occurrence_type = "ResultCount",
550+
trigger_source = "AllResults"
551+
}
552+
]
553+
group_notifications = var.group_notifications
554+
connection_notifications = var.connection_notifications
555+
email_notifications = var.email_notifications
556+
},
557+
"RdsMSSQLHighAuthFailureByClientIPOnDBs" = {
558+
monitor_name = "Amazon RDS MSSQL - Authentication failures from the same client IP on multiple databases"
559+
monitor_description = "This alert fires when we detect specific client IP attempting authentication failures on more than or equal to 10 databases over a 15 minute time-period."
560+
monitor_monitor_type = "Logs"
561+
monitor_parent_id = var.monitor_folder_id
562+
monitor_is_disabled = var.monitors_disabled
563+
monitor_evaluation_delay = "0m"
564+
queries = {
565+
A = "account=* region=* namespace=aws/rds dbidentifier=* _sourceHost=/aws/rds/*Error Logon Login failed for user\n| json \"message\" nodrop | if (_raw matches \"{*\", message, _raw) as message\n| parse field=message \"* Logon Login failed for user '*'. Reason: * [CLIENT: *]\" as time, user, reason, client_ip\n| count_distinct(dbidentifier) as unique_db by client_ip\n| 10 as threshold\n| where unique_db >= threshold\n| sort by unique_db, client_ip asc\n| fields - threshold"
566+
}
567+
triggers = [
568+
{
569+
detection_method = "LogsStaticCondition",
570+
time_range = "-15m",
571+
trigger_type = "Critical",
572+
threshold = 1,
573+
threshold_type = "GreaterThanOrEqual",
574+
occurrence_type = "ResultCount",
575+
trigger_source = "AllResults"
576+
},
577+
{
578+
detection_method = "LogsStaticCondition",
579+
time_range = "-15m",
580+
trigger_type = "ResolvedCritical",
581+
threshold = 1,
582+
threshold_type = "LessThan",
583+
occurrence_type = "ResultCount",
584+
trigger_source = "AllResults"
585+
}
586+
]
587+
group_notifications = var.group_notifications
588+
connection_notifications = var.connection_notifications
589+
email_notifications = var.email_notifications
522590
}
523591
}
524592
}

‎aws-observability-terraform/app-modules/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ terraform {
77
version = ">= 2.1"
88
}
99
sumologic = {
10-
version = ">= 2.28.3, < 3.0.0"
10+
version = ">= 2.31.0, < 3.0.0"
1111
source = "SumoLogic/sumologic"
1212
}
1313
}

‎aws-observability-terraform/cloudformation-module/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ terraform {
99
version = "~> 2.1"
1010
}
1111
sumologic = {
12-
version = "~> 2.6.2"
12+
version = ">= 2.31.0, < 3.0.0"
1313
source = "SumoLogic/sumologic"
1414
}
1515
}

‎aws-observability-terraform/examples/appmodule/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,14 @@
55
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.0 |
66
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.42.0, < 4.0.0 |
77
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 3.1.0 |
8-
| <a name="requirement_sumologic"></a> [sumologic](#requirement\_sumologic) | >= 2.28.3, < 3.0.0 |
8+
| <a name="requirement_sumologic"></a> [sumologic](#requirement\_sumologic) | >= 2.31.0, < 3.0.0 |
99
| <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.11.1 |
1010

1111
## Providers
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_sumologic"></a> [sumologic](#provider\_sumologic) | >= 2.28.3, < 3.0.0 |
15+
| <a name="provider_sumologic"></a> [sumologic](#provider\_sumologic) | >= 2.31.0, < 3.0.0 |
1616
| <a name="provider_time"></a> [time](#provider\_time) | >= 0.11.1 |
1717

1818
## Modules

‎aws-observability-terraform/examples/appmodule/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ terraform {
77
version = ">= 5.16.2, < 6.0.0"
88
}
99
sumologic = {
10-
version = ">= 2.28.3, < 3.0.0"
10+
version = ">= 2.31.0, < 3.0.0"
1111
source = "SumoLogic/sumologic"
1212
}
1313
time = {

‎aws-observability-terraform/examples/sourcemodule/overrideSources/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,14 @@
55
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.0 |
66
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.42.0, < 4.0.0 |
77
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 3.1.0 |
8-
| <a name="requirement_sumologic"></a> [sumologic](#requirement\_sumologic) | >= 2.28.3, < 3.0.0 |
8+
| <a name="requirement_sumologic"></a> [sumologic](#requirement\_sumologic) | >= 2.31.0, < 3.0.0 |
99
| <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.11.1 |
1010

1111
## Providers
1212

1313
| Name | Version |
1414
|------|---------|
15-
| <a name="provider_sumologic"></a> [sumologic](#provider\_sumologic) | >= 2.28.3, < 3.0.0 |
15+
| <a name="provider_sumologic"></a> [sumologic](#provider\_sumologic) | >= 2.31.0, < 3.0.0 |
1616
| <a name="provider_time"></a> [time](#provider\_time) | >= 0.11.1 |
1717

1818
## Modules

‎aws-observability-terraform/examples/sourcemodule/overrideSources/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ terraform {
77
version = ">= 5.16.2, < 6.0.0"
88
}
99
sumologic = {
10-
version = ">= 2.28.3, < 3.0.0"
10+
version = ">= 2.31.0, < 3.0.0"
1111
source = "SumoLogic/sumologic"
1212
}
1313
time = {

0 commit comments

Comments
 (0)