Skip to content

Commit f0b2fa1

Browse files
author
awstools
committed
feat(client-cloudwatch-logs): Added CloudWatch Logs Transformer support for converting CloudTrail, VPC Flow, EKS Audit, AWS WAF and Route53 Resolver logs to OCSF v1.1 format.
1 parent 864dcb0 commit f0b2fa1

File tree

7 files changed

+180
-15
lines changed

7 files changed

+180
-15
lines changed

‎clients/client-cloudwatch-logs/src/commands/GetTransformerCommand.ts‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,11 @@ export interface GetTransformerCommandOutput extends GetTransformerResponse, __M
135135
* // parseRoute53: { // ParseRoute53
136136
* // source: "STRING_VALUE",
137137
* // },
138+
* // parseToOCSF: { // ParseToOCSF
139+
* // source: "STRING_VALUE",
140+
* // eventSource: "CloudTrail" || "Route53Resolver" || "VPCFlow" || "EKSAudit" || "AWSWAF", // required
141+
* // ocsfVersion: "V1.1", // required
142+
* // },
138143
* // parsePostgres: { // ParsePostgres
139144
* // source: "STRING_VALUE",
140145
* // },

‎clients/client-cloudwatch-logs/src/commands/PutLogEventsCommand.ts‎

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -43,12 +43,10 @@ export interface PutLogEventsCommandOutput extends PutLogEventsResponse, __Metad
4343
* all event messages in UTF-8, plus 26 bytes for each log event.</p>
4444
* </li>
4545
* <li>
46-
* <p>None of the log events in the batch can be more than 2 hours in the future.</p>
46+
* <p>Events more than 2 hours in the future are rejected while processing remaining valid events.</p>
4747
* </li>
4848
* <li>
49-
* <p>None of the log events in the batch can be more than 14 days in the past. Also,
50-
* none of the log events can be from earlier than the retention period of the log
51-
* group.</p>
49+
* <p>Events older than 14 days or preceding the log group's retention period are rejected while processing remaining valid events.</p>
5250
* </li>
5351
* <li>
5452
* <p>The log events in the batch must be in chronological order by their timestamp. The
@@ -58,7 +56,7 @@ export interface PutLogEventsCommandOutput extends PutLogEventsResponse, __Metad
5856
* <code>yyyy-mm-ddThh:mm:ss</code>. For example, <code>2017-09-15T13:45:30</code>.) </p>
5957
* </li>
6058
* <li>
61-
* <p>A batch of log events in a single request cannot span more than 24 hours. Otherwise, the operation fails.</p>
59+
* <p> A batch of log events in a single request must be in a chronological order. Otherwise, the operation fails.</p>
6260
* </li>
6361
* <li>
6462
* <p>Each log event can be no larger than 1 MB.</p>
@@ -67,14 +65,15 @@ export interface PutLogEventsCommandOutput extends PutLogEventsResponse, __Metad
6765
* <p>The maximum number of log events in a batch is 10,000.</p>
6866
* </li>
6967
* <li>
70-
* <important>
71-
* <p>The quota of five requests per second per log stream
72-
* has been removed. Instead, <code>PutLogEvents</code> actions are throttled based on a
73-
* per-second per-account quota. You can request an increase to the per-second throttling
74-
* quota by using the Service Quotas service.</p>
75-
* </important>
68+
* <p>For valid events (within 14 days in the past to 2 hours in future), the time span in a single batch cannot exceed 24 hours. Otherwise, the operation fails.</p>
7669
* </li>
7770
* </ul>
71+
* <important>
72+
* <p>The quota of five requests per second per log stream
73+
* has been removed. Instead, <code>PutLogEvents</code> actions are throttled based on a
74+
* per-second per-account quota. You can request an increase to the per-second throttling
75+
* quota by using the Service Quotas service.</p>
76+
* </important>
7877
* <p>If a call to <code>PutLogEvents</code> returns "UnrecognizedClientException" the most
7978
* likely cause is a non-valid Amazon Web Services access key ID or secret key. </p>
8079
* @example

‎clients/client-cloudwatch-logs/src/commands/PutTransformerCommand.ts‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,11 @@ export interface PutTransformerCommandOutput extends __MetadataBearer {}
145145
* parseRoute53: { // ParseRoute53
146146
* source: "STRING_VALUE",
147147
* },
148+
* parseToOCSF: { // ParseToOCSF
149+
* source: "STRING_VALUE",
150+
* eventSource: "CloudTrail" || "Route53Resolver" || "VPCFlow" || "EKSAudit" || "AWSWAF", // required
151+
* ocsfVersion: "V1.1", // required
152+
* },
148153
* parsePostgres: { // ParsePostgres
149154
* source: "STRING_VALUE",
150155
* },

‎clients/client-cloudwatch-logs/src/commands/TestTransformerCommand.ts‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,11 @@ export interface TestTransformerCommandOutput extends TestTransformerResponse, _
126126
* parseRoute53: { // ParseRoute53
127127
* source: "STRING_VALUE",
128128
* },
129+
* parseToOCSF: { // ParseToOCSF
130+
* source: "STRING_VALUE",
131+
* eventSource: "CloudTrail" || "Route53Resolver" || "VPCFlow" || "EKSAudit" || "AWSWAF", // required
132+
* ocsfVersion: "V1.1", // required
133+
* },
129134
* parsePostgres: { // ParsePostgres
130135
* source: "STRING_VALUE",
131136
* },

‎clients/client-cloudwatch-logs/src/models/models_0.ts‎

Lines changed: 68 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3649,6 +3649,23 @@ export const EntityRejectionErrorType = {
36493649
*/
36503650
export type EntityRejectionErrorType = (typeof EntityRejectionErrorType)[keyof typeof EntityRejectionErrorType];
36513651

3652+
/**
3653+
* @public
3654+
* @enum
3655+
*/
3656+
export const EventSource = {
3657+
AWSWAF: "AWSWAF",
3658+
CLOUD_TRAIL: "CloudTrail",
3659+
EKS_AUDIT: "EKSAudit",
3660+
ROUTE53_RESOLVER: "Route53Resolver",
3661+
VPC_FLOW: "VPCFlow",
3662+
} as const;
3663+
3664+
/**
3665+
* @public
3666+
*/
3667+
export type EventSource = (typeof EventSource)[keyof typeof EventSource];
3668+
36523669
/**
36533670
* <p>Represents a matched event.</p>
36543671
* @public
@@ -5123,6 +5140,45 @@ export interface ParseRoute53 {
51235140
source?: string | undefined;
51245141
}
51255142

5143+
/**
5144+
* @public
5145+
* @enum
5146+
*/
5147+
export const OCSFVersion = {
5148+
V1_1: "V1.1",
5149+
} as const;
5150+
5151+
/**
5152+
* @public
5153+
*/
5154+
export type OCSFVersion = (typeof OCSFVersion)[keyof typeof OCSFVersion];
5155+
5156+
/**
5157+
* <p>This processor converts logs into <a href="https://ocsf.io">Open Cybersecurity Schema Framework (OCSF)</a> events.</p>
5158+
* <p>For more information about this processor including examples, see <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseToOCSF">
5159+
* parseToOSCF</a> in the <i>CloudWatch Logs User Guide</i>.</p>
5160+
* @public
5161+
*/
5162+
export interface ParseToOCSF {
5163+
/**
5164+
* <p>The path to the field in the log event that you want to parse. If you omit this value, the whole log message is parsed.</p>
5165+
* @public
5166+
*/
5167+
source?: string | undefined;
5168+
5169+
/**
5170+
* <p>Specify the service or process that produces the log events that will be converted with this processor.</p>
5171+
* @public
5172+
*/
5173+
eventSource: EventSource | undefined;
5174+
5175+
/**
5176+
* <p>Specify which version of the OCSF schema to use for the transformed log events.</p>
5177+
* @public
5178+
*/
5179+
ocsfVersion: OCSFVersion | undefined;
5180+
}
5181+
51265182
/**
51275183
* <p>Use this processor to parse Amazon VPC vended logs, extract fields, and and convert them into a JSON format. This processor always
51285184
* processes the entire log event message.</p>
@@ -5459,6 +5515,12 @@ export interface Processor {
54595515
*/
54605516
parseRoute53?: ParseRoute53 | undefined;
54615517

5518+
/**
5519+
* <p>Use this processor to convert logs into Open Cybersecurity Schema Framework (OCSF) format</p>
5520+
* @public
5521+
*/
5522+
parseToOCSF?: ParseToOCSF | undefined;
5523+
54625524
/**
54635525
* <p>Use this parameter to include the <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parsePostGres">
54645526
* parsePostGres</a> processor in your transformer.</p>
@@ -6447,6 +6509,10 @@ export interface PutDeliverySourceRequest {
64476509
* <code>AD_DECISION_SERVER_LOGS</code>, <code>MANIFEST_SERVICE_LOGS</code>, and <code>TRANSCODE_LOGS</code>.</p>
64486510
* </li>
64496511
* <li>
6512+
* <p>For Entity Resolution, the valid value is
6513+
* <code>WORKFLOW_LOGS</code>.</p>
6514+
* </li>
6515+
* <li>
64506516
* <p>For IAM Identity Center, the valid value is
64516517
* <code>ERROR_LOGS</code>.</p>
64526518
* </li>
@@ -6455,8 +6521,8 @@ export interface PutDeliverySourceRequest {
64556521
* <code>EVENT_LOGS</code>.</p>
64566522
* </li>
64576523
* <li>
6458-
* <p>For Amazon SES mail manager, the valid value is
6459-
* <code>APPLICATION_LOG</code>.</p>
6524+
* <p>For Amazon SES mail manager, the valid values are
6525+
* <code>APPLICATION_LOG</code> and <code>TRAFFIC_POLICY_DEBUG_LOGS</code>.</p>
64606526
* </li>
64616527
* <li>
64626528
* <p>For Amazon WorkMail, the valid values are

‎clients/client-cloudwatch-logs/src/protocols/Aws_json1_1.ts‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -328,6 +328,7 @@ import {
328328
ParseKeyValue,
329329
ParsePostgres,
330330
ParseRoute53,
331+
ParseToOCSF,
331332
ParseVPC,
332333
ParseWAF,
333334
Processor,
@@ -3935,6 +3936,8 @@ const se_MetricTransformations = (input: MetricTransformation[], context: __Serd
39353936

39363937
// se_ParseRoute53 omitted.
39373938

3939+
// se_ParseToOCSF omitted.
3940+
39383941
// se_ParseVPC omitted.
39393942

39403943
// se_ParseWAF omitted.
@@ -4441,6 +4444,8 @@ const de_MetricTransformations = (output: any, context: __SerdeContext): MetricT
44414444

44424445
// de_ParseRoute53 omitted.
44434446

4447+
// de_ParseToOCSF omitted.
4448+
44444449
// de_ParseVPC omitted.
44454450

44464451
// de_ParseWAF omitted.

0 commit comments

Comments
 (0)