VPC Flow logs via AWS

This article explains how to configure VPC flow logs and steps to configure Chronicle feed to ingest logs. 

Configure VPC flow logs

1. Open the Amazon VPC console and in the navigation pane, choose Your VPCs.
2. Select the checkboxes for one or more VPCs.

3. Choose Actions --> Create flow log and Configure the flow log settings

4. Select Destination based on the requirement, either Cloud watch or S3 Bucket.

Create a S3 bucket

1. Select Create new S3 bucket. You may also choose to use an existing S3 bucket.
2. Provide a name for AWS KMS alias or choose an existing AWS KMS Key.
3. Leave the other settings as default and click Next.
4. Choose Event type, add Data events as required, and click Next.
5. Review the settings in Review and create and click Create trail.
6. In the AWS console, search for "Amazon S3 Buckets."
7. Click the newly created log bucket and select the folder AWSLogs. Then click Copy S3 URI and save it for use in the following steps.

Configure Chronicle Feed to ingest logs

1. Go to Chronicle settings and click Feeds.
2. Click Add New.
3. Select Amazon S3 for Source Type.
4. Select AWS Cloudtrail (or other AWS service) for Log Type.
5. Click Next.
6. Select region and provide S3 URI of the Amazon S3 bucket you copied earlier. Further, you could append the S3 URI with:
   {{datetime("yyyy/MM/dd")}}
   As in the following example, so that Chronicle would scan logs each time only for a particular day:
   s3://aws-cloudtrail-logs-XXX-1234567/AWSLogs/1234567890/CloudTrail/us-east-1/{{datetime("yyyy/MM/dd")}}/
7. Under URI IS A, select Directories including subdirectories. Select an appropriate option under Source Deletion Option, this should match with the permissions of the IAM User account you created earlier.
8. Provide Access Key ID and Secret Access Key of the IAM User account you created earlier.
9. Click Next and Finish.

Below are the steps which involves feed addition to chronicle instance by NetEnrich

• S3 URI
• ACCESS KEY ID
• SECRET ACCESS KEY