Configure data collection from Amazon S3 manually

Collect data from Amazon S3 manually in Cortex Cloud.

There are various reasons why you may need to configure data collection from Amazon S3 manually, as opposed to using the CloudFormation Script provided in Cortex Cloud. For example, if your organization does not use CloudFormation scripts, you will need to follow the instructions below, which explain at a high-level how to perform these steps manually with a link to the relevant topic in the Amazon S3 documentation with the detailed steps to follow.

As soon as Cortex Cloud begins receiving logs, the app automatically creates an Amazon S3 Cortex Query Language (XQL) dataset (aws_s3_raw). This enables you to search the logs with XQL Search using the dataset. For example queries, refer to the in-app XQL Library. For enhanced cloud protection, you can also configure Cortex Cloud to ingest network flow logs as Cortex Cloud network connection stories, which you can query with XQL Search using the xdr_dataset dataset with the preset called network_story. Cortex Cloud can also generate Cortex Cloud issues (Analytics, Correlations, IOC, and BIOC) when relevant from Amazon S3 logs. While Correlation Rules issues are generated on non-normalized and normalized logs, Analytics, IOC, and BIOC issues are only generated on normalized logs.

Enhanced cloud protection provides:

• Normalization of cloud logs
• Cloud logs stitching
• Enrichment with cloud data
• Detection based on cloud analytics
• Cloud-tailored investigations

Be sure you do the following tasks before you begin configuring data collection manually from Amazon CloudWatch to Amazon S3.

Note: If you already have an Amazon S3 bucket configured with VPC flow logs that you want to use for this configuration, you do not need to perform the prerequisite steps detailed in the first two bullets.

• Ensure that you have at a minimum the following permissions in AWS for an Amazon S3 bucket and Amazon Simple Queue Service (SQS).

  • Amazon S3 bucket: GetObject
  • SQS: ChangeMessageVisibility, ReceiveMessage, GetQueueAttributes, and DeleteMessage.
• Create a dedicated Amazon S3 bucket for collecting network flow logs with the default settings. For more information, see Creating a bucket using the Amazon S3 Console. ### Note It is your responsibility to define a retention policy for your Amazon S3 bucket by creating a Lifecycle rule in the Management tab. We recommend setting the retention policy to at least 7 days to ensure that the data is retrieved under all circumstances.
• Ensure that you can access your Amazon Virtual Private Cloud (VPC) and have the necessary permissions to create flow logs.
• Determine how you want to provide access to Cortex Cloud to your logs and perform API operations. You have the following options.

  • Use Workload Federated Identity to allow Cortex Cloud's dedicated log collector service account to assume an IAM role in your AWS environment using a short-lived OIDC token, without storing any long-lived credentials. This is the Workload Federated Identity option in the Amazon S3 collection configuration and is the recommended option when available.
  • Designate an AWS IAM user, where you will need to know the Account ID for the user and have the relevant permissions to create an access key/id for the relevant IAM user. This is the default option as explained in Configure the Amazon S3 collection by selecting Access Key.
  • Create an assumed role in AWS to delegate permissions to a Cortex Cloud AWS service. This role grants Cortex Cloud access to your flow logs. For more information, see Creating a role to delegate permissions to an AWS service. This is the Assumed Role option as described in the Configure the Amazon S3 collection. For more information on creating an assumed role for Cortex Cloud , see Create an assumed role. To collect Amazon S3 logs that use server-side encryption (SSE), the user role must have an IAM policy that states that Cortex Cloud has kms:Decrypt permissions. With this permission, Amazon S3 automatically detects if a bucket is encrypted and decrypts it. If you want to collect encrypted logs from different accounts, you must have the decrypt permissions for the user role also in the key policy for the master account Key Management Service (KMS). For more information, see Allowing users in other accounts to use a KMS key.
• If using Workload Federated Identity, ensure you have permissions to create an AWS IAM Identity Provider and an IAM role with a trust policy in your AWS account. You will need the Cortex Cloud service account identifier (provided in the Cortex Cloud UI after saving the configuration) to configure the trust relationship.

Note: For resources such as Amazon S3, SQS, VPC flow logs, and event notifications, you may use the default configurations; yet, these settings remain fully customizable to meet your specific environment requirements.

Configure Cortex Cloud to receive network flow logs from Amazon S3 manually.

1. Log in to the AWS Management Console.
2. From the menu bar, ensure that you have selected the correct region for your configuration.
3. Configure your Amazon Virtual Private Cloud (VPC) with flow logs. For more information, see AWS VPC Flow Logs.

   If you already have an Amazon S3 bucket configured with VPC flow logs, skip this step and go to Configure an Amazon Simple Queue Service (SQS).
4. Configure an Amazon Simple Queue Service (SQS). For more information, see Configuring Amazon SQS queues (console).

   Ensure that you create your Amazon S3 bucket and Amazon SQS queue in the same region.
5. Configure an event notification to your Amazon SQS whenever a file is written to your Amazon S3 bucket. For more information, see Amazon S3 Event Notifications.
6. Configure access keys for the AWS IAM user that Cortex Cloud uses for API operations. For more information, see Managing access keys for IAM users.

   • It is the responsibility of the customer’s organization to ensure that the user who performs this task of creating the access key is designated with the relevant permissions. Otherwise, this can cause the process to fail with errors.
   • Skip this step if you are using an Assumed Role or Workload Federated Identity for Cortex Cloud.
7. Update the Access Policy of your SQS queue and grant the required permissions mentioned above to the relevant IAM user. For more information, see Granting permissions to publish event notification messages to a destination.

   Skip this step if you are using an Assumed Role or Workload Federated Identity for Cortex Cloud.
8. Configure the Amazon S3 collection in Cortex Cloud.

   1. Navigate to Settings → Data Sources & Integrations.
   2. On the Data Sources & Integrations page, click + Add New, search for Amazon S3, then hover over it and click Add.
   3. Select the authentication method you configured and enter the following values:

Workload Federated Identity

Delegates permissions to a Cortex Cloud AWS service using an IAM assumed role. For more information, see Creating a role to delegate permissions to an AWS service.

Field	Input
SQS URL	Specify the SQS URL, which is the URL of the Amazon SQS that you configured in the AWS Management Console.
Name	Specify a descriptive name for your log collection configuration.
Role ARN	Specify the ARN of the IAM role that Cortex Cloud's log collector will assume. This role must have a trust policy that allows Cortex Cloud's service account to assume it.
Audience	Specify the OIDC audience value configured in your AWS IAM identity provider trust policy. This value scopes the OIDC token to your specific AWS environment.
Log Type	Select Flow Logs to configure your log collection to receive network flow logs from Amazon S3.

Click Copy Identifier to copy the Cortex Cloud service account identifier. Add this identifier to the trust policy of the IAM role in AWS to authorize Cortex Cloud's log collector to assume the role.

Access Key

Uses a designated AWS IAM user's static access key and secret to authenticate.

Field	Input
SQS URL	Specify the SQS URL, which is the URL of the Amazon SQS that you configured in the AWS Management Console.
Name	Specify a descriptive name for your log collection configuration.
AWS Client ID	Specify the Access key ID, which you received when you configured access keys for the AWS IAM user in AWS.
AWS Client Secret	Specify the Secret access key you received when you configured access keys for the AWS IAM user in AWS.
Log Type	Select Flow Logs to configure your log collection to receive network flow logs from Amazon S3.

Assumed Role

Delegates permissions to a Cortex Cloud AWS service using an IAM assumed role. For more information, see Creating a role to delegate permissions to an AWS service.

Field	Input
SQS URL	Specify the SQS URL, which is the URL of the Amazon SQS that you configured in the AWS Management Console.
Name	Specify a descriptive name for your log collection configuration.
Role ARN	Specify the Role ARN for the Assumed Role you created in AWS.
External ID	Specify the External ID for the Assumed Role you created in AWS.
Log Type	Select Flow Logs to configure your log collection to receive network flow logs from Amazon S3.

1. Click Test to validate access, and then click Enable.

Once events start to come in, a green check mark appears underneath the Amazon S3 configuration with the number of logs received.