 |
In November 2013, we introduced AWS CloudTrail to trace consumer exercise and API utilization. AWS CloudTrail allows auditing, safety monitoring, and operational troubleshooting. CloudTrail information consumer exercise and API calls throughout AWS companies as occasions. CloudTrail occasions enable you reply the questions of “who did what, the place, and when?”.
Lately we now have improved the power so that you can simplify your auditing and safety evaluation through the use of AWS CloudTrail Lake. CloudTrail Lake is a managed information lake for capturing, storing, accessing, and analyzing consumer and API exercise on AWS for audit, safety, and operational functions. You possibly can mixture and immutably retailer your exercise occasions, and run SQL-based queries for search and evaluation.
Now we have heard your suggestions that aggregating exercise info from numerous purposes throughout hybrid environments is complicated and expensive, however essential for a complete image of your group’s safety and compliance posture.
Right now we’re saying help of ingestion for exercise occasions from non-AWS sources utilizing CloudTrail Lake, making it a single location of immutable consumer and API exercise occasions for auditing and safety investigations. Now you’ll be able to consolidate, immutably retailer, search, and analyze exercise occasions from AWS and non-AWS sources, reminiscent of in-house or SaaS purposes, in a single place.
Utilizing the brand new PutAuditEvents API in CloudTrail Lake, you’ll be able to centralize consumer exercise info from disparate sources into CloudTrail Lake, enabling you to research, troubleshoot and diagnose points utilizing this information. CloudTrail Lake information all occasions in standardized schema, making it simpler for customers to eat this info to comprehensively and shortly reply to safety incidents or audit requests.
CloudTrail Lake can be built-in with chosen AWS Companions, reminiscent of Cloud Storage Safety, Clumio, CrowdStrike, CyberArk, GitHub, Kong Inc, LaunchDarkly, MontyCloud, Netskope, Nordcloud, Okta, One Id, Shoreline.io, Snyk, and Wiz, permitting you to simply allow audit logging by way of the CloudTrail console.
Getting Began to Combine Exterior Sources
You can begin to ingest exercise occasions from your personal information sources or accomplice purposes by selecting Integrations underneath the Lake menu within the AWS CloudTrail console.
To create a brand new integration, select Add integration and enter your channel title. You possibly can select the accomplice software supply from which you need to get occasions. When you’re integrating with occasions from your personal purposes hosted on-premises or within the cloud, select My customized integration.
For Occasion supply location, you’ll be able to select locations in your occasions from this integration. This permits your software or companions to ship occasions to your occasion information retailer of CloudTrail Lake. An occasion information retailer can retain your exercise occasions for per week to as much as seven years. Then you’ll be able to run queries on the occasion information retailer.
Select both Use present occasion information shops or Create new occasion information retailer—to obtain occasions from integrations. To be taught extra about occasion information retailer, see Create an occasion information retailer within the AWS documentation.
It’s also possible to arrange the permissions coverage for the channel useful resource created with this integration. The knowledge required for the coverage relies on the combination kind of every accomplice purposes.
There are two kinds of integrations: direct and answer. With direct integrations, the accomplice calls the PutAuditEvents API to ship occasions to the occasion information retailer in your AWS account. On this case, you should present Exterior ID, the distinctive account identifier offered by the accomplice. You possibly can see a hyperlink to accomplice web site for the step-by-step information. With answer integrations, the appliance runs in your AWS account and the appliance calls the PutAuditEvents API to ship occasions to the occasion information retailer in your AWS account.
To seek out the Integration kind in your accomplice, select the Accessible sources tab from the integrations web page.
After creating an integration, you’ll need to supply this Channel ARN to the supply or accomplice software. Till these steps are completed, the standing will stay as incomplete. As soon as CloudTrail Lake begins receiving occasions for the built-in accomplice or software, the standing subject shall be up to date to replicate the present state.
To ingest your software’s exercise occasions into your integration, name the PutAuditEvents API so as to add the payload of occasions. Make sure that there isn’t a delicate or personally figuring out info within the occasion payload earlier than ingesting it into CloudTrail Lake.
You can also make a JSON array of occasion objects, which features a required user-generated ID from the occasion, the required payload of the occasion as the worth of EventData, and an elective checksum to assist validate the integrity of the occasion after ingestion into CloudTrail Lake.
{
"AuditEvents": [
{
"Id": "event_ID",
"EventData": "{event_payload}", "EventDataChecksum": "optional_checksum",
},
... ]
}The next instance reveals the best way to use the put-audit-events AWS CLI command.
$ aws cloudtrail-data put-audit-events
--channel-arn $ChannelArn
--external-id $UniqueExternalIDFromPartner
--audit-events
{
"Id": "87f22433-0f1f-4a85-9664-d50a3545baef",
"EventData":"{"eventVersion": .01","eventSource":"MyCustomLog2", ...}",
},
{
"Id": "7e5966e7-a999-486d-b241-b33a1671aa74",
"EventData":"{"eventVersion": .02","eventSource":"MyCustomLog1", ...}",
"EventDataChecksum":"848df986e7dd61f3eadb3ae278e61272xxxx",
}On the Editor tab within the CloudTrail Lake, write your personal queries for a brand new built-in occasion information retailer to verify delivered occasions.
You can also make your personal integration question, like getting all principals throughout AWS and exterior assets which have made API calls after a selected date:
SELECT userIdentity.principalId FROM $AWS_EVENT_DATA_STORE_ID
WHERE eventTime > '2022-09-24 00:00:00'
UNION ALL
SELECT eventData.userIdentity.principalId FROM $PARTNER_EVENT_DATA_STORE_ID
WHRERE eventData.eventTime > '2022-09-24 00:00:00'To be taught extra, see CloudTrail Lake occasion schema and pattern queries that will help you get began.
Launch Companions
You possibly can see the checklist of our launch companions to help a CloudTrail Lake integration choice within the Accessible purposes tab. Listed below are weblog posts and bulletins from our companions who collaborated on this launch (some shall be added within the subsequent few days).
Now Accessible
AWS CloudTrail Lake now helps ingesting exercise occasions from exterior sources in all AWS Areas the place CloudTrail Lake is offered at this time. To be taught extra, see the AWS documentation and every accomplice’s getting began guides.
If you’re all in favour of turning into an AWS CloudTrail Companion, you’ll be able to contact your ordinary accomplice contacts.
– Channy
