AWS VPC Flow Logs Integration Guide

cloud integrations amazon aws vpc

The following instructions are for configuring an AWS VPC Flow Logs integration to facilitate log ingestion into Secureworks® Taegis™ XDR.

Prerequisites ⫘

• AWS VPC Flow Logs must be enabled for your environment with a logging destination of S3.
• The following should be done in the same AWS region as your AWS VPC Flow Logs bucket.

• Logs should be configured using the default format or the Select All format for all version 5 fields. Other custom formats will fail to normalize correctly. Users can reference the AWS VPC Flow Log Userguide for the current default format. Utilizing all fields is recommended as it includes additional information that may be used by investigations and detections.

  • Default fields:

  ${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status}

  • Select All fields:

  ${account-id} ${action} ${az-id} ${bytes} ${dstaddr} ${dstport} ${end} ${flow-direction} ${instance-id} ${interface-id} ${log-status} ${packets} ${pkt-dst-aws-service} ${pkt-dstaddr} ${pkt-src-aws-service} ${pkt-srcaddr} ${protocol} ${region} ${srcaddr} ${srcport} ${start} ${sublocation-id} ${sublocation-type} ${subnet-id} ${tcp-flags} ${traffic-path} ${type} ${version} ${vpc-id}

Data Provided from Integrations ⫘

	Antivirus	Auth	CloudAudit	DHCP	DNS	Email	Encrypt	HTTP	Management	Netflow	NIDS	Thirdparty
AWS VPC Flow Logs										D

Y = Normalized | D = Out-of-the-Box Detections | V = Vendor-Specific Detections

Set Up AWS VPC Flow Logs ⫘

1. From the XDR left-hand side navigation, select Integrations → Cloud APIs → Add API Integration.
2. Choose Set Up AWS Integrations and then select Setup under Amazon VPC Flow Logs.

Set up AWS VPC Flow Logs Integration

3. Select Download CloudFormation Shared Resources and save it as taegis-cloudformation-shared-resources.yaml.
4. Select Download CloudFormation Lambda Template and save it as taegis-cloudformation-lambda-template.yaml.
5. Select Download Lambda; the file should be named taegis-lambda-amd64.zip.
6. Select Download Credentials.
7. Select Create after you have downloaded all files.

Upload the Lambda Executable and CloudFormation Templates to S3 ⫘

1. Log in to the AWS Console for the region (e.g., https://us-east-1.console.aws.amazon.com/cloudformation) with an account that has permissions to create roles, lambdas, secrets, and policies, or using a role that can assume another role with these permissions.
2. In the Storage section, select S3.
3. Create a new bucket or locate an existing bucket in which to store the Lambda executable and, optionally, the CloudFormation templates. The bucket does not need to be public, versioned, or encrypted.
4. Upload the Lambda taegis-lambda-amd64.zip to the root of the bucket and take note of the bucket name.
5. Optionally upload taegis-cloudformation-shared-resources.yaml and taegis-cloudformation-lambda-template.yaml to the same bucket.

Create a Shared Resources Stack in Each AWS Region That Will Contain a Lambda Deployment ⫘

1. Log in to the AWS Console for the region (e.g., https://us-east-1.console.aws.amazon.com/cloudformation) with an account that has permissions to create roles, lambdas, secrets, and policies, or using a role that can assume another role with these permissions.
2. In the Management and Governance section, select CloudFormation.
3. Select the Create Stack button to create a new stack using the taegis-cloudformation-shared-resources.yaml template provided.

Create New Stack

4. From the Prepare Template section, choose Template is ready.
5. From the Specify Template section, choose Amazon S3 URL OR choose Upload a template file.

6. If you choose Amazon S3 URL, input the CloudFormation object URL gathered previously into the Amazon S3 URL field. For example, https://cwl-poc.s3.amazonaws.com/taegis-cloudformation-shared-resources.yaml.

7. Select Next.

8. Enter an appropriate stack name.

9. Enter the contents of the credentials.txt file into the SecretValue field.
10. Select the correct TaegisRegion based off of your XDR login URL; for example, select ctpx if you use https://ctpx.secureworks.com/login or foxtrot if you use https://foxtrot.taegis.secureworks.com/.
11. Select Next.
12. On the Configure stack options page, the default selections and values can be accepted. Select Next.
13. On the Review and create page, Select Submit.

Create the Lambda Stack ⫘

1. Log in to the AWS Console for the region (e.g., https://us-east-1.console.aws.amazon.com/cloudformation) with an account that has permissions to create roles, lambdas, secrets, and policies, or using a role that can assume another role with these permissions.
2. In the Management and Governance section, select CloudFormation.
3. Select the Create Stack button.

Create New Stack

4. From the Prepare Template section, choose Template is ready.
5. From the Specify Template section, choose Amazon S3 URL OR choose Upload a template file.

6. If you choose Amazon S3 URL, input the CloudFormation object URL gathered previously into the Amazon S3 URL field. For example: https://cwl-poc.s3.amazonaws.com/taegis-cloudformation-lambda-template.yaml.

7. Select Next.

8. Enter an appropriate stack name.

9. Select IntegrationType from the dropdown. This describes what sort of log objects are in the NotificationBucket. If more than one type, or you are not sure, select generic.

Update Lambda Stack Integration Type

10. In the field NotificationBucket, enter the bucket name, not a URL or URI, that houses the VPC Logs.
11. (Optional) Enter the appropriate value into the SNSNotificationarn field if you wish to use SNS notifications going forward instead of S3 notifications.
12. (Optional) Enter the appropriate value into the NotificationBucketCustomerManagedKMSarn if you wish to add the KMS key ARN that may be encrypting the objects in the NotificationBucket. The KMS key policy must have Enable IAM User Permissions. If not, the Lambda ARN can be added to your KMS key.
13. The field TeagisLambdaS3BucketName should be the name of the S3 bucket that contains the Lambda that was previously uploaded.
14. The field LambdaEnvKMSarn can be left empty. If populated, the KMS key must have Enable IAM User Permissions.
15. The remaining fields can be left at their defaults.
16. Select Next.

Complete Remaining Stack Options ⫘

17. The configure stack options page is optional.
18. Select Next.
19. Review all parameters. Make sure that all fields you have specified from Step 9 through Step 15 have a valid value.

Review Lambda Parameters

20. Select the I acknowledge that AWS CloudFormation might create IAM resources checkbox and choose Submit.
21. Wait at least 30 seconds and then select the refresh button. The process may take a minute or more to finish. A status of CREATE_COMPLETE for the stack indicates the process has finished. Discard the credential.txt file containing the client_id and client_secret downloaded in the Set Up AWS CloudTrail section. These values are now stored in the AWS SecretsManager.

Add the Lambda Trigger ⫘

22. In the AWS console, switch to the Lambda service.
23. Locate the new Lambda by name. The default name is {STACKNAME}-scwx-tdr-lambda-{INTEGRATIONTYPE}. For example: ct-demo-scwx-tdr-lambda-awscloudtrail.
24. Select the Lambda name. The edit page for that Lambda displays.
25. Expand the Function overview section and choose Add Trigger.
26. In the Trigger Configuration editor, select the drop down menu and choose S3. Optionally, use an SNS trigger configured with a previously created topic.
27. From the Bucket options, find the bucket containing the VPC logs and select it.
28. From the Event Type options, choose All Object Create Events.
29. In the prefix field, enter the bucket prefix where the VPC logs are located. Leave this blank if no prefix is used.
30. Leave the suffix field blank.
31. Check the following box to acknowledge the cost impact of a lambda function.
32. Choose Add. The configuration page for that lambda displays again. A message displays at the top indicating adding a trigger was successful; for example, "The trigger wmikeking-VPC was successfully added to function VPC-Logs-TDR-Upload".
33. The function is now receiving events from the trigger.

Verification Steps ⫘

34. Verify Lambda Runtime settings. The Runtime value should be Custom runtime on Amazon Linux 2.

Verify Lambda Runtime Settings

34. See Test AWS Lambda Logs to verify that the AWS Lambda function for your integration is working by configuring a test for it in the AWS Console.

35. In the AWS console, go to the Lambda function that was installed. If there is an error, select Fix errors.

Fix Lambda Errors

36. See View AWS Lambda Logs to view logs generated by your AWS Lambda functions and verify successful uploads. This verifies the trigger is working, on the assumption there is new S3 data being published to the bucket.

{"level":"debug","time":"2023-11-15T19:27:19Z","message":"Uploading data to s3"}

Download Existing Integration Setup Files ⫘

If you need to add your CloudTrail integration to many regions or completely redo the integration, you can download the existing set of integration files including the templates, Lambda, and credentials files at any time:

1. In the XDR left-hand side navigation, navigate to Integrations → Cloud APIs.
2. From the Cloud API Integrations table, click the download icon from the Actions column in the row of the integration you want to redo/modify.
3. Select the Download Integration icon. The Download panel appears.

Download Existing Integration Files

4. Download any needed files.

Related Topics ⫘