Amazon Web Services (AWS)

Version: Amazon Web Services (AWS).

Amazon Web Services (AWS) is a collection of remote computing services (also called web services) that together make up a cloud computing platform, offered over the internet by Amazon.com.

Netsurion helps to monitor events from AWS using CloudTrail. This is achieved by creating some necessary reports, alerts, and dashboards.

Reports will contain a detailed overview of the activities like login/ logout, login failed, network interface activity, bucket activity, security group activity, and user management activities.

Alerts will be triggered when a critical security event is detected as login failed, user deleted, or network interface deleted.

The dashboard provides a visual representation of all the CloudTrail events in a categorized view. This includes graph pattern, tabular pattern, map, and meter gauge.

Once events are received into Netsurion, Reports, Knowledge Objects, Categories and Dashboards can be configured into Netsurion.

Netsurion monitors all the Amazon Web Services events from services like Amazon EC2 and Amazon VPC, they are given as below:-

  • Security - Login failed, Network interface deleted, User removed, Security group activity
  • Compliance - Policy activity, User-Management activity
  • Operation - Login success, Bucket-Object activity, Network Interface created

Once Amazon Web Services is configured to deliver events to Netsurion alerts, dashboards, and reports can be configured into Netsurion.

Some of the Data Source Integrations available in Netsurion are listed below.

Alerts

Type Name Description
Security AWS - Network Interface Deleted This alert will be triggered if there is any activity related to VPC network interface deletion.
Security AWS - S3 User Deleted This alert will be triggered if a user gets deleted.
Compliance AWS - CIS Control AWS Config configuration changed This alert will be triggered when the configuration is changed in the AWS Config. it will help ensure sustained visibility of configuration items within the AWS account.
Compliance AWS - CIS Control AWS Management Console authentication failures This alert will be triggered in the event of any failed or unauthorized login attempt to the AWS management console.
Compliance AWS - CIS Control changes to Network Access Control Lists (NACL) detected This alert will be triggered in the event of any changes to Network Access Control Lists is detected. Monitoring changes to NACLs will help ensure that the AWS resources and services are not unintentionally exposed.
Compliance AWS - CIS Control Changes to network gateways detected This alert will be triggered in the event of any changes to the network gateway is detected. Monitoring changes to network gateways will help ensure that all ingress/egress traffic traverses the VPC border via a controlled path.
Compliance AWS - CIS Control CloudTrail configuration changed This alert will be triggered in the event of any CloudTrail configuration is changed. Monitoring changes to CloudTrail's configuration will help ensure sustained visibility to activities performed in the AWS account.
Compliance AWS - CIS Control Disabling or scheduled deletion of customer created CMKs This alert will be triggered in the event of any disabling or scheduled deletion of customer created CMKs. Monitoring changes to CloudTrail's configuration will help ensure sustained visibility to activities performed in the AWS account.
Compliance AWS - CIS Control IAM policy changed This alert will be triggered in the event of any IAM policy changed. Monitoring changes to IAM policies will help ensure authentication and authorization controls remain intact.
Compliance AWS - CIS Control Management Console signed-in without MFA This alert will be triggered in the event of any user signed-in without MFA. Monitoring for single-factor console logins will increase visibility into accounts that are not protected by MFA.
Compliance AWS - CIS Control Route table changed This alert will be triggered in the event of any Route table changed. Monitoring changes to route tables will help ensure that all VPC traffic flows through an expected path.
Compliance AWS - CIS Control S3 bucket policy changed This alert will be triggered in the event of the s3 bucket policy changed. Monitoring changes to the S3 bucket policies may reduce the time to detect and correct permissive policies on sensitive S3 buckets.
Compliance AWS - CIS Control Security group changed This alert will be triggered in the event of the s3 bucket policy changed. Monitoring changes to the security group will help ensure that resources and services are not unintentionally exposed.
Compliance AWS - CIS Control Unauthorized API calls This alert is triggered in the event of unauthorized API calls detected. Monitoring unauthorized API calls will help reveal application errors and may reduce the time to detect malicious activity.
Compliance AWS - CIS Control Usage of root account detected This alert will be triggered in the event of root account usage detected. Monitoring for root account logins will provide visibility into the use of a fully privileged account and an opportunity to reduce the use of it.
Compliance AWS - CIS Control VPC configuration changed This alert will be triggered in the event of VPC changed. Monitoring changes to IAM policies will help ensure authentication and authorization controls remain intact.

Reports

Type Name Description
Security AWS - Login Failed Activity This report will generate a detailed view of failed or unauthorized logins to the AWS management console.
Security AWS - Security Group Activity This report will generate a detailed view of the activities related to the security groups, i.e. CreateSecurityGroup, AuthorizeSecurityGroupIngress, DeleteSecurityGroup, etc.
Operations AWS - Login Success Activity This report will generate a detailed view of the successful user login or authentication to the AWS management console.
Operations AWS - Network Interface Activity This report will generate a detailed view of the activity related to network interface create, delete, reset, modify, detach, attach, etc.
Operations AWS - Bucket Level Activity This report will generate a detailed view of the activities related to the Amazon S3 bucket. This includes CreateBucket, PutBucketPolicy, ListBuckets, etc.
Compliance AWS - Policy Activity This report will generate a detailed view of the activities related to policy, i.e. AttachUserPolicy, GetPolicy, DetachRolePolicy, CreatePolicy, etc.
Compliance AWS - User Management Activity This report will generate a detailed view of the activities related to user or group create, delete, add, remove, etc.

Documentation

The configurations detailed are consistent with Netsurion version 9.x and later, and Amazon Web Services.

Download Integration Guide and How-to Guide for more information and to configuration instructions.

This site uses cookies to store information on your computer. Some are essential to make our site work; others help us improve the user experience. By using the site, you consent to the placement of these cookies. Read our Privacy Statement to learn more.

I Accept