{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"style":{"value":"none"}},"macroMetadata":{"macroId":{"value":"260bef13-62cf-4dd1-8c1a-7c4f7c9b556c"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"b1609b98-29d6-4aca-9466-41a257495e5b"}},{"type":"paragraph"},{"type":"heading","attrs":{"level":2},"content":[{"text":"AWS","type":"text"}]},{"type":"table","attrs":{"layout":"center","width":1800.0,"localId":"8c2c0430-416b-49b7-8752-6e6ada798099"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"Log index","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Instruction","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"log-aws-apigateway","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure that permissions ","type":"text"},{"text":"logs:DescribeLogGroups","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"logs:DescribeLogStreams","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"logs:GetLogEvents","type":"text","marks":[{"type":"code"}]},{"text":" are granted to Cloudaware. Logs from CloudWatch groups will be discovered automatically. ","type":"text"}]},{"type":"paragraph","content":[{"text":"Cloudaware supports the tag-based discovery for CloudWatch groups. Ensure that the permission ","type":"text"},{"text":"logs:ListTagsForResource","type":"text","marks":[{"type":"code"}]},{"text":" is granted and the tag ","type":"text"},{"text":"log-source:apigateway","type":"text","marks":[{"type":"code"}]},{"text":" is present.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"log-aws-cloudfront-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Enable logging as described in this external ","type":"text"},{"text":"guide","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.cloudconformity.com/knowledge-base/aws/CloudFront/cloudfront-logging-enabled.html "}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Ensure that logs are being stored in S3 bucket. Grant Cloudaware with access to this bucket (","type":"text"},{"text":"s3:GetObject","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"s3:ListObject","type":"text","marks":[{"type":"code"}]},{"text":" permissions).","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"log-aws-cloudtrail-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure CloudTrail is enabled and the CloudTrail data is accessible (the bucket should be present to Cloudaware).","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"log-aws-config-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Enable AWS Config as described in ","type":"text"},{"text":"AWS Documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.aws.amazon.com/config/latest/developerguide/getting-started.html"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Ensure that Cloudaware has been granted with the permission ","type":"text"},{"text":"config:Des*","type":"text","marks":[{"type":"code"}]},{"text":" (or ","type":"text"},{"text":"config:DescribeDeliveryChannels","type":"text","marks":[{"type":"code"}]},{"text":" as minimum).","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"log-aws-ec2-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure that logs are being stored in S3 bucket. Grant Cloudaware with access to this bucket (","type":"text"},{"text":"s3:GetObject","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"s3:ListObject","type":"text","marks":[{"type":"code"}]},{"text":" permissions).","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"log-aws-eks-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure Amazon EKS is enabled as described in ","type":"text"},{"text":"AWS Documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Ensure that Cloudaware has been granted with permissions ","type":"text"},{"text":"logs:DescribeLogGroups","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text","marks":[{"type":"em"}]},{"text":"logs:DescribeLogStreams","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text","marks":[{"type":"em"}]},{"text":"logs:GetLogEvents","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"log-aws-elb-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure that that logging for ALB/ELB is on and logs are being stored in S3 Bucket. Grant Cloudaware with access to this bucket (","type":"text"},{"text":"s3:GetObject","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"s3:ListObject","type":"text","marks":[{"type":"code"}]},{"text":" permissions).","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"log-aws-health-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure that permissions ","type":"text"},{"text":"health:DescribeEvents","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"health:DescribeAffectedEntities","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"health:DescribeEventDetails","type":"text","marks":[{"type":"code"}]},{"text":" are granted to Cloudaware.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"log-aws-guardduty-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure that logs are being stored in S3 bucket. Grant Cloudaware with access to this bucket (","type":"text"},{"text":"s3:GetObject","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"s3:ListObject","type":"text","marks":[{"type":"code"}]},{"text":" permissions).","type":"text"}]},{"type":"paragraph","content":[{"text":"If logs are not discovered automatically, apply the tag ","type":"text"},{"text":"log-source:guardduty","type":"text","marks":[{"type":"code"}]},{"text":" on the bucket to fix it.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"log-aws-rds-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Cloudaware tracks RDS logs in both CloudWatch and events from DB instance. Ensure that Cloudaware has the following permissions*:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" for logs from CloudWatch: ","type":"text"},{"text":"logs:DescribeLogGroups","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"logs:DescribeLogStreams","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"logs:GetLogEvents","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":" for logs from DB instance: ","type":"text"},{"text":"rds:DescribeDBInstances","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"rds:DescribeDBLogFiles","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"rds:DownloadCompleteDBLogFile","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"rds:DownloadDBLogFilePortion","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"paragraph","content":[{"text":"*These permissions are predefined in Cloudaware Conflux Collector policy.","type":"text","marks":[{"type":"em"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"log-aws-lambda-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure that Cloudaware has been granted with permissions ","type":"text"},{"text":"logs:DescribeLogGroups","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"logs:DescribeLogStreams","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"logs:ListTagsForResource","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"logs:GetLogEvents","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"},{"type":"hardBreak"},{"text":"Cloudaware automatically discovers CloudWatch groups where Lambda logs are stored. If the search didn't bring results, tag the group(s) with ","type":"text"},{"text":"log-source: lambda","type":"text","marks":[{"type":"code"}]},{"text":" tag.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"log-aws-r53resolver-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure that logging for DNS Queries is enabled as described in ","type":"text"},{"text":"AWS Documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/query-logs.html#query-logs-configuring"}}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"log-aws-trustedadvisor-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure that permissions ","type":"text"},{"text":"support:DescribeTrustedAdvisorChecks","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"support:DescribeTrustedAdvisorCheckResult","type":"text","marks":[{"type":"code"}]},{"text":" are granted to Cloudaware.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"log-aws-s3accesslog-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure that logging for S3 is enabled as described in ","type":"text"},{"text":"AWS Documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.aws.amazon.com/AmazonS3/latest/user-guide/server-access-logging.html"}}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"log-aws-vpcflowlogs-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure VPC, VPC subnet or Elastic Network Interface traffic is logged to CloudWatch Logs as described in ","type":"text"},{"text":"AWS Documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://aws.amazon.com/blogs/aws/vpc-flow-logs-log-and-view-network-traffic-flows/"}}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[96.0]},"content":[{"type":"paragraph","content":[{"text":"log-aws-waf-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure that WAF logs are being stored in S3 Bucket or in CloudWatch Logs. Grant Cloudaware with access to this bucket (","type":"text"},{"text":"kinesis:DescribeStream","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"kinesis:ListStreams","type":"text","marks":[{"type":"code"}]},{"text":" permissions should be in place, along with ","type":"text"},{"text":"s3:ListBucket","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"s3:GetObject","type":"text","marks":[{"type":"code"}]},{"text":" or ","type":"text"},{"text":"logs:DescribeLogGroups","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"logs:DescribeLogStreams","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"logs:GetLogEvents","type":"text","marks":[{"type":"code"}]},{"text":" depending on the log destination).","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"*","type":"text"},{"text":" If the S3 bucket is encrypted, please grant Cloudaware decrypt permissions. You can create a custom policy for the existing Cloudaware role on the account level, where the log bucket is located. Below is the example of a custom policy granting decrypt permissions, in addition to the necessary ","type":"text","marks":[{"type":"em"}]},{"text":"list*","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text","marks":[{"type":"em"}]},{"text":"get*","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"permissions:","type":"text","marks":[{"type":"em"}]}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"kms:Decrypt\",\n \"kms:DescribeKey\"\n ],\n \"Resource\": \"arn:aws:kms:::key/\",\n \"Effect\": \"Allow\",\n \"Sid\": \"AllowAccessToKMSCloudtrailBucket\"\n },\n {\n \"Action\": [\n \"s3:ListBucket\"\n ],\n \"Resource\": [\n \"arn:aws:s3:::aws-controltower-s3-access-logs--\",\n \"arn:aws:s3:::aws-controltower-logs--\"\n ],\n \"Effect\": \"Allow\",\n \"Sid\": \"AllowAccessToLogsBucket\"\n },\n {\n \"Action\": [\n \"s3:GetObject\"\n ],\n \"Resource\": [\n \"arn:aws:s3:::aws-controltower-s3-access-logs--/*\",\n \"arn:aws:s3:::aws-controltower-logs--/*\"\n ],\n \"Effect\": \"Allow\"\n }\n ]\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"WHERE ","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" must be replaced by a relevant encryption key","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" must be replaced by a relevant bucket ID ","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" must be replaced by a relevant bucket region ","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Azure","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"f13efec1-e695-43a9-836c-f3b2768727ca"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"Log index","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Instruction","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"log-azure-activity-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure that the Reader role has been assigned to Cloudaware based on ","type":"text"},{"text":"Azure Start Guide","type":"text","marks":[{"type":"link","attrs":{"href":"https://cloudaware.atlassian.net/wiki/spaces/DOCS/pages/4106223619/Setup+in+Azure#Add-role-assignments"}}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[98.0]},"content":[{"type":"paragraph","content":[{"text":"log-azure-flowlogs-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[662.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure that a ","type":"text"},{"text":"custom role","type":"text","marks":[{"type":"link","attrs":{"href":"https://cloudaware.atlassian.net/wiki/spaces/DOCS/pages/1831272449"}}]},{"text":" has been created for Cloudaware to have 'read' access to Storage Account keys (","type":"text"},{"text":"Microsoft.Storage/storageAccounts/listKeys/action","type":"text","marks":[{"type":"code"}]},{"text":" permission).","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Google Cloud","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"d2906cbb-81ee-43f2-a524-c726d482fac9"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[89.0]},"content":[{"type":"paragraph","content":[{"text":"Log index","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[671.0]},"content":[{"type":"paragraph","content":[{"text":"Instruction","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[89.0]},"content":[{"type":"paragraph","content":[{"text":"log-gcp-audit-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[671.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure that Cloud logging is enabled as described in ","type":"text"},{"text":"Google Cloud Documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://cloud.google.com/logging/docs/audit/"}}]},{"text":".","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Host level logs","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"8bd1242e-402d-489d-8380-1cdf1af47461"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[84.0]},"content":[{"type":"paragraph","content":[{"text":"Log index","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[676.0]},"content":[{"type":"paragraph","content":[{"text":"Instruction","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[84.0]},"content":[{"type":"paragraph","content":[{"text":"metricbeat","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[676.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure ","type":"text"},{"text":"Breeze","type":"text","marks":[{"type":"link","attrs":{"href":"https://cloudaware.atlassian.net/wiki/spaces/KB/pages/1206256867/Breeze+Agent"}}]},{"text":" is installed on a host. Ensure the outbound connection to port 8443 is open on your Conflux node*. WARNING: once enabled, ","type":"text"},{"text":"metriсbeat","type":"text","marks":[{"type":"em"}]},{"text":" may generate a significant number of logs","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[84.0]},"content":[{"type":"paragraph","content":[{"text":"winlogbeat","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[676.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure ","type":"text"},{"text":"Breeze","type":"text","marks":[{"type":"link","attrs":{"href":"https://cloudaware.atlassian.net/wiki/spaces/KB/pages/1206256867/Breeze+Agent"}}]},{"text":" is installed on a host. Ensure the outbound connection to port 8443 is open on your Conflux node*. WARNING: once enabled, ","type":"text"},{"text":"winglobeat ","type":"text","marks":[{"type":"em"}]},{"text":"may generate a significant number of logs","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[84.0]},"content":[{"type":"paragraph","content":[{"text":"filebeat","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[676.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure ","type":"text"},{"text":"Breeze","type":"text","marks":[{"type":"link","attrs":{"href":"https://cloudaware.atlassian.net/wiki/spaces/KB/pages/1206256867/Breeze+Agent"}}]},{"text":" is installed on a host. Ensure the outbound connection to port 8443 is open on your Conflux node*. WARNING: once enabled, ","type":"text"},{"text":"filebeat","type":"text","marks":[{"type":"em"}]},{"text":" may generate a significant number of logs","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[84.0]},"content":[{"type":"paragraph","content":[{"text":"packetbeat","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[676.0]},"content":[{"type":"paragraph","content":[{"text":"Ensure ","type":"text"},{"text":"Breeze","type":"text","marks":[{"type":"link","attrs":{"href":"https://cloudaware.atlassian.net/wiki/spaces/KB/pages/1206256867/Breeze+Agent"}}]},{"text":" is installed on a host. Ensure the outbound connection to port 8443 is open on your Conflux node*. WARNING: once enabled, ","type":"text"},{"text":"packetbeat","type":"text","marks":[{"type":"em"}]},{"text":" may generate a significant number of logs","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"*","type":"text","marks":[{"type":"strong"}]},{"text":" DNS name and IP address will be provided after Conflux is enabled for you in Cloudaware","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":2},"content":[{"text":"Other logs","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"GitLab Audit","type":"text"}]},{"type":"table","attrs":{"layout":"center","width":1800.0,"localId":"e9a86c9a-052d-4ccb-bd9b-d7f72f118d27"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"Log index","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1611.0]},"content":[{"type":"paragraph","content":[{"text":"Instruction","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[188.0]},"content":[{"type":"paragraph","content":[{"text":"log-gitlab-","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1611.0]},"content":[{"type":"paragraph","content":[{"text":"stream:","type":"text","marks":[{"type":"em"}]},{"text":" Contact Cloudaware to request a Destination URL for event stream creation in GitLab account. ","type":"text"},{"text":"Learn more","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.gitlab.com/ee/administration/audit_event_streaming/"}}]}]},{"type":"paragraph","content":[{"text":"AWS S3 bucket: ","type":"text","marks":[{"type":"em"}]},{"text":"Ensure that logs are being stored in S3 bucket. Grant Cloudaware with access to this bucket (","type":"text"},{"text":"s3:GetObject","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"s3:ListObject","type":"text","marks":[{"type":"code"}]},{"text":" permissions). Ensure that the tag","type":"text"},{"text":"log-source => gitlab","type":"text","marks":[{"type":"code"}]},{"text":" is used on the bucket.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Okta","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"d5e9bb66-df88-4813-ace1-3b715edcc426"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[181.0]},"content":[{"type":"paragraph","content":[{"text":"Log index","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1618.0]},"content":[{"type":"paragraph","content":[{"text":"Instruction","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[181.0]},"content":[{"type":"paragraph","content":[{"text":"log-okta-system-","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1618.0]},"content":[{"type":"paragraph","content":[{"text":"Provide the Cloudaware support with Okta URL and a ","type":"text"},{"text":"token","type":"text","marks":[{"type":"link","attrs":{"href":"https://help.okta.com/en-us/content/topics/security/api.htm?cshid=ext-create-api-token#create-okta-api-token"}}]},{"text":".","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"OneLogin","type":"text"}]},{"type":"table","attrs":{"layout":"center","width":1800.0,"localId":"04bcbc97-5b32-430a-8391-2837065acc81"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"Log index","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1615.0]},"content":[{"type":"paragraph","content":[{"text":"Instruction","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[184.0]},"content":[{"type":"paragraph","content":[{"text":"log-onelogin-","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1615.0]},"content":[{"type":"paragraph","content":[{"text":"Contact Cloudaware to request a Listener URL and a token required to create a webhook in OneLogin. Use the provided parameters in the field 'Custom headers' in OneLogin UI (Developers → Webhooks). Specify the format as JSON Array when creating the webhook. Here is an example:","type":"text"}]},{"type":"codeBlock","content":[{"text":"Listener URL: https://COMPANYNAME-conflux.cloudaware.com:XXXX\nCustom Headers:\n conflux: Xxx1xxxx0xxxxxXXxX\nFormat: JSON Array","type":"text"}]},{"type":"paragraph","content":[{"text":"WHERE ","type":"text","marks":[{"type":"em"}]},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" must be replaced by your organization name","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Syslog","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":1800.0,"localId":"c7a9b7f2-e8ab-4b4d-90c3-a2930a9536da"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[181.0]},"content":[{"type":"paragraph","content":[{"text":"Log index","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1618.0]},"content":[{"type":"paragraph","content":[{"text":"Instruction","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[181.0]},"content":[{"type":"paragraph","content":[{"text":"log-syslog-*","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1618.0]},"content":[{"type":"paragraph","content":[{"text":"Contact Cloudaware to request a syslog server URL. Set up the logs stream to the following destination:","type":"text"},{"type":"hardBreak"},{"text":"Host: ","type":"text"},{"text":"COMPANYNAME-syslog-conflux.cloudaware.com","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"Port: 514","type":"text"},{"type":"hardBreak"},{"text":"Protocol: TCP","type":"text"}]},{"type":"paragraph","content":[{"text":"WHERE ","type":"text","marks":[{"type":"em"}]},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" must be replaced by your organization name","type":"text"}]}]}]}]}],"version":1}

Browser not supported