Skip to main content

AWS CloudWatch Logs

AWS CloudWatch Logs is Amazon Web Services' centralized log management and monitoring service that collects, stores, and analyzes log data from various AWS resources, applications, and on-premises servers. This service enables organizations to aggregate all their system, application, and custom log files in one place for real-time monitoring, troubleshooting, and analysis.

CategoryObservability
DirectionQuery source
Sign-inAWS IAM
Query languagesSTIX
Websitehttp://aws.com

Before you start​

Huntbase signs in to AWS CloudWatch Logs with AWS IAM. Create the credential in AWS CloudWatch Logs first, then keep it to hand for the Connect step.

  1. In the IAM console, create a policy that allows the CloudWatch Logs actions listed below, and attach it to a dedicated IAM user (or to the role you plan to assume).
  2. Sign in as that user, choose your user name in the navigation bar, and choose Security credentials.
  3. In Access keys, choose Create access key. On the best-practices page, choose Other, then Next, then Create access key.
  4. On Retrieve access keys, choose Show or Download .csv file. This is your only chance to save the secret access key.
  5. Optional: to use a role, go to Roles › Create role, choose AWS account as the trusted entity, and attach the policy. Then give the user sts:AssumeRole on the role's ARN.

Permissions:

  • logs:DescribeLogGroups
  • logs:StartQuery
  • logs:GetQueryResults
  • logs:StopQuery
  • sts:AssumeRole on the role ARN (only when you fill in AWS IAM Role)
Watch out for
  • Queries run through CloudWatch Logs Insights, so the key needs the query actions, not only logs:GetLogEvents.

For the vendor's own instructions, see CloudWatch Logs permissions reference.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect AWS CloudWatch Logs​

  1. Go to Connections and click New connection, or click New connection on the AWS CloudWatch Logs product page.
  2. On Product, pick AWS CloudWatch Logs and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your AWS CloudWatch Logs lives:

FieldRequiredNotes
AWS RegionYesThe AWS Region your log groups are in, such as us-east-1.
Log Group NamesNoJSON that maps a log type to one or more log group names, such as {"vpcflow": "USEast1_FlowLogs", "guardduty": ["/aws/events/guardduty"]}. Use the default key for groups without a type. Leave this blank to search every log group in the Region.

Credentials​

The only Method is AWS IAM. Enter a Credential label (for example Production), then fill in:

FieldRequiredNotes
AWS Access Key IDYesAWS Access Key ID is required for both AWS key-based and role-based authentication. Secret — not shown again after you save it.
AWS Secret Access KeyYesAWS Secret Access Key ID is required for both AWS key-based and role-based authentication. Secret — not shown again after you save it.
AWS IAM RoleNoOptional. The ARN of a role to assume, such as arn:aws:iam::123456789012:role/HuntbaseLogsRead. The access key is still required, because it's used to assume the role. Secret — not shown again after you save it.

Query it​

Once connected, AWS CloudWatch Logs can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
STIXSTIX patterns for indicator sweeps, translated into the product's native search.

Next steps​