1. Expel Support Center
  2. Connect your technology
  3. Cloud integrations

AWS CloudTrail: Existing CloudTrail setup for Workbench

  • Updated

This article describes how to connect your existing AWS CloudTrail to the Expel Workbench.

If you're...

use...

Notes

connecting an existing CloudTrail

this article

You must already have a trail configured to send CloudTrail events to a S3 bucket.

You must already have an IAM (Identity and Access Management) Role for Workbench to authenticate with. To set this up, follow Step 6 of the AWS CloudTrail - New CloudTrail setup for Workbench article.

setting up new AWS CloudTrails

the onboarding wizard

You can also use the manual connection procedure.

connecting an existing CloudTrail that includes Control Tower

the Control Tower connection steps

Amazon S3 notifications can only be configured for 1 Simple Queue Service (SQS) queue per bucket. This poses a problem if you want to hook up Workbench to your CloudTrail bucket if you're already sending notifications to an SQS queue for internal reasons.

In this article, we show how you can route S3 notifications through SNS (simple notification service) to a different SQS queue that Workbench can poll from.

In this article

About connecting your device

Connecting your device to Workbench allows Workbench to ingest the logs. AWS logs include a great deal of information that can take hours to manually review. And not all AWS alerts need attention.

Expel collects data through direct API integrations with the AWS platform. Expel supports authentication with an IAM Role (recommended) or IAM User with a set of read-only permissions. To collect data, Expel communicates directly with AWS APIs (like AWS GuardDuty and Inspector) and pulls in CloudTrail data from S3.

Expel processes all product alerts with a library of Expel created rules focused on the MITRE attack framework. This makes it possible for a product alert that wouldn't be reviewed to be elevated to an Expel alert.

Before you start

Information to record

DField

Description

S3 bucket ARN (Amazon Resource Name)

The unique identifier for the S3 bucket where CloudTrail events are being sent.

SQS queue ARN

The unique identifier for the SQS queue that Workbench uses to consume S3 notifications.

SQS queue URL

The URL for the SQS queue that Workbench uses to consume S3 notifications.

SNS topic ARN

The unique identifier for the SNS topic that routes S3 notifications to the SQS queue.

About console permissions in your devices

As you connect your devices to Workbench, you provide Workbench access to those devices through permissions in the devices. These permissions vary from 1 device technology to another, but we typically need at least Read access to your devices to pull in any logs from those devices into Workbench.

Without minimum permissions to your devices, the SOC analysts are limited in their insight into your technology. This can mean they surface more benign alerts to your team for further investigation, resulting in increasing the workload for your team, and resulting in alert fatigue.

If you grant Read access to your devices, we can investigate the device and the logs more deeply and surface relevant alerts to you in Workbench. Allowing Expel visibility into the console of your security devices helps our SOC analysts make better decisions on whether an alert is benign or malicious. It also allows our SOC analysts to perform health checks to make sure Workbench is not missing alerts from your security devices. Depending on what your organization purchased from Expel, the SOC analysts may even be able to contain and/or remediate the issues on your behalf.

Ultimately, the more permissions you can grant Workbench, the better and faster the SOC analysts can find and investigate alerts in your environment.

Permissions description and explanation

Expel requires these permissions when connecting to AWS CloudTrail. These permissions are set to Read, except as shown below.

This permission...

does this...

Notes

ec2:DescribeRegions

Dynamically list all enabled regions for a customer account

ec2:DescribeInstances

Cloud investigative actions and inventory

Allows SOC analysts to triage issues and get additional content for the environment.

ec2:DescribeSecurityGroups

iam:List*

iam:Get*

lambda:GetFunction

rds:DescribeDBInstances

rds:ListTagsForResource

eks:DescribeCluster

eks:ListClusters

ecs:ListContainerInstances

ecs:DescribeContainerInstances

ecs:DescribeClusters

ecs:ListClusters

s3:GetBucketNotification

s3:GetEncryptionConfiguration

cloudtrail:GetTrail

cloudtrail:DescribeTrails

cloudtrail:GetTrailStatus

cloudtrail:ListTrails

organizations:ListAccounts

Enumerate accounts in an org

sqs:DeleteMessage

Remove Processed messages from the queue

Requires Write permission.

sqs:ReceiveMessage

Read messages

s3:GetObject

Download cloudtrail log files

ec2:DescribeVolumes

Cloud investigative actions and inventory

Allows SOC analysts to triage issues and get additional content for the environment.

ecs:DescribeTaskDefinition

Inventory

ecs:ListTaskDefinitions

config:ListDiscoveredResources

config:GetDiscoveredResourceCounts

lambda:ListFunctions

Cloud investigative actions and inventory

Allows SOC analysts to triage issues and get additional content for the environment.

lightsail:GetInstances

lightsail:GetRegions

s3:ListAllMyBuckets

kms:Decrypt

Decrypt S3 buckets

organizations:DescribeOrganization

Organization information

Retrieves information about the organization the user's account belongs to.

Step 1: Create a new SNS topic

Caution

Make sure to create the SNS topic in the same region as the S3 bucket CloudTrail events are being sent to!

  1. Navigate to Services > Simple Notification Service > Topics and click Create Topic.

  2. On the next screen, select Standard as the Type and create a Topic Name.

  3. Under Access Policy, select Advanced.

  4. In the JSON editor, paste the below policy substituting the YOUR_TOPIC_ARN and YOUR_S3_ARN fields with your values. This policy allows S3 to publish notifications to the topic for your CloudTrail bucket.

    {
"Version": "2008-10-17",
"Id": "expel-topic-policy-ID",
"Statement": [
  {
   "Sid": "expel-statement-ID",
   "Effect": "Allow",
   "Principal": {
    "AWS":"*"
    },
    "Action": [
     "SNS:Publish"
    ],
    "Resource": "YOUR_TOPIC_ARN",
    "Condition": {
       "ArnLike": { 
           "aws:SourceArn": "YOUR_S3_ARN"
    }
   }
  }
 ]
}

  5. Click Create Topic.

Step 2: Create an SQS queue for S3 notifications

In this step, we create a new SQS queue for S3 notifications. Workbench polls notifications from this queue to know when new CloudTrail data is added.

Caution

Make sure you create the SQS queue in the same region as the SNS topic and S3 bucket!

  1. Navigate to Services > Simple Queue Service > Queues and click Create queue.

  2. On the next screen, select Standard Queue and name the new queue.

    • Visibility timeout: 30 Seconds.

    • Message retention period: 7 days.

    • Delivery delay: 0 Seconds.

    • Maximum message size: 256 KB.

    • Receive message wait time: 0 Seconds.

  3. Under Access Policy, select Advanced.

  4. In the JSON editor, paste the below policy substituting the YOUR_SQS_QUEUE_ARN and YOUR_SNS_TOPIC_ARN fields with your values.

    {
"Version": "2012-10-17",
"Id": "YOUR_QUEUE_ARN/SQSDefaultPolicy",
"Statement": [
{
"Sid": "Sid1572965666162",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "SQS:SendMessage",
"Resource": "YOUR_SQS_QUEUE_ARN",
"Condition": {
"StringEquals": {
"aws:SourceArn": "YOUR_SNS_TOPIC_ARN"
}
}
}
]
}

Step 3: Subscribe SQS queue to SNS topic

Now that we’ve created an SNS topic and SQS queue, we need to configure SNS to send events to the SQS queue.

  1. Navigate to Services > Simple Notification Service > Subscriptions and click Create subscription.

  2. On the next screen, type the required fields to configure the subscription.

    Field

    Value

    Topic ARN

    Your SNS Topic ARN

    Protocol

    Select Amazon SQS

    Endpoint

    Your SNS Queue ARN

    Enable raw message delivery

    Important

    Selecting enable raw message delivery makes sure SNS doesn’t add extra metadata headers to the message when it sends to SQS. Make sure you select this!

  3. Click Create subscription to finish this step.

Step 4: Enable S3 event notifications to SNS topic

In this step, we configure the CloudTrail S3 bucket to send SNS notifications when CloudTrail adds logs to the bucket.

  1. Navigate to Services > S3 > Your S3 CloudTrail Bucket.

  2. Open Properties for your S3 bucket and navigate to Event notifications. Click Create event notification.

  3. On the next screen:

    • Create a name for your notification rule.

    • Select All object create events.

    • Send to SNS topic.

    • Select your SNS topic we created earlier.

  4. Click Save changes.

Step 5: Grant ExpelIAM Role access to SQS queue

At this point we configured S3 notifications → SNS topic → SQS queue. The final step involves granting the existing ExpelIAM Role access to poll events from the SQS queue and the S3 bucket.

  1. Navigate to Services > IAM > Expel Role.

  2. Create and add a new inline policy to the Expel Role. Grant the policy these permissions:

    • SQS Permissions

      • DeleteMessage

      • DeleteMessageBatch

      • ReceiveMessage

    • S3 Permissions

      • GetObject

    • Expel Permissions

      {
   “Version”: “2012-10-17”,
   “Statement”: [
   {
           “Action”: [
           “sqs:DeleteMessage”,
           “sqs:DeleteMessageBatch”,
           “sqs:ReceiveMessage”
           ],
           “Effect”: “Allow”,
           “Resource”: “YOUR_SQS_QUEUE_ARN”
    },
    {
           “Action”: [
           “s3:GetObject”
    ],
           “Effect”: “Allow”,
           “Resource”: “YOUR_S3_BUCKET_ARN/*”
    }
  ]
}

  3. Congratulations! You configured S3 notifications to an SQS queue through SNS. Contact your engagement manager for details on how to finish onboarding.

Tip

This article was accurate at the time of writing, but changes happen. If you find the instructions are outdated, leave a description in the comment field below and let us know!

  • Was this article helpful?

  • 0 out of 1 found this helpful

Related articles