Connecting Amazon S3 to Azure Sentinel

Question

question

HarshaBalla-4340 asked Apr 18, '22 JamesTran-MSFT commented May 2, '22

Connecting Amazon S3 to Azure Sentinel

We have stored Cloud watch Logs to Amazon S3 buckets using Kinesis Firehose. Now the requirement is to analyze those logs in S3 through Azure sentinel.

Followed this document "Connect Microsoft Sentinel to Amazon Web Services to ingest AWS service log data"

[1]: https://docs.microsoft.com/en-us/azure/sentinel/connect-aws?tabs=s3

But here I can see new version that can ingest logs from the following AWS services by pulling them from an S3 bucket:

Amazon Virtual Private Cloud (VPC) - VPC Flow Logs
Amazon GuardDuty - Findings
AWS CloudTrail - Management and data events

Could someone help me out here on how to achieve this, if any docs are available it would be helpful

microsoft-sentinel

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2022-04-18T12:53:49.367Z

AndrewBlumhardt-1137 answered Apr 18, '22 JamesTran-MSFT edited Apr 22, '22

As you mentioned there are two AWS connectors. The legacy connector "Amazon Web Services" for CloudTrail and a new "Amazon Web Services S3" connector for CloudTrail, GuardDuty, and VPC. I assume the new connector should replace the older version.

The article you provided describes the new connector. I have not set this up myself but the document you linked has the setup instructions and the connector page in Sentinel also has instructions. Is there a particular step or error that is causing a roadblock?

You may also find this blog post helpful: https://samilamppu.com/2022/01/17/microsoft-sentinel-how-to-leverage-built-in-amazon-web-services-s3-data-connector/

· 4

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JamesTran-MSFT · Apr 19 at 04:07 PM

@HarshaBalla-4340
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

0 ·

HarshaBalla-4340 JamesTran-MSFT · Apr 22 at 05:37 AM

Thanks for your response,
I had kept some of findings in comment section, could someone help me out there!

0 ·

HarshaBalla-4340 · Apr 21 at 06:51 AM

Thanks for following up, Happy with your response.

I ran automated script which is in the link https://docs.microsoft.com/en-us/azure/sentinel/connect-aws?tabs=s3 for setting up DataConnector.
Where I used ConfigAwsConnector.ps1 and ConfigCustomLogDataConnector.ps1 since I need to export cloud watch customized logs in AWS S3 bucket to Sentinel.

My doubt here is which option to choose here in destination table for reflecting data in sentinel and any queries are there to get these results in sentinel dashboard? it would be helpful.
Since I tried all three it's not working

Thanks,

0 ·

image.png (33.0 KiB)

JamesTran-MSFT HarshaBalla-4340 · Apr 22 at 04:31 PM

@HarshaBalla-4340
Thank you for following up on this!

When selecting the Destination table, can you see if waiting some time for the data to be ingested into the tables resolves your issue? For the additional queries, are you asking for other queries outside the article that was linked?

0 ·

Answer 2 · 2022-04-22T21:33:31.91Z

AndrewBlumhardt-1137 answered Apr 22, '22 JamesTran-MSFT commented May 2, '22

It sounds like you may be trying to use an unsupported operation for that connector.

Apparently there is a new generic S3 connector in private preview to collect cloud watch logs or any other custom logs stored in S3. The current connector only supports VPC, GuardDuty, and CloudTrail.

Here is a link to join the private preview program: https://aka.ms/SecurityPRP

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JamesTran-MSFT · May 02 at 08:56 PM

@HarshaBalla-4340
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

0 ·

question