This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject

NetWitness Community

  • Home
  • Products
    • NetWitness Platform
      • Advisories
      • Documentation
        • Platform Documentation
        • Known Issues
        • Security Fixes
        • Hardware Documentation
        • Threat Content
        • Unified Data Model
        • Videos
      • Downloads
      • Integrations
      • Knowledge Base
    • NetWitness Cloud SIEM
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Detect AI
      • Advisories
      • Documentation
      • Knowledge Base
    • NetWitness Investigator
    • NetWitness Orchestrator
      • Advisories
      • Documentation
      • Knowledge Base
      • Legacy NetWitness Orchestrator
        • Advisories
        • Documentation
  • Community
    • Blog
    • Discussions
    • Events
    • Idea Exchange
  • Support
    • Case Portal
      • Create New Case
      • View My Cases
      • View My Team's Cases
    • Community Support
      • Getting Started
      • News & Announcements
      • Community Support Forum
      • Community Support Articles
    • Product Life Cycle
    • Support Information
    • General Security Advisories
  • Training
    • Blog
    • Certification Program
    • Course Catalog
    • New Product Readiness
    • On-Demand Subscriptions
    • Student Resources
    • Upcoming Events
  • Technology Partners
  • Trust Center
Sign InRegister Now
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
NetWitness Community Blog
Subscribe to the official NetWitness Community blog for information about new product features, industry insights, best practices, and more.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
  • NetWitness Community
  • Blog
  • Universal Plugins for AWS

Universal Plugins for AWS

AhteshamPatel
Occasional Contributor AhteshamPatel Occasional Contributor
Occasional Contributor
Options
  • Subscribe to RSS Feed
  • Mark as New
  • Mark as Read
  • Bookmark
  • Subscribe
  • Email to a Friend
  • Printer Friendly Page
  • Report Inappropriate Content
‎2021-10-12 09:31 AM

For customers that run their infrastructure on AWS cloud and would like to ingest logs from various services into NetWitness for security and compliance, we have developed Amazon CloudWatch Plugin and S3 Universal Connector. For customers on NetWitness platform 11.5 or later these universal plugins alleviate the problem of managing multiple connectors, one for each service, faced by our customers.

Depending upon where in AWS the logs are being stored, customers can use either of Amazon CloudWatch or S3 Universal Connector to ingest logs into NetWitness. Both these plugins use same parsers to parse the logs and hence no difference is seen in meta selection.

 

 AhteshamPatel_0-1632899252840.png

 

Log types currently supported by amazoncloudwatch plugin and required parser are as shown. In addition to the below log types customers can collect any other log type and route them to a custom parser or get in touch with RSA customer service to add official support.

Log Type Parser
Cloudtrail

aws_cloudtrail

VPC Flow Logs

aws

Route 53

aws, aws_route53resolver

AWS Active Directory Logs

aws_windows

Windows Logs

aws_windows

 

Similarly s3universal connector supported log types and the required parsers is as shown below. NetWitness will continue to add support for more AWS services based on customer request.

Log Type Parser
Cloudtrail

aws_cloudtrail

VPC Flow Logs

aws
AWS WAF Logs aws_waf
CiscoUmbrella (iplogs, dnslogs and proxylogs)

cisco_umbrella

AWS Active Directory Logs

aws_windows

Windows Logs aws_windows

 

Amazon AWS cloudtrail and vpc flow logs plugins will be deprecated and it is recommended that customers start using either amazon cloudwatch or s3 universal connector instead.

Additional Resources:

  • Amazon Cloudwatch Plugin Configuration Guide
  • S3 Universal Connector Configuration Guide
  • AWS CloudTrail - Anomalous Activity Detection Threat Content 
Labels:
  • Integrations
3 Likes
Share

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

  • Comment
Latest Articles
  • Agent Tesla: The Information Stealer
  • Threat Analysis: Detecting “Follina” (CVE-2022-30190) RCE Vulnerability with Netwitness Endpoint
  • Introducing NetWitness Vision XDR
  • Introducing NetWitness Platform XDR v12.0
  • Atlassian Confluence Zero-day Vulnerability (0-Zero) CVE-2022-26134: What You Need To Know
  • ‘Follina’ CVE-2022-30190 0-Day: What You Need To Know
  • CVE-2022-1388: BIG-IP iControl REST RCE Vulnerability
  • Ragnar Locker Ransomware: The Rampage Continues…
  • Ransomware Email Attacks: Beware of BazarLoader
  • Detecting Impacket with Netwitness Endpoint
Labels
  • Announcements 54
  • Events 2
  • Features 9
  • Integrations 6
  • Resources 57
  • Tutorials 21
  • Use Cases 21
  • Videos 116
Powered by Khoros
  • Blog
  • Events
  • Discussions
  • Idea Exchange
  • Knowledge Base
  • Case Portal
  • Community Support
  • Product Life Cycle
  • Support Information
  • About the Community
  • Terms & Conditions
  • Privacy Statement
  • Acceptable Use Policy
  • Employee Login
© 2022 RSA Security LLC or its affiliates. All rights reserved.