Configuring Amazon Elastic Kubernetes Service to communicate with QRadar

Before you can add a logsource in IBM QRadar, you must enable logging on your Amazon AWS console.

Before you begin

You must have a cluster that is created in the Amazon Container Services application. For more information about creating clusters, see your Amazon Elastic Kubernetes Service (Amazon EKS) documentation (https://docs.aws.amazon.com/eks/latest/userguide/create-cluster.html).

Procedure

  1. Log in to your IAM console (https://console.aws.amazon.com/iam/).
  2. Click Services > Amazon Kubernetes Service > Clusters.
  3. From the Clusters list, select the cluster that you want to use, then click the Configuration tab.
  4. Click the Logging tab and then enable the options that you want the logging service to monitor.
  5. To create the log group, click Manage logging.
  6. To view the log group, click Services > CloudWatch > Log groups. The log group displays in the Log groups list as /aws/eks/<cluster name>/cluster.
  7. Click Services > Amazon Kubernetes Service > Clusters.
  8. Click the Details tab, then record the Cluster ARN value. You need this value for the Log Group parameter value when you add a log source in QRadar.

What to do next

Adding a log source