Adding an Amazon AWS CloudTrail data source by using the Amazon Web Services protocol and CloudWatch Logs

Access Key ID/Secret Key

Standard authentication that can be used from anywhere.

EC2 Instance IAM Role

If your QRadar product managed host is running in an AWS EC2 instance, choosing this option uses the IAM role from the metadata that is assigned to the instance for authentication. No keys are required. This method works only for managed hosts that are running within an AWS EC2 container.

The Access Key ID that was generated when you configured the security credentials for your AWS user account.

If you selected Access Key ID / Secret Key or Assume IAM Role, the Access Key parameter is displayed.

The Secret Key that was generated when you configured the security credentials for your AWS user account.

If you selected Access Key ID / Secret Key or Assume IAM Role, the Secret Key parameter is displayed.

If you enabled Assume an IAM Role, the Assume Role ARN parameter is displayed.

If you enabled Assume an IAM Role, the Assume Role Session Name parameter is displayed.

Log Stream

(Optional) The name of the log stream within a log group. If you want to collect logs from all log streams within a log group, leave this field blank.

Filter Pattern

(Optional) Type a pattern for filtering the collected events. This pattern is not a regex filter. Only the events that contain the exact value that you specified are collected from CloudWatch Logs. If you type ACCEPT as the Filter Pattern value, only the events that contain the word ACCEPT are collected, as shown in the following example.

{LogStreamName: LogStreamTest,Timestamp: 0,Message: ACCEPT OK,IngestionTime: 0,EventId: 0}

Event Delay

Delay in seconds for collecting data.

Other Region(s)

Deprecated. Use Regions instead.

Forwards only the original event that was added to the CloudWatch Logs.

CloudWatch logs wrap the events that they receive with extra metadata. Select this option if you want to collect only the original event that was sent to AWS without the additional stream metadata through CloudWatch Logs.

The original event is the value for the message key that is extracted from the CloudWatch log. The following CloudWatch Logs event example shows the original event that is extracted from CloudWatch Logs in highlighted text:

{LogStreamName: 123456786_CloudTrail_us-east-2,Timestamp: 1505744407363, Message: {"eventVersion":"1.05","userIdentity":{"type":"IAMUser","principalId":"AAAABBBCCCDDDBBBCCC","arn":"arn:aws:iam::1234567890:user/<username>","accountId":"1234567890","accessKeyId":"AAAABBBBCCCCDDDD","userName":"User-Name","sessionContext":{"attributes":{"mfaAuthenticated":"false","creationDate":"2017-09-18T13:22:10Z"}},"invokedBy":"signin.amazonaws.com"},"eventTime":"2017-09-18T14:10:15Z","eventSource":"cloudtrail.amazonaws.com","eventName":"DescribeTrails","awsRegion":"us-east-1","sourceIPAddress":"192.0.2.1","userAgent":"signin.amazonaws.com","requestParameters":{"includeShadowTrails":false,"trailNameList":[]},"responseElements":null,"requestID":"11b1a00-7a7a-11a1-1a11-44a4aaa1a","eventID":"a4914e00-1111-491d-bbbb-a0dd3845b302","eventType":"AwsApiCall","recipientAccountId":"1234567890"},IngestionTime: 1505744407506,EventId: 335792223611111122479126672222222513333}

If you don't select Use As A Gateway Log Source and you don't configure the Log Source Identifier Pattern, the QRadar product receives events as unknown generic data sources.

If you selected Use As A Gateway Log Source, you can define a custom log source identifier. This option can be defined for events that are being processed and for to be automatically discovered when applicable. If you don't configure the Log Source Identifier Pattern, the QRadar product receives events as unknown generic .

Use key-value pairs to define the custom Log Source Identifier. The key is the Identifier Format String, which is the resulting source or origin value. The value is the associated regex pattern that is used to evaluate the current payload. This value also supports capture groups that can be used to further customize the key.

Define multiple key-value pairs by typing each pattern on a new line. Multiple patterns are evaluated in the order that they are listed. When a match is found, a custom Log Source Identifier is displayed.

If the QRadar product accesses the Amazon Web Service by using a proxy, select this option.

If the proxy requires authentication, configure the Proxy Server, Proxy Port, Proxy Username, and Proxy Password fields.

If the proxy does not require authentication, configure the Proxy IP or Hostname field.

The upper limit for the maximum number of events per second (EPS). The default is 5000.

If the Use As A Gateway Log Source option is selected, this value is optional.

If the EPS Throttle parameter value is left blank, no EPS limit is imposed by the QRadar product.

{LogStreamName: 1234567890_CloudTrail_us
-east-2,Timestamp: 1505744407363,Message: 
{"eventVersion":"1.05","userIdentity":{"type"
:"IAMUser","principalId":"AIDAIEGANDWTHAAUMATYA",
"arn":"arn:aws:iam::1234567890:user/QRadar-ITeam",
"accountId":"1234567890","accessKeyId":
"AAAABBBBCCCCDDDD","userName":"QRadar-ITeam",
"sessionContext":{"attributes":{"mfaAuthenticated":
"false","creationDate":"2017-09-18T13:22:10Z"}},
"invokedBy":"signin.amazonaws.com"},"eventTime":
"2017-09-18T14:10:15Z","eventSource":
"cloudtrail.amazonaws.com","eventName":
"DescribeTrails","awsRegion":"us-east-1",
"sourceIPAddress":"127.0.0.1","userAgent":
"signin.amazonaws.com","requestParameters":
{"includeShadowTrails":false,"trailNameList":
[]},"responseElements":null,"requestID":
"17b7a04c-99cca-11a1-9d83-43d5bce2d2fc",
"eventID":"a4444e00-55e5-4444-bbbb-a0dd3845b302",
"eventType":"AwsApiCall","recipientAccountId":
"1234567890"},IngestionTime: 1505744407506,
EventId: 33579222362711111111111111222222222222}