Connecting to an Amazon CloudWatch data source

Connect the Amazon CloudWatch data source to the platform to enable your applications and dashboards to collect and analyze Amazon CloudWatch security data. Universal Data Insights connectors enable federated search across your security products.

1. Go to Menu > Connections > Data sources.
2. On the Data Sources tab, click Connect a data source.
3. Select the data source type.
4. Configure the connection to the data source.
   1. In the Data source name field, assign a name to uniquely identify the data source connection.
      You can create multiple connection instances to a data source so it would be good to clearly set them apart by name. Only alphanumeric characters and the following special characters are allowed: - . _
   2. In the Data source description field, write a description to indicate the purpose of the data source connection.
      You can create multiple connection instances to a data source, so it is useful to clearly indicate the purpose of each connection by description. Only alphanumeric characters and the following special characters are allowed: - . _
   3. If you have a firewall between your cluster and the data source target, use the Edge Gateway to host the containers. In the Edge gateway (optional) field, specify which Edge Gateway to use.
      Select an Edge Gateway to host the connector. It can take up to five minutes for the status of newly deployed data source connections on the Edge Gateway to show as being connected.
   4. In the Region field, specify the CloudWatch region for the data source. Select your region code from the Region column of the Service Endpoints table in the AWS General Reference guide (https://docs.aws.amazon.com/general/latest/gr/cwl_region.html).
   5. In the Log group names field, specify the log group names of the CloudWatch logs that you want to connect to. If the log group names are not specified, all the available log groups are connected.
      This field is optional. The value of Log group names must use a specific JSON format:

      {"<service_type>": "<service_log_group_name>"}

      For example:

      {"vpcflow": "vpcflow_log_group_name"}

      To get logs from multiple service types, the service types and their associated log group names can be specified in the JSON separated by a comma. For example:

      {"vpcflow": "vpcflow_log_group_name", "guardduty": "guardduty_log_group_name"}

5. Set the query parameters to control the behavior of the search query on the data source.
   1. In the Concurrent search limit field, set the number of simultaneous connections that can be made to the data source. The default limit for the number of connections is 4. The value must not be less than 1 and must not be greater than 100.
   2. In the Query search timeout limit field, set the time limit in minutes for how long the query is run on the data source. The default time limit is 30. When the value is set to zero, there is no timeout. The value must not be less than 1 and must not be greater than 120.
   3. In the Result size limit field, set the maximum number of entries or objects that are returned by search query. The default result size limit is 10,000. The value must not be less than 1 and must not be greater than 500,000.
   4. In the Query time range field, set the time range in minutes for the search, represented as the last X minutes. The default is 5 minutes. The value must not be less than 1 and must not be greater than 10,000.
   Important: If you increase the concurrent search limit and the result size limit, a greater amount of data can be sent to the data source, which increases the strain on the data source. Increasing the query time range also increases the amount of data.
6. Optional: If you need to customize the STIX attributes mapping, click Customize attribute mapping and edit the JSON blob to map new or existing properties to their associated target data source fields.
7. Configure identity and access.
   1. Click Add a Configuration.
   2. In the Configuration name field, enter a unique name to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
   3. In the Configuration description field, enter a unique description to describe the access configuration and distinguish it from the other access configurations for this data source connection that you might set up. Only alphanumeric characters and the following special characters are allowed: - . _
   4. Click Edit access and choose which users can connect to the data source and the type of access.
   5. Establish AWS authentication to enable access to the AWS search API.
      • To establish an AWS key-based authentication, enter values for the AWS Access key id and AWS secret access key parameters.
      • To establish an AWS role-based authentication, enter values for the AWS Access key id, AWS secret access key, and AWS IAM Role parameters.

      For more information about AWS authentication, see Configuring AWS authentication.
   6. If CloudWatch is configured with a self-signed Security Sockets Layer (SSL) certificate, add a connection certificate.

      To confirm that you have a self-signed certificate, you can search the web for 'ssl decode', then copy and paste your certification into a Certificate Decoder. If the value in the Common Name field is local, for example, yourlocalhost.yourlocaldomain, it indicates a self-signed certificate.

      If your hostname or IP address does value not match the common name value, you must provide a Server Name Indicator (SNI). The SNI enables a separate hostname to be provided to the Transport Layer Security (TLS) handshake of the resource connection.

      Copy the certificate details and paste it in the space that is provided.

   7. Click Add.
   8. To save your configuration and establish the connection, click Done.
   You can see the data source connection configuration that you added under Connections on the data source settings page. A message on the card indicates connection with the data source.

   When you add a data source, it might take a few minutes before the data source shows as being connected.

   Tip: After you connect a data source, it might take up to 30 seconds to retrieve the data. Before the full data set is returned, the data source might display as unavailable. After the data is returned, the data source shows as being connected, and a polling mechanism occurs to validate the connection status. The connection status is valid for 60 seconds after every poll.

   You can add other connection configurations for this data source that have different users and different data access permissions.

8. To edit your configurations, complete the following steps:
   1. On the Data Sources tab, select the data source connection that you want to edit.
   2. In the Configurations section, click Edit Configuration ().
   3. Edit the identity and access parameters and click Save.