cscli parsers install crowdsecurity/aws-cloudtrailParser for cloudtrail logs with type aws-cloudtrail.
As cloudtrail logs that are sent to s3 are stored in a json array
object called Records, you may want to use the transform feature of
crowdsec with the following configuration:
map(JsonExtractSlice(evt.Line.Raw, "Records"), ToJsonString(#)).
Example of acquis.yaml using s3 s3notifications through sqs:
1source: s32polling_method: sqs3sqs_name: <sqs_queue>4sqs_format: s3notification5polling_interval: 306aws_region: eu-west-17transform: map(JsonExtractSlice(evt.Line.Raw, "Records"), ToJsonString(#))8max_buffer_size: 100000009use_time_machine: true10labels:11 type: aws-cloudtrail
A direct acquisition method is supported using s3 by directly listing new object in the bucket. In case of high cloudtrail traffic, this is discouraged, because it will require some significant compute resources.
Cloudtrail logs are arriving every few minutes, thus, we can't use the real time feature of crowdsec. That's the reason we are suggesting to use the time machine feature, to take into account the time when they occurred and not when they are sent to CrowdSec.
Please have a look at the documentation https://docs.crowdsec.net/docs/next/data_sources/s3
Cloudtrail logs can be sent to kinesis as well, and crowdsec supports such a source for cloudtrail logs:
1source: kinesis2stream_name: cloutrail_stream3aws_region: eu-west-14from_subscription: true5labels:6 type: aws-cloudtrail
1onsuccess: next_stage2#debug: true3filter: "evt.Parsed.program == 'aws-cloudtrail'"4name: crowdsecurity/aws-cloudtrail5description: "Parse AWS Cloudtrail logs"6statics:7 - parsed: cloudtrail_parsed8 expression: UnmarshalJSON(evt.Line.Raw, evt.Unmarshaled, 'cloudtrail')9 - target: evt.StrTime10 expression: evt.Unmarshaled.cloudtrail.eventTime11 - meta: user_type12 expression: evt.Unmarshaled.cloudtrail.userIdentity.type13 # see : https://github.com/antonmedv/expr/blob/master/docs/Language-Definition.md#nil-coalescing14 - meta: user_arn15 expression: |16 evt.Unmarshaled.cloudtrail.userIdentity?.arn ?? evt.Unmarshaled.cloudtrail.userIdentity.userName17 - meta: event_name18 expression: evt.Unmarshaled.cloudtrail.eventName19 - meta: event_source20 expression: evt.Unmarshaled.cloudtrail.eventSource21 - meta: region22 expression: evt.Unmarshaled.cloudtrail.awsRegion23 - meta: source_ip24 expression: |25 IsIP(evt.Unmarshaled.cloudtrail.sourceIPAddress) ? evt.Unmarshaled.cloudtrail.sourceIPAddress : ""26 - meta: user_agent27 expression: evt.Unmarshaled.cloudtrail.userAgent28 - meta: error_code29 expression: evt.Unmarshaled.cloudtrail.errorCode30 - meta: event_id31 expression: evt.Unmarshaled.cloudtrail.eventID32 - meta: account_id33 expression: evt.Unmarshaled.cloudtrail.userIdentity.accountId34 - meta: log_type35 value: aws-cloudtrail36