Install with a top-level collection
3 collections include itsudo cscli collections install crowdsecurity/aws-cis-benchmarkInstalls 1 parser and 14 scenarios.
View AWS - CIS Benchmark →Installation
sudo cscli parsers install crowdsecurity/aws-cloudtrailThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
onsuccess: next_stage#debug: truefilter: "evt.Parsed.program == 'aws-cloudtrail'"name: crowdsecurity/aws-cloudtraildescription: "Parse AWS Cloudtrail logs"statics:- parsed: cloudtrail_parsedexpression: UnmarshalJSON(evt.Line.Raw, evt.Unmarshaled, 'cloudtrail')- target: evt.StrTimeexpression: evt.Unmarshaled.cloudtrail.eventTime- meta: user_typeexpression: evt.Unmarshaled.cloudtrail.userIdentity.type# see : https://github.com/antonmedv/expr/blob/master/docs/Language-Definition.md#nil-coalescing- meta: user_arnexpression: |evt.Unmarshaled.cloudtrail.userIdentity?.arn ?? evt.Unmarshaled.cloudtrail.userIdentity.userName- meta: event_nameexpression: evt.Unmarshaled.cloudtrail.eventName- meta: event_sourceexpression: evt.Unmarshaled.cloudtrail.eventSource- meta: regionexpression: evt.Unmarshaled.cloudtrail.awsRegion- meta: source_ipexpression: |IsIP(evt.Unmarshaled.cloudtrail.sourceIPAddress) ? evt.Unmarshaled.cloudtrail.sourceIPAddress : ""- meta: user_agentexpression: evt.Unmarshaled.cloudtrail.userAgent- meta: error_codeexpression: evt.Unmarshaled.cloudtrail.errorCode- meta: event_idexpression: evt.Unmarshaled.cloudtrail.eventID- meta: account_idexpression: evt.Unmarshaled.cloudtrail.userIdentity.accountId- meta: log_typevalue: aws-cloudtrail
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.
Documentation
Parser for cloudtrail logs
Parser for cloudtrail logs with type aws-cloudtrail.
S3
As cloudtrail logs that are sent to s3 are stored in a json array
object called Records, you may want to use the transform feature of
crowdsec with the following configuration:
map(JsonExtractSlice(evt.Line.Raw, "Records"), ToJsonString(#)).
Example of acquis.yaml using s3 s3notifications through sqs:
1source: s32polling_method: sqs3sqs_name: <sqs_queue>4sqs_format: s3notification5polling_interval: 306aws_region: eu-west-17transform: map(JsonExtractSlice(evt.Line.Raw, "Records"), ToJsonString(#))8max_buffer_size: 100000009use_time_machine: true10labels:11 type: aws-cloudtrail
A direct acquisition method is supported using s3 by directly listing new object in the bucket. In case of high cloudtrail traffic, this is discouraged, because it will require some significant compute resources.
Cloudtrail logs are arriving every few minutes, thus, we can't use the real time feature of crowdsec. That's the reason we are suggesting to use the time machine feature, to take into account the time when they occurred and not when they are sent to CrowdSec.
Please have a look at the documentation https://docs.crowdsec.net/docs/next/data_sources/s3
Kinesis
Cloudtrail logs can be sent to kinesis as well, and crowdsec supports such a source for cloudtrail logs:
1source: kinesis2stream_name: cloutrail_stream3aws_region: eu-west-14from_subscription: true5labels:6 type: aws-cloudtrail