AWS

AWS CloudTrail Logs

Go to Loggers > Loggers and add a logger. For details, see Loggers. To encrypt logs, you must first create an encrypted table in System > Tables.

The main fields are as follows.

• Name: Unique name to identify the logger
• Interval (sec.): 600
• Storage/Data Source: Select appropriate nodes based on your Logpresso platform configuration
• Logger Model: Select AWS CloudTrail
• Table: Enter a name starting with AWS_CLOUDTRAIL
• S3 Bucket Region: Region of the S3 bucket where AWS CloudTrail logs are stored
• S3 Bucket Name: Name of the S3 bucket where AWS CloudTrail logs are stored
• Monitoring period: Period range of logs to collect (default: 0)
• AWS Profile: Name of the AWS connection profile

AWS GuardDuty Logs

In the GuardDuty console, you can enable exporting findings and configure them to be stored in S3. The AWS GuardDuty logger collects logs stored in the S3 bucket.

The main fields are as follows.

• Name: Unique name to identify the logger
• Interval (sec.): 600
• Storage/Data Source: Select appropriate nodes based on your Logpresso platform configuration
• Logger Model: Select AWS GuardDuty
• Table: Enter a name starting with AWS_GUARDDUTY
• S3 Bucket Region: Region of the S3 bucket where AWS GuardDuty logs are stored
• S3 Bucket Name: Name of the S3 bucket where AWS GuardDuty logs are stored
• Monitoring period: Period range of logs to collect (default: 0)
• AWS Profile: Name of the AWS connection profile

AWS WAF Logs

First, in the AWS WAF console, open Protection packs (web ACLs), select your web ACL, and configure logging to an S3 bucket on the Configure logging page. When logging is configured, the Logging destination shows the Amazon S3 bucket and the Status changes to Enabled.

Go to Loggers > Loggers and add a logger.

The main fields are as follows.

• Name: Unique name to identify the logger
• Interval (sec.): 600
• Storage/Data Source: Select appropriate nodes based on your Logpresso platform configuration
• Logger Model: Select AWS WAF
• Table: Enter a name starting with AWS_WAF
• S3 Bucket Region: Region of the S3 bucket where AWS WAF logs are stored
• S3 Bucket Name: Name of the S3 bucket where AWS WAF logs are stored
• WAF ACL Name: Name of the web access control list
• Monitoring period: Period range of logs to collect (default: 0)
• AWS Profile: Name of the AWS connection profile

AWS Shield Logs

The main fields are as follows.

• Name: Unique name to identify the logger
• Interval (sec.): 600
• Storage/Data Source: Select appropriate nodes based on your Logpresso platform configuration
• Logger Model: Select AWS Shield
• Table: Enter a name starting with AWS_SHIELD
• AWS Profile: Name of the AWS connection profile

AWS ALB Logs

On the Attributes tab of the AWS load balancer, you can enable access logs and store them in an S3 bucket. The AWS ALB logger collects the access logs stored in the S3 bucket.

The main fields are as follows.

• Name: Unique name to identify the logger
• Interval (sec.): 600
• Storage/Data Source: Select appropriate nodes based on your Logpresso platform configuration
• Logger Model: Select AWS ALB
• Table: Enter a name starting with AWS_ALB
• S3 Bucket Region: Region of the S3 bucket where AWS ALB logs are stored
• S3 Bucket Name: Name of the S3 bucket where AWS ALB logs are stored
• Monitoring period: Period range of logs to collect (default: 0)
• AWS Profile: Name of the AWS connection profile

AWS Aurora DB Logs

The main fields are as follows.

• Name: Unique name to identify the logger
• Interval (sec.): 600
• Storage/Data Source: Select appropriate nodes based on your Logpresso platform configuration
• Logger Model: Select AWS Aurora DB Activity
• Table: Enter a name starting with DBAC_AURORA
• AWS Profile: Name of the AWS connection profile
• AWS SQS URL: Endpoint URL of the AWS SQS queue (e.g., https://sqs.ap-northeast-2.amazonaws.com/ACCOUNT_ID/logpresso-aws-aurora-das.fifo)

AWS Network Firewall Logs

In the Network Firewall console, edit the firewall's Logging configuration to store alert, flow, and TLS logs in an S3 bucket. The AWS Network Firewall logger collects the logs stored in the S3 bucket.

The main fields are as follows.

• Name: Unique name to identify the logger
• Interval (sec.): 600
• Storage/Data Source: Select appropriate nodes based on your Logpresso platform configuration
• Logger Model: Select AWS Network Firewall
• Table: Enter a name starting with AWS_NETWORK_FIREWALL
• S3 Bucket Region: Region of the S3 bucket where AWS Network Firewall logs are stored
• S3 Bucket Name: Name of the S3 bucket where AWS Network Firewall logs are stored
• S3 Bucket Prefix: The S3 bucket prefix set in the logging configuration, if any (without leading or trailing /)
• Monitoring period: Period range of logs to collect (default: 0)
• AWS Profile: Name of the AWS connection profile

AWS S3 Daily Rolling Directory Watcher Logs

To create an AWS S3 Daily Rolling Directory Watcher logger, you must first add a logger model. AWS S3 Daily Rolling Directory Watcher collection is supported from AWS app version 1.6.2501.0.

Go to Loggers > Logger Models and add a logger model. For details, see Logger Models.

• Name: Unique name to identify the logger model
• Type: Select AWS S3 Daily Rolling Directory Watcher
• Log Schema Rules: Original is selected by default

Go to Loggers > Loggers and add a logger with the logger model created above.

The required fields are as follows.

• Name: Unique name to identify the logger
• Interval (sec.): 600
• Storage/Data Source: Select appropriate nodes based on your Logpresso platform configuration
• Logger Model: Select the logger model created above
• Table: Enter the name of the table to store logs
• AWS profile: Name of the AWS connection profile
• S3 bucket region: Region of the AWS S3 bucket where the logs to collect are stored
• S3 bucket name: Name of the AWS S3 bucket where the logs to collect are stored
• Target pattern: Regular expression to validate the names of the S3 objects to collect
• Date format: Format used to parse the date from the S3 object name (yyyy/MM/dd by default)

To collect multi-line logs or to specify the collection period, enter the following optional fields. The first/last line regex options and the date pattern option are supported from AWS app version 1.7.2504.0.

• Date pattern: Regular expression used to extract the date and time
• Regex for first line: Regular expression to recognize the start of a new log (used for multi-line logs)
• Regex for last line: Regular expression to recognize the end of a log (used for multi-line logs)
• Monitoring period: Period range of logs to collect (in days)
• EOF Flush: Collects the remaining content as a log when the end of the file is reached.
• Full scan: When set to true, scans every path in the S3 bucket each cycle. (default: false)