Collect AWS Network Firewall logs

Supported in:

Google SecOps SIEM

Note: This feature is covered by Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the Google Security Operations Technical Support Service guidelines and the Google Security Operations Service Specific Terms.

This document explains how to ingest AWS Network Firewall logs to Google Security Operations. AWS Network Firewall is a managed service that provides protection to your VPC against malicious traffic. By sending Network Firewall logs to Google SecOps, you can improve your monitoring, analysis, and threat detection.

Before You Begin

• Ensure that you have a Google SecOps instance.
• Ensure that you have privileged access to AWS.

Configure Logging for AWS Network Firewall

1. Sign in to the AWS Management Console.
2. Open the Amazon VPC console.
3. In the navigation pane, select Firewalls.
4. Select the name of the firewall that you want to edit.
5. Select the Firewall details tab.
6. In the Logging section, click Edit.
7. Select the log types: Flow, Alert and TLS.

8. For each selected log type, choose S3 for the destination type.

   Note: In order to change the destination for an existing log type, you must first disable logging for the policy.
   Then, edit the policy and specify the new destination(s) for the log type.

9. Click Save.

Configure a feed in Google SecOps to ingest AWS Network Firewall logs

1. Go to SIEM Settings > Feeds.
2. Click Add new.
3. In the Feed name field, enter a name for the feed (for example, AWS Network Firewall Logs).
4. Select Amazon S3 as the Source type.
5. Select AWS Network Firewall as the Log type.
6. Click Next.

7. Specify values for the following input parameters:

   • Region: the region where the Amazon S3 bucket is located.
   • S3 URI: the bucket URI.
     • s3://your-log-bucket-name/
       • Replace your-log-bucket-name with the actual name of the bucket.
   • URI is a: select Directory or Directory which includes subdirectories.

   • Source deletion options: select the deletion option according to your preference.

     Note: If you select the Delete transferred files or Delete transferred files and empty directories option, make sure that you granted appropriate permissions to the service account.

   • Access Key ID: the User access key with access to the S3 bucket.

   • Secret Access Key: the User secret key with access to the S3 bucket.

   • Asset namespace: the asset namespace.

   • Ingestion labels: the label to be applied to the events from this feed.

8. Click Next.

9. Review your new feed configuration in the Finalize screen, and then click Submit.

UDM Mapping Table

Log Field	UDM Mapping	Logic
availability_zone	target.resource.attribute.cloud.availability_zone	Directly mapped from the availability_zone field.
event.app_proto	network.application_protocol	Directly mapped from the event.app_proto field, converted to uppercase if not one of the specified values (ikev2, tftp, failed, snmp, tls, ftp). HTTP2 is replaced with HTTP.
event.dest_ip	target.ip	Directly mapped from the event.dest_ip field.
event.dest_port	target.port	Directly mapped from the event.dest_port field, converted to integer.
event.event_type	additional.fields[event_type_label].key	The key is hardcoded as "event_type".
event.event_type	additional.fields[event_type_label].value.string_value	Directly mapped from the event.event_type field.
event.flow_id	network.session_id	Directly mapped from the event.flow_id field, converted to string.
event.netflow.age	additional.fields[netflow_age_label].key	The key is hardcoded as "netflow_age".
event.netflow.age	additional.fields[netflow_age_label].value.string_value	Directly mapped from the event.netflow.age field, converted to string.
event.netflow.bytes	network.sent_bytes	Directly mapped from the event.netflow.bytes field, converted to unsigned integer.
event.netflow.end	additional.fields[netflow_end_label].key	The key is hardcoded as "netflow_end".
event.netflow.end	additional.fields[netflow_end_label].value.string_value	Directly mapped from the event.netflow.end field.
event.netflow.max_ttl	additional.fields[netflow_max_ttl_label].key	The key is hardcoded as "netflow_max_ttl".
event.netflow.max_ttl	additional.fields[netflow_max_ttl_label].value.string_value	Directly mapped from the event.netflow.max_ttl field, converted to string.
event.netflow.min_ttl	additional.fields[netflow_min_ttl_label].key	The key is hardcoded as "netflow_min_ttl".
event.netflow.min_ttl	additional.fields[netflow_min_ttl_label].value.string_value	Directly mapped from the event.netflow.min_ttl field, converted to string.
event.netflow.pkts	network.sent_packets	Directly mapped from the event.netflow.pkts field, converted to integer.
event.netflow.start	additional.fields[netflow_start_label].key	The key is hardcoded as "netflow_start".
event.netflow.start	additional.fields[netflow_start_label].value.string_value	Directly mapped from the event.netflow.start field.
event.proto	network.ip_protocol	Directly mapped from the event.proto field. If the value is "IPv6-ICMP", it's replaced with "ICMP".
event.src_ip	principal.ip	Directly mapped from the event.src_ip field.
event.src_port	principal.port	Directly mapped from the event.src_port field, converted to integer.
event.tcp.syn	additional.fields[syn_label].key	The key is hardcoded as "syn".
event.tcp.syn	additional.fields[syn_label].value.string_value	Directly mapped from the event.tcp.syn field, converted to string.
event.tcp.tcp_flags	additional.fields[tcp_flags_label].key	The key is hardcoded as "tcp_flags".
event.tcp.tcp_flags	additional.fields[tcp_flags_label].value.string_value	Directly mapped from the event.tcp.tcp_flags field.
event_timestamp	metadata.event_timestamp.seconds	Directly mapped from the event_timestamp field, parsed as a timestamp.
event_timestamp	timestamp.seconds	Directly mapped from the event_timestamp field, parsed as a timestamp.
firewall_name	metadata.product_event_type	Directly mapped from the firewall_name field. Set to "NETWORK_CONNECTION" if both event.src_ip and event.dest_ip are present, otherwise set to "GENERIC_EVENT". Hardcoded to "AWS Network Firewall". Hardcoded to "AWS".

Changes

2023-05-05

• Newly created parser.

Need more help? Get answers from Community members and Google SecOps professionals.