Amazon Web Services (AWS)용 Security Command Center 선별된 감지, 위협 조사, 클라우드 인프라 사용 권한 관리(CIEM) 기능을 사용하려면 Google SecOps 수집 파이프라인을 사용해서 AWS 로그를 수집해야 합니다. 수집에 필요한 AWS 로그 유형은 구성 중인 항목에 따라 다릅니다.
AWS 환경의 발견 항목을 생성하려면 클라우드 인프라 사용 권한 관리(CIEM) 기능에 AWS CloudTrail 로그의 데이터가 필요합니다.
CIEM을 사용하려면 AWS 로그 수집을 구성할 때 다음을 수행합니다.
AWS CloudTrail을 설정할 때 다음 구성 단계를 완료합니다.
다음 중 하나를 만듭니다.
모든 AWS 계정에서 로그 데이터를 가져오는 조직 수준 트레일
선택한 AWS 계정에서 로그 데이터를 가져오는 계정 수준 트레일
CIEM에 선택한 Amazon S3 버킷 또는 Amazon SQS 큐를 설정하여 모든 리전의 관리 이벤트를 로깅합니다.
Security Operations 콘솔 피드 페이지를 사용하여 AWS 로그를 수집하도록 피드를 설정할 때 다음 구성 단계를 완료합니다.
모든 리전의 Amazon S3 버킷 또는 Amazon SQS 대기열에서 모든 계정 로그를 수집하는 피드를 만듭니다.
다음 옵션 중 하나를 사용하여 피드 소스 유형에 따라 피드 수집 라벨 키-값 쌍을 설정합니다.
소스 유형이 Amazon S3인 경우 다음 중 하나를 구성합니다.
15분마다 데이터를 추출하려면 라벨을 CIEM로, 값을 TRUE로 설정합니다.
15분의 데이터 지연 시간이 허용되는 다른 Security Command Center 서비스에 이 피드를 재사용할 수 있습니다.
12시간마다 데이터를 추출하려면 라벨을 CIEM_EXCLUSIVE로, 값을 TRUE로 설정합니다. 이 옵션은 24시간 데이터 지연 시간이 허용되는 CIEM 및 기타 잠재적인 Security Command Center 서비스에 적합합니다.
소스 유형이 Amazon SQS인 경우 라벨을 CIEM로, 값을 TRUE로 설정합니다.
로그 수집을 올바르게 구성하지 않으면 CIEM 감지 서비스에 잘못된 결과가 표시될 수 있습니다. 또한 CloudTrail 구성에 문제가 있으면 Security Command Center에 CIEM AWS CloudTrail configuration error 아이콘이 표시됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["| Enterprise [service tier](/security-command-center/docs/service-tiers)\n\nThe Security Command Center curated detections, threat investigation, and\nCloud Infrastructure Entitlement Management (CIEM) capabilities for Amazon Web Services\n(AWS) require the ingestion of AWS logs using the Google SecOps\ningestion pipeline. The AWS log types required for ingestion differ based on\nwhat you are configuring:\n\n- CIEM requires data from the AWS CloudTrail log type.\n- Curated detections require data from multiple AWS log types.\n\nTo learn more about the different AWS log types, see [Supported devices and log\ntypes](/chronicle/docs/detection/cloud-threats-category#aws-log-types).\n\nConfigure AWS log ingestion for CIEM\n\nTo generate findings for your AWS environment, the Cloud Infrastructure Entitlement Management (CIEM)\ncapabilities require data from AWS CloudTrail logs.\n\nTo use CIEM, do the following when configuring AWS log ingestion.\n\n1. When setting up your AWS CloudTrail, complete the following configuration\n steps:\n\n 1. Create one of the following:\n\n - An organization-level trail that pulls log data from across all AWS accounts.\n - An account-level trail that pulls log data from select AWS accounts.\n\n | **Note:** For an account-level trail, Security Command Center won't be able to detect all lateral movement risks.\n 2. Set the Amazon S3 bucket or Amazon SQS queue you choose for CIEM\n to log **management events** from *all regions*.\n\n2. When setting up a feed to ingest AWS logs using the Security Operations console\n **Feeds** page, complete the following configuration steps:\n\n 1. Create a feed that ingests all account logs from the Amazon S3 bucket or Amazon SQS queue for *all regions*.\n 2. Set the feed **Ingestion labels** key-value pair based on the feed source\n type, using one of the following options:\n\n - If the **Source type** is **Amazon S3**, configure one of the following:\n\n - To extract data every 15 minutes, set the **Label** to `CIEM` and the **Value** to `TRUE`. You can reuse this feed for other Security Command Center services where a 15-minute data latency is acceptable.\n - To extract data every 12 hours, set the **Label** to `CIEM_EXCLUSIVE` and the **Value** to `TRUE`. This option works for CIEM and other potential Security Command Center services where a 24-hour data latency is acceptable.\n - If the **Source type** is **Amazon SQS** , set the **Label** to `CIEM`\n and the **Value** to `TRUE`.\n\nIf you don't configure log ingestion correctly, the CIEM\ndetection service might display incorrect findings. In addition, if there are\nissues with your CloudTrail configuration, Security Command Center displays the\n[`CIEM AWS CloudTrail configuration error`](/security-command-center/docs/how-to-remediate-scc-errors#ciem-cloudtrail-troubleshoot).\n\nTo configure log ingestion, see [Ingest AWS logs into Google Security Operations](/chronicle/docs/ingestion/ingest-aws-logs-into-chronicle)\nin the Google SecOps documentation.\n\nFor full instructions on enabling CIEM, see\n[Enable the CIEM detection service for AWS](/security-command-center/docs/ciem-enable-service).\nFor more information about CIEM features, see\n[Overview of Cloud Infrastructure Entitlement Management](/security-command-center/docs/ciem-overview).\n\nConfigure AWS log ingestion for curated detections\n\nCurated detections available with Security Command Center Enterprise help identify\nthreats in AWS environments using both event and context data.\n\nEach [AWS rule set](/chronicle/docs/detection/cloud-threats-category#aws-rule-sets)\nrequires certain data to function as designed, including one or more of the\nfollowing sources:\n\n- AWS CloudTrail\n- AWS GuardDuty\n- AWS context data about hosts, services, and VPCs.\n- AWS Identity and Access Management\n\nTo use these curated detections, you must ingest AWS log data to the Google SecOps tenant, and then enable the curated detection rules.\n\nFor more information, see the following in the Google SecOps\ndocumentation:\n\n- [Supported devices and log types for AWS](/chronicle/docs/detection/cloud-threats-category#aws-log-types): information about data required by\n the AWS rule sets.\n\n- [Ingest AWS logs into Google Security Operations](/chronicle/docs/ingestion/ingest-aws-logs-into-chronicle): steps to collect AWS CloudTrail logs.\n\n- [Curated detections for AWS data](/chronicle/docs/detection/cloud-threats-category#aws-rule-sets): summary of the AWS rule sets in the\n Cloud Threats curated detections.\n\n- [Use curated detections to identify threats](/chronicle/docs/detection/use-curated-detections): how to use curated detections in\n Google SecOps.\n\nSee [Google Cloud service tiers](/security-command-center/docs/service-tiers#aws-logs)\nfor information about the type of log data that customers with Security Command Center\nEnterprise can ingest to the Google SecOps tenant."]]
