Aws Cloudwatch Vpc Flow

LogZilla App Store application: Aws Cloudwatch Vpc Flow

Overview

Amazon Web Services (AWS) CloudWatch is a monitoring and observability service for use with AWS services. CloudWatch collects monitoring and operational data in the form of logs, metrics, and events. CloudWatch can be used to detect anomalous behavior, set alarms, visualize logs and metrics side by side, take automated actions, troubleshoot issues, and discover insights to keep applications running smoothly.

AWS VPC Flow Logs is a feature to capture information about the IP traffic going to and from network interfaces in a VPC.

App Function

The AWS CloudWatch VPC Flow app parses AWS VPC Flow logs received via AWS CloudWatch and creates user tags corresponding to many of the data elements present in each log message.

Device Configuration

VPC Flow Logs are forwarded to LogZilla using AWS Kinesis Data Firehose. For complete setup instructions, see the LogZilla documentation: AWS CloudWatch Kinesis Setup.

Summary:

  1. Enable VPC Flow Logs in the AWS Console for the desired VPC
  2. Configure CloudWatch Logs as the destination
  3. Create a Kinesis Data Firehose delivery stream with LogZilla's /firehose endpoint as the HTTP destination
  4. Create a CloudWatch subscription filter to forward logs to the Firehose delivery stream

Vendor Documentation

Incoming Log Format

VPC Flow Logs are received from Amazon CloudWatch by means of a CloudWatch web hook. CloudWatch conveys the log messages to LogZilla by sending them to LogZilla's HTTP port as JSON messages. LogZilla then parses the CloudWatch log format and extracts the specific flow log information.

The flow log information is a fixed-order sequence of space-separated data elements. There are no field keys or names, the meaning must be derived from the data ordering.

Event Classes

The app categorizes events into the following Event Classes:

Event ClassDescriptionAction
networkNormal traffic flowsACCEPT
securityBlocked traffic (potential threats)REJECT

Parsed Metadata Fields

The app extracts the following user tags from VPC Flow log messages:

Tag NameDescription
ActionFlow action (ACCEPT/REJECT)
Availability ZoneAWS availability zone ID
DstIPDestination IP address
DstPortDestination port/service
Flow DirectionTraffic direction
Instance IDEC2 instance identifier
Interface IDNetwork interface ID
Log StatusLogging status
ProtocolNetwork protocol name
RegionAWS region
SrcIPSource IP address
TCP FlagsTCP flags
TypeTraffic type (IPv4/IPv6/EFA)
VPC IDVPC identifier
MitreIdMITRE ATT&CK technique (for blocked admin protocols)
MITRE TacticMITRE ATT&CK tactic category

MITRE ATT&CK Mapping

EventMITRE TechniqueTactic
SSH/RDP/Telnet blockedT1110 (Brute Force)Credential Access

Log Examples

Incoming SSH Connection Accepted (format 1)

text
2 123456789010 eni-1235b8ca123456789 172.31.16.139 172.31.16.21
20641 22 6 20 4249 1418530010 1418530070 ACCEPT OK

Incoming SSH Connection Accepted (format 2)

text
123456789010 ACCEPT apse2-az3 4249 172.31.16.21 22 1418530070
ingress eni-1235b8ca123456789 eni-0c0d52089ed3b20ba OK 20 -
4.3.2.1 - 1.2.3.4 6 us-east-1 172.31.16.139 20641 1418530010 - -
subnet-vf0-88683c 18 8 IPv4 5 vpc-12345

Dashboards

The AWS VPC Flow app includes the following dashboards:

  • AWS VPC Flow: Network - Accepted traffic flows, protocols, ports, regions
  • AWS VPC Flow: Security - Rejected traffic, blocked sources, MITRE mapping

Triggers

TriggerDescriptionActionable
AWS VPC: MITRE ATT&CK Threat DetectedAny MITRE-mapped threatYes
AWS VPC: SSH BlockedBlocked SSH connection attemptsYes
AWS VPC: RDP BlockedBlocked RDP connection attemptsYes
AWS VPC: Telnet BlockedBlocked Telnet connection attemptsYes
AWS VPC: SMB BlockedBlocked SMB/NetBIOS (ransomware indicator)Yes
AWS VPC: Database Access BlockedBlocked database port accessYes
AWS VPC: Traffic RejectedAny rejected trafficNo
Aws Cloudwatch Vpc Flow | LogZilla Documentation