AWS Security Lake Plugin for Log Shipper

This document explains how to configure the AWS Security Lake v1.1.0 integration with the Log Shipper module of the Netskope Cloud Exchange platform.

Prerequisites

• A Netskope tenant (or multiple, for example, production and development/test instances) that is already configured in Cloud Exchange.
• A Netskope Cloud Exchange tenant with the Log Shipper module already configured.
• A Netskope Cloud Exchange tenant with the Netskope CLS and Netskope WebTX plugins already configured. Links for the configuration guides are:
  • For Alerts and Events – Netskope CLS
  • For Web Transaction Logs – Netskope WebTX
• Amazon S3 bucket permissions for the IAM user.
  • ListBucket
  • CreateBucket
  • ListAllMyBuckets
  • GetBucketPolicy
  • GetBucketPublicAccessBlock
  • PutEncryptionConfiguration
  • PutBucketPublicAccessBlock
  • PutBucketPolicy
• An Amazon Security Lake enabled AWS account. References: https://docs.aws.amazon.com/security-lake/latest/userguide/ and https://aws.amazon.com/security-lake/.
• AWS Lambda configured as mentioned here.

Plugin Flow

Amazon Security Lake Plugin Support

Event Support	Yes
Alert Support	Yes
WebTx Support	Yes

All Netskope events, alert logs, and web transaction logs will be shared.

Compatibility

Netskope CE: v4.1.0 and v4.2.0

Performance Matrix

This performance reading is for a Large Stack CE with the below mentioned VM specifications.

Stack Size	Large RAM: 32 GB Core: 16
Alerts/Events	~ 6 MBps
WebTx	~ 6 MBps

Workflow

Click play to watch a video.

• AWS Configuration
• Configure the AWS Security Lake Plugin
• Plugin Authentication Methods
• Validate the Amazon Security Lake Plugin
• Troubleshooting the Amazon Security Lake Plugin
• Mappings Field Descriptions