Configure the AWS Security Lake Plugin

1. In Cloud Exchange, go to Settings > Plugins.
2. Search for and select the Amazon Security Lake box to open the plugin creation dialog.

   

3. Enter a Configuration Name, like Amazon Security Lake.
4. Select a valid Mapping. (Default Mapping for all plugins are available. If you want to Create New Mapping, follow the CLS guide to Create New Mapping.)

   Note

   Here the Transform the raw logs toggle should be enabled as we cannot send data directly to AWS S3 Source Bucket because the lambda expects those files to be in a specific form (OCSF – Open Cybersecurity Schema Framework) in order to convert them into parquet files as per the requirement of Amazon Security Lake.

   

5. Click Next.
6. Enter these parameters:
   • Authentication Method:
     • Types of Authentication supported:
       • Deployed on AWS:
         • Follow these steps to use the “Deployed on AWS” authentication method.
       • IAM Role Anywhere:
         • Parameters required: Private Key File, Certificate Body, Password Phrase, Profile ARN, Role ARN & Trust Anchor ARN.
         • Follow these steps to use the “IAM Role Anywhere” authentication method.
   • Private Key File: Private Key File for decrypting the AWS Private CA Certificate for IAM Roles Anywhere authentication.
   • Certificate Body: Certificate body for AWS Public/Private CA Certificate for IAM Roles Anywhere authentication.

     

   • Password Phrase: Password Phrase for decrypting the CA Certificate for IAM Roles Anywhere authentication.
   • Profile ARN: AWS Profile ARN for IAM Roles Anywhere authentication.
   • Role Arn: AWS Role ARN for IAM Roles Anywhere authentication.
   • Trust Anchor ARN: AWS Trust Anchor ARN for IAM Roles Anywhere authentication.

     

   • AWS S3 Source Bucket Region: Region Name from where to get the AWS S3 Source Bucket. Make sure that the region name matches the region in the Profile ARN and Trust Anchor ARN.
   • AWS S3 Source Bucket: AWS S3 Source Bucket Name in which the data object will be stored. Note: If a bucket with the specified name does not exist in the selected region then a new bucket will be created. (Note: The value of this bucket name config. parameter in Netskope CE should be the same as source bucket name mentioned in CFN stack parameter. Also the bucket name mentioned here will only contain the logs sent from Netskope CE not the parquet converted files.)
7. Click Save.

   

Note: (optional) Use the steps in the following section to configure the plugin with Secret Vault HashiCorp.

Configure the Amazon Security Lake Plugin using Secret Vault HashiCorp (optional)

Use this configuration only if you are using Secret Vault HashiCorp. The Secret Vault HashiCorp securely stores and manages access to secrets such as passwords and passphrases (Certificates are not included in this).

1. Click on Settings > General > Secrets Manager.
2. Enable the Secrets Manager toggle button.

   

3. Select HashiCorp from the Secrets Manager dropdown.

   

4. Enter the Vault URL and Namespace.

   

5. Select Token for the Authentication Method and enter your token in the textbox.

   

6. Click Save.

   

7. After saving the Secrets Manager, go to Log Shipper > Plugins.
8. Configure the Amazon Security Lake plugin.
9. While configuring the plugin, for the parameter Password Phrase, a toggle button would be displayed.

   

10. Enable the toggle button.

    

11. Enter the path where the secret is stored.

    

12. Enter the other required parameters and click Save.

    

Note: The Secret Vault HashiCorp securely stores and manages access to secrets such as password field type. If the user wants, the user can encrypt the disk/partition to protect the mongodb for other field types.

Configure a Log Shipper Business Rule for AWS Security Lake

1. Go to Log Shipper > Business Rules.

   

2. Click Create New Rule.

   

3. Enter a Rule Name and select Filter(s). Enter a Folder Name, if any.
4. Click Save.

Configure a Log Shipper SIEM Mapping for AWS Security Lake

1. Go to Log Shipper > SIEM Mappings and click Add SIEM Mapping.

   

2. Select a Source Configuration, Destination Configuration, and Business Rule.
3. Click Save.