Protective Monitoring - Cloudtrail Events

[mikereiddigital]

User Story

As a platform engineer we have been asked by the SecOps team (as part of the current Protective Monitoring work) to include Cloudtrail events as a dataset to be shared with them. As this is new requirement to the current PM work, this new ticket has been created.

Value / Purpose

This has been requested by the SecOps team and the scope of this needs to be properly assessed.

Useful Contacts

No response

Additional Information

Contacts - leonardo.marini@justice.gov.uk

Proposal / Unknowns

Definition of Done

• Documentation has been written / updated
• README has been updated
• User docs have been updated
• Another team member has reviewed
• Tests are green

[mikereiddigital]

Currently looking into how we use a firehose stream (and so most of the existing module) where the source of the data is an s3 bucket rather than a cloudwatch log group.

[mikereiddigital]

The SecOps team want to follow this approach - https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/Ingest-Audit-Logs-from-AWS-Cloud-Trail - the key question here being whether they can access the SQS queue via another account that they are already authenticated to or whether they will require more direct access. Will be talking again to Leo today to confirm this.

[mikereiddigital]

PR for the SQS resources - https://github.com/ministryofjustice/modernisation-platform/pull/6718/files

[mikereiddigital]

After a few more issues, SecOps are able to access the SQS & S3 and all appears to be working. Will monitor it tomorrow in case any issues are raised.