Skip to content

Commit 9c7bf6d

Browse files
rjjaegerawsBrian969
rjjaegeraws
and
Brian969
authored
Doc Update: AddOn OpenSearch SIEM Readme (#946)
* update readme * add diagram of logging architecture Co-authored-by: Brian969 <56414362+Brian969@users.noreply.github.com>
1 parent 01b470e commit 9c7bf6d

File tree

3 files changed

+26
-20
lines changed

3 files changed

+26
-20
lines changed

‎docs/architectures/images/ASEA-Logging-Arch.png‎

13 KB
Loading

‎reference-artifacts/Add-ons/opensiem/README.md‎

Lines changed: 25 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ At a highlevel, the deployment steps consist of the following:
1212

1313
The total deployment time takes approximately 30 minutes (+ ASEA State Machine execution time). The AWS resources deployed extend beyond the AWS Free tier; you will incur AWS charges when this solution is deployed.
1414

15+
The following diagram details the ASEA + OpenSIEM Add-On logging architecture. The OpenSIEM Add-On components are documented in turquoise on the right side of the diagram in both the log-archive and the operations accounts.
16+
17+
![Logging](../../../docs/architectures/images/ASEA-Logging-Arch.png)
18+
1519
## Prerequisites
1620

1721
1. ASEA v1.5.1 or above
@@ -54,6 +58,7 @@ The **SiemConfig.json** file is used to configure how this solution is deployed
5458
443
5559
],
5660
"source": [
61+
"------ REPLACE -----",
5762
"10.0.0.0/8",
5863
"100.96.252.0/23",
5964
"100.96.250.0/23"
@@ -91,26 +96,26 @@ The **SiemConfig.json** file is used to configure how this solution is deployed
9196
}
9297
```
9398

94-
| Config | Description |
95-
| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
96-
| operationsAccountId | This is the AWS Account ID for the Operations account |
97-
| logArchiveAccountId | This is the AWS Account ID for the Log Archive account |
98-
| vpcId | This is the VPC Id, within the Operations account, where the OpenSearch Domain will be deployed |
99-
| region | This is the ASEA primary or home region |
100-
| s3LogBuckets | This contains a string array of the S3 Bucket names, in the Log Archive account, that will have S3 Notifications configured. In the default ASEA architecture, there are 2 S3 buckets that should be added here. |
101-
| securityGroups | This structure is similar to what is used in the ASEA config file, but with reduced implementation. The security groups here will be applied to the Lambda Functions and OpenSearch domain. The Security Groups will be created by this project. |
102-
| appSubnets | These are the SubnetIds of existing subnets within the VPC. The Lambda Functions and OpenSearch domain will be deployed into the Subnets defined here. |
103-
| lambdaLogProcessingRoleArn | This is the IAM Role that the **Lambda Processor** will use to download S3 Objects from the Log Archive and write documents to OpenSearch. This is a protected role that is referenced by this project, but created by the ASEA. More details below. This value must be an IAM ARN. |
104-
| cognitoDomainPrefix | Amazon Cognito is used to provision user access to the OpenSearch Dashboards. The value specified here will be used as the domain; it must be regionally unique. (You can't use the text aws, amazon, or cognito, in the domain prefix) |
105-
| openSearchDomainName | This is the name for the OpenSearch domain |
106-
| openSearchInstanceTypeMainNodes | This specifies the OpenSearch instance type for the main nodes. ([Supported Types](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/supported-instance-types.html)) |
107-
| openSearchInstanceTypeDataNodes | This specifies the OpenSearch instance type for the data nodes. ([Supported Types](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/supported-instance-types.html)) |
108-
| openSearchCapacityMainNodes | This specifies the number of OpenSearch main nodes to provision. |
109-
| openSearchInstanceTypeDataNodes | This specifies the number of OpenSearch data nodes to provision. |
110-
| openSearchVolumeSize | This specifies the amount of storage (GB) provisioned for the data nodes. This impacts the amount of available storage for the Domain. Note there are [limits](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/limits.html) for EBS size for instance types. |
111-
| openSearchConfiguration | This is the file name of the SIEM search configuration. This file should reside in the _config_ folder. This json file mirrors the content found in the _SIEM on Amazon OpenSearch Service_ corresponding INI file. |
112-
| maxmindLicense | This is the file name of the MaxMind license file. This file should reside in the _config_ folder. This is an optional configuration that enables IP to Geo which enables map visualizations. Leave blank ("") to skip the deployment of this functionality. |
113-
| siemVersion | This is a label used to identitfy the _SIEM on Amazon OpenSearch Service_ or your own version/configuration of the Lambdas. This applies an environment variable to the Lambdas and a change to this value will execute the lambdas on CDK deployment. |
99+
| Config | Description |
100+
| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
101+
| operationsAccountId | This is the AWS Account ID for the Operations account |
102+
| logArchiveAccountId | This is the AWS Account ID for the Log Archive account |
103+
| vpcId | This is the VPC Id, within the Operations account, where the OpenSearch Domain will be deployed |
104+
| region | This is the ASEA primary or home region |
105+
| s3LogBuckets | This contains a string array of the S3 Bucket names, in the Log Archive account, that will have S3 Notifications configured. In the default ASEA architecture, there are 2 S3 buckets that should be added here. |
106+
| securityGroups | This structure is similar to what is used in the ASEA config file, but with reduced implementation. The security groups here will be applied to the Lambda Functions and OpenSearch domain. The Security Groups will be created by this project. The inbound rules should be updated to reflect the allowed IPs. In the example, the IP range is the VPC CIDR in the Operations AWS account. |
107+
| appSubnets | These are the SubnetIds of existing subnets within the VPC. The Lambda Functions and OpenSearch domain will be deployed into the Subnets defined here. |
108+
| lambdaLogProcessingRoleArn | This is the IAM Role that the **Lambda Processor** will use to download S3 Objects from the Log Archive and write documents to OpenSearch. This is a protected role that is referenced by this project, but created by the ASEA. More details below. This value must be an IAM ARN. |
109+
| cognitoDomainPrefix | Amazon Cognito is used to provision user access to the OpenSearch Dashboards. The value specified here will be used as the domain; it must be regionally unique. (You can't use the text aws, amazon, or cognito, in the domain prefix) |
110+
| openSearchDomainName | This is the name for the OpenSearch domain |
111+
| openSearchInstanceTypeMainNodes | This specifies the OpenSearch instance type for the main nodes. ([Supported Types](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/supported-instance-types.html)) |
112+
| openSearchInstanceTypeDataNodes | This specifies the OpenSearch instance type for the data nodes. ([Supported Types](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/supported-instance-types.html)) |
113+
| openSearchCapacityMainNodes | This specifies the number of OpenSearch main nodes to provision. |
114+
| openSearchInstanceTypeDataNodes | This specifies the number of OpenSearch data nodes to provision. |
115+
| openSearchVolumeSize | This specifies the amount of storage (GB) provisioned for the data nodes. This impacts the amount of available storage for the Domain. Note there are [limits](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/limits.html) for EBS size for instance types. |
116+
| openSearchConfiguration | This is the file name of the SIEM search configuration. This file should reside in the _config_ folder. This json file mirrors the content found in the _SIEM on Amazon OpenSearch Service_ corresponding INI file. |
117+
| maxmindLicense | This is the file name of the MaxMind license file. This file should reside in the _config_ folder. This is an optional configuration that enables IP to Geo which enables map visualizations. Leave blank ("") to skip the deployment of this functionality. |
118+
| siemVersion | This is a label used to identitfy the _SIEM on Amazon OpenSearch Service_ or your own version/configuration of the Lambdas. This applies an environment variable to the Lambdas and a change to this value will execute the lambdas on CDK deployment. |
114119

115120
---
116121

‎reference-artifacts/Add-ons/opensiem/SiemConfig.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
443
1818
],
1919
"source": [
20+
"------ REPLACE -----",
2021
"10.0.0.0/8",
2122
"100.96.252.0/23",
2223
"100.96.250.0/23"

0 commit comments

Comments
 (0)