Configure CDR and CIEM for AWS

Log ingestion relies on AWS EventBridge to access AWS service events, and analyzes threats through Falco-based policies, rules, and machine learning policies.

Prerequisites

• You must have an AWS Account or Organization already connected to Sysdig.
• Access to a User with the permissions required to install.
• You must have (at least) one CloudTrail Trail in the accounts to be monitored. GuardDuty findings are ingested if the service is enabled in the AWS Accounts.

Set Up Log Ingestion

1. Log in to Sysdig Secure, and select Integrations > Cloud Accounts | AWS.

2. Select an account that is part of the Organization you would like to add features to, or the individual Account you onboarded.

   The detail panel appears on the right. Here, you can see a list of features.

3. To set up log ingestion, select Select Identity and Access Management (CIEM) or Setup Cloud Detection and Response (CDR). Both features require log ingestion.

The Organization Overview page appears. You can see which features are enabled and which are not enabled.

4. Beside Log Ingestion, select Go to Setup.

5. Follow the steps in the onboarding wizard.

6. Verify the details of your Organization or Account where the features will be added.

7. Select the regions from which events will be sent to Sysdig.

   AWS logs global service events to us-east-1 region. Without this region in your AWS setup, you might miss key events, including IAM events. Ensure you select us-east-1 plus any other AWS regions you currently use for the account.

8. Create a log_ingestion.tf file in the folder that contains your main.tf.

9. Copy the snippet provided into the log_ingestion.tf file.

By default, the snippet enables both CIEM and CDR. To disable one of these features, see Disable Features.

10. Run the command: terraform init && terraform apply.

(Optional) CDR Monitoring of S3 buckets via Notifications

Optionally, you can enable Data Events in AWS CloudTrail through granular configuration of S3 buckets. Agentless AWS Cloud Threat Detection (CDR) can monitor operations performed on objects stored in AWS Simple Storage Service (S3) buckets through S3 notifications. To learn about supported event types, see AWS’s documentation on EventBridge. To enable this function, see Enabling Amazon EventBridge. Once enabled, the events from those buckets will be forwarded to Sysdig and processed using the configured policies and rules.

Disable Features

When you configure a Log Ingestion component, both CIEM and CDR are enabled by default.

To disable either of these features, comment out the relevant stanza in the Terraform snippet:

1. Retrieve the log_ingestion.tf Terraform snippet from the onboarding wizard as described in Set Up Log Ingestion.

2. To disable CIEM comment out:

   resource "sysdig_secure_cloud_auth_account_feature" "identity_entitlement" {
       account_id = module.onboarding.sysdig_secure_account_id
       type       = "FEATURE_SECURE_IDENTITY_ENTITLEMENT"
       enabled    = true
       components = [module.event-bridge.event_bridge_component_id]
       depends_on = [module.event-bridge, sysdig_secure_cloud_auth_account_feature.config_posture]
   }
   

3. To disable CDR, comment out:

   resource "sysdig_secure_cloud_auth_account_feature" "threat_detection" {
       account_id = module.onboarding.sysdig_secure_account_id
       type       = "FEATURE_SECURE_THREAT_DETECTION"
       enabled    = true
       components = [module.event-bridge.event_bridge_component_id]
       depends_on = [module.event-bridge]
   }
   

4. Run terraform init && terraform apply.

We recommend commenting out the stanza instead of removing it entirely. If you want to enable a disabled feature, un-comment the stanza.

Advanced Customization

The Log Ingestion component creates an EventBridge rule that sends events matching the conditions defined in an event pattern. You can customize this behavior either through the UI or directly using Terraform/CFT.

Customize Log Ingestion Using the UI

1. Login to Sysdig Secure.
2. Go to Integrations > AWS.
3. Select the account you want to configure the Log Ingestion component for.
4. Configure either Identity and Access Management or Cloud Detection and Response.
   The Account Overview page opens.
5. Click Go to Setup next to Log Ingestion.
   The wizard opens.
6. Under Select Sources (optional), choose Guided customization and select the sources you want to use.

Customize Log Ingestion Using Terraform

To customize Log Ingestion directly in Terraform, modify the event_pattern parameter in the event-bridge module.

module "event_bridge" {
  ...
  event_pattern = <<EOF
{
  "detail-type": [
    "AWS API Call via CloudTrail"
  ],
  "detail": {
    "eventCategory": [
      "Management"
    ]
  }
}
EOF
}

To customize this in the CFT stack creation, edit the EventBridge Rule Event Pattern parameter and provide the JSON pattern. Use the heredoc content from the example above (the text between the two EOF markers).

Check Connection Status

To check the connection status:

1. Log in to Sysdig Secure and select Integrations > Cloud Accounts | AWS.

2. Select your account.

   The detail panel appears on the right.

   If the connection is successful, you will see the feature as Connected. This may take up to 5 minutes after deploying the Terraform.