Skip to content

AWS Application Load Balancer (ALB) Logs Integration Guide🔗

The following instructions are for configuring an AWS ALBLogs integration to facilitate log ingestion into Secureworks® Taegis™ XDR.

Note

The following should be done in the same AWS region as your AWS ALB Logs bucket.

Data Provided from Integrations🔗

Normalized Data Out-of-the-Box Detections Vendor-Specific Detections
AWS Application Load Balancer   HTTP  

Note

XDR detectors are not guaranteed to be triggered, even if a data source's logs are normalized to a schema associated with a given detector. However, you can create Custom Detection Rules to generate detections based on normalized data from a data source.

Set Up AWS ALB🔗

Note

If you do not have login access to XDR, have someone who does help you complete any steps that require access. You can also contact your Secureworks® representative for help.

  1. From the Taegis Menu, select Integrations → Cloud APIs.

  2. Select Add an Integration from the top of the page.

    Add an Integration

  3. From the Optimized tab, choose AWS and then select Set Up under AWS ALB.

    Set up AWS ALB Integration

  4. Select Next.

  5. Enter the Taegis Integration Name. This serves as a unique name for your integration; it can include any valid values up to 100 characters.
  6. Select Done. The CloudFormation template will automatically download as taegis-cloudformation-lambda-template.yaml.

Upload the CloudFormation Template to S3 (Optional)🔗

  1. Log in to the AWS Console for the region (e.g., https://us-east-1.console.aws.amazon.com/cloudformation) with an account that has permissions to create roles, lambdas, secrets, and policies, or using a role that can assume another role with these permissions.
  2. In the Storage section, select S3.
  3. Create a new bucket or locate an existing bucket in which to store the CloudFormation template. The bucket does not need to be public, versioned, or encrypted.

  4. Upload taegis-cloudformation-lambda-template.yaml to the same bucket.

    Tip

    Take note of the bucket name and the key, including any prefix. These identifiers are needed when you create a stack.

Create the Lambda Stack🔗

  1. Log in to the AWS Console for the region (e.g., https://us-east-1.console.aws.amazon.com/cloudformation) with an account that has permissions to create roles, lambdas, secrets, and policies, or using a role that can assume another role with these permissions.
  2. In the Management and Governance section, select CloudFormation.

  3. Select the Create Stack button.

    Note

    You might see a list of CloudFormation stacks when you select CloudFormation like the following image. If that is the case, select the Create Stack dropdown and choose With new resources (standard).

    Create New Stack

  4. From the Prerequisite - Prepare Template section, select Choose an existing template.

  5. From the Specify Template section, choose Upload a template file and select the Choose file button.
  1. Select Next.

  2. Enter an appropriate stack name.

    Note

    Spaces are not allowed in stack names.

  3. Select IntegrationType from the dropdown. This describes what sort of log objects are in the NotificationBucket. If there's more than one type, or you are not sure, select generic.

    Update Lambda Stack Integration Type

  4. In the field NotificationBucket, enter the bucket name, not a URL or URI, that houses the logs.

  5. (Optional) Enter the appropriate value into the SNSNotificationarn field if you wish to use SNS notifications going forward instead of S3 notifications.
  6. The remaining fields can be left at their defaults.
  7. Select Next.
  8. Select the I acknowledge that AWS CloudFormation might create IAM resources checkbox.
  9. Select Next.
  10. Review all parameters.
  11. Select Submit.
  12. Wait at least 30 seconds and then select the refresh button. The process may take a minute or more to finish. A status of CREATE_COMPLETE for the stack indicates the process has finished.

Add the Lambda Trigger🔗

  1. In the AWS console, switch to the Lambda service.
  2. Locate the new Lambda by name. The default name is {STACKNAME}-scwx-tdr-lambda-{INTEGRATIONTYPE}. For example: ct-demo-scwx-tdr-lambda-awscloudtrail.
  3. Select the Lambda name. The edit page for that Lambda displays.
  4. Expand the Function overview section and choose Add Trigger.
  5. In the Trigger Configuration editor, select the drop down menu and choose S3. Optionally, use an SNS trigger configured with a previously created topic.
  6. From the Bucket options, find the bucket containing the logs and select it.
  7. From the Event Type options, choose All Object Create Events.
  8. In the prefix field, enter the bucket prefix where the logs are located. Leave this blank if no prefix is used.
  9. Leave the suffix field blank.
  10. Check the following box to acknowledge the cost impact of a lambda function.

  11. Choose Add. The configuration page for that lambda displays again. A message displays at the top indicating adding a trigger was successful; for example, The trigger wmikeking was successfully added to function Logs-TDR-Upload. The function is now receiving events from the trigger.

    Important

    AWS Lambda Concurrency Guidance🔗

    The Reserved Concurrency value set by the Taegis XDR CloudFormation template (taegis-cloudformation-lambda-template.yaml) is 5. For more information regarding Lambda concurrency and the calculation of a value appropriate for your environment, please reference Lambda function scaling in AWS Docs.

    Please reference the following AWS documentation to the identify the values to be used in the concurrency calulation:

    AWS Concurrent Execution Limit🔗

    If you see the following error when running your Lambda:

    AWS Concurrent Execution Limit

    You need to request a quota increase from AWS to raise your concurrent execution limit. For more information, see Lambda quotas in AWS Docs.

You can use Advanced Search to verify a successful set up by searching for events from the specific integration. For this integration, use this search:

from http where sensor_type = 'AWS Application Load Balancer'