Cloudaware Upgrades Conflux Module With Enhanced AWS CloudTrail Support

CloudTrail is undoubtably powerful source of audit data for all AWS user level and API level activities. However building any kind of security optics dashboard with CloudTrail is not easy for several reasons:

1. Cannot differentiate read-only from destructive API calls.
2. Over 800 different unique event names. Which ones are important?
3. 50 or so different error codes
4. Some API calls can be critical from security perspective but not from configuration impact angle and vice versa. How do we differentiate?

Cloudaware Conflux assesses each Cloudtrail Event and assigns 3 separate scores for each event:

• ConfigImpactLevel [0–10] indicates potential configuration impact of a CloudTrail event. Naturally all read only events have low configuration impact level. Impact level also takes into consideration error code messages. For example, low impact level event that has been throttled by AWS will have higher score than the events that executed without errors.
• SecurityImpactLevel [0–10] indicates security impact of a CloudTrail event. Events like CreateSAMLProvider or AcceptVPCPeeringConnection would rank high as far as security impact level and bumped even higher as a result of any errors such as Unauthorized Access (403)
• TotalImpactLevel indicates total impact of an event both from security and configuration perspective and also takes into consideration location and trustworthiness of the identity based on location, authentication method and previous history.

Conflux also adds several other “helper” fields to each CloudTrail event, helping end-users understand how Configuration and Security impact levels are calculated.

• ConfigError is a configuration score that is associated with the native ErrorCode and ErrorMessage fields in CloudTrail.
• SecError is a security score that is associated with the native ErrorCode and ErrorMessage fields in CloudTrail.
• OperationType is a classifier field that classified over 800 events into just a dozen operation types. Currently supported operation types are:
• CreateResource e.g. CreateBucket
• DestroyResource e.g. TerminateInstance
• DestroySecurityMetadata e.g. DeleteBucketPolicy
• WriteSecurityMetadata e.g. CreateIAMPolicy or PutBucketAcl
• GetData e.g. GetObject
• WriteData e.g. PutObject
• GetSecurityMetadata e.g. ListIAMPolicies

Working With Enhanced Fields

Conflux’s additional CloudTrail fields appear in the ELK index alongside AWS native CloudTrail fields.

Users can can search, sort and build dashboards using enhanced fields.

About Conflux

Conflux automatically discovers, parses and ingests logs from AWS, Azure and GCE into ELK stack. Conflux is fully integrated with Cloudaware CMDB allowing users to navigate seemlessly from CMDB CI to CI-related logs in Conflux.

Find out more about Cloudaware here.