Page Comparison

Log type

Additional information

Detailed instructions

AWS CloudTrail

For this log type, you must be able to:

• Gather your AWS account information

• Create a new trail and sync your AWS S3 bucket

AWS CloudTrail

AWS GuardDuty

For this log type, you must be able to:

• Update your AWS permissions for GuardDuty, Lambda, CloudWatch, and CloudFormation

• Retrieve your AWS credentials (AWS account number / account ID, AWS Access Key, AWS Secret Key)

• Configure the AWS GuardDuty CloudFormation StackSet Template

AWS GuardDuty

AWS VPC Flow Logs

For this log type, you must be able to:

• Update your AWS permissions for VPC, Lambda, CloudWatch, and CloudFormation

• Configure a Web ACL

• Configure the AWS WAF CloudFormation Stack Template

Create Flow Connection - AWS VPC Flow Logs

AWS WAF

For this log type, you must be able to:

• Update your AWS permissions for WAF, Lambda, CloudWatch, and CloudFormation

• Configure the AWS VPC Flow Log CloudFormation Stack Template

AWS WAF

Check Point

For this log type you must be able to:

• Log into and pre-configure the Check Point box

• Configure your Check Point device

Create a Remote Log Source - Check Point

Cisco ASA

For this log type, you must be able to:

• Log into your Cisco ASA device

• Access the privileged EXEC mode

Create a Remote Log Source - Cisco ASA

Cisco ISR

For this log type, you must be able to:

• Log into your Cisco ISR device

• Access the privileged EXEC mode

Create a Remote Log Source - Cisco ISR

Juniper

For this log type, you must be able to:

• Log into your Juniper SRX device

• Access the privileged EXEC mode

Create a Remote Log Source - Juniper

Fortinet FortiGate

For this log type, you must be able to:

• Log into your Fortinet Security Gateway

• Access the CLI Console

Create a Remote Log Source - Fortinet Security Gateway

Imperva Incapsula

For this log type, you must be able to:

• Access the AWS console

• Configure the IAM Role for an EC2 server or non-EC2 server

• Log into your log relay server

Create a Remote Log Source - Imperva Incapsula

Palo Alto Firewall

For this log type, you must be able to:

• Access the Palo Alto console

• Configure your server and server profile

Create a Remote Log Source - Palo Alto Firewall

SonicWall

For this log type, you must be able to:

• Log into the SonicWall console

• Configure your SonicWall device

Create a Remote Log Source - SonicWall

Cylance

For this log type:

• The user has a Log Relay device online

• The user is not blocking traffic on port TCP and UDP port 14015 between the Cylance and the Log Relay

Create a Remote Log Source - Cylance

Storage Only

For this log type, you must be able to:

• Configure your device or application for compliance log storage only

Create a Storage Only Log Source