Cloud Native Sources

Owned by Former user (Deleted)
Last updated: 15 May 2024 by Soniya Patil
5 min read

 

WHAT IS CLOUD NATIVE?

Cloud Native services take advantage of cloud computing and are built using microservices. The use of microservices decentralizes applications, makes environments more stable and helps to limit the possibility of an application failure.

What direction are you going with your cloud? Armor can ingest logs from services within AWS, Azure or Google Cloud Platform. In AWS, Armor can ingest logs from AWS CloudTrail, VPC Flow Logs, AWS WAF, and Amazon GuardDuty. In Azure, Network Security Group and Application Gateway flow logs can be ingested.

ARMOR LOG MANAGEMENT is ready to be configured to collect logs from the services below:

 

amazon web service logo
AWS CloudTrail logo
AWS CloudTrail

 

 

 

 

 

To fully use this screen, you must add the following permissions to your account:

  • Read Log Management

  • Write Log Management

  • Read Log Management Plan Selection

  • Write Log Management Plan Selection

You can use the Log & Data Management screen to:

  • View storage consumption in the Summary section

  • View the status of the logging subagent in the Agent Sources section

  • View the status and configure existing sources and add new sources in the External Sources section

    • For documentation on adding or configuring external sources, click here

  • View or change your storage plan in the Log Storage Plans section

 

By default, Armor collects and retains the following log types for 30 days:

CentOS/RHEL

Ubuntu/Debian

Windows

CentOS/RHEL

Ubuntu/Debian

Windows

/var/log/secure

/var/log/messages

/var/log/audit.log

/var/log/yum.log

/var/log/auth.log

/var/log/syslog

System Event Log

Security Event Log

 

 

Using the Armor Management Portal (AMP)

View Logging Subagent Status

You can use these instructions to review the logging status of your virtual machines. Specifically, you can verify if your virtual machine is sending logs to Armor.

  1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.

  2. Click Log & Data Management.

  3. Click Agent Sources.

Column

Description

Column

Description

Name

This column displays the name of the virtual machine or instance that contains the Armor agent.

You can click a specific virtual machine to access the Virtual Machines screen.

Type

This column displays if the virtual machine or instance has been converted to a log collecting device, also known as Log Relay.

Last Log Received

This column displays the date and time when Armor last received a log.

Retention Type

This column displays the length of time that Armor keeps logs.
By default, the Armor Management Portal (AMP) retains log status and details for the previous 30 days. To review logs older than 30 days for a specified instance, see Review log retention plans.

Average Size

This column displays the average size of the collected logs.

Log Status

This column displays the status of the logging subagent.

  1. Online indicates the agent has sent logs within the past hour.

  2. Warning indicates the agent in the past 24 hours has sent logs that exceeds the 7-day moving average by 10% or more.

  3. Critical indicates the agent has not sent logs within the past hour.

  4. Offline indicates the agent (or the instance) is offline.

 

Review Log Retention Plans

Plan name

Log retention rate

Description

Plan name

Log retention rate

Description

Log Management Essentials

30 days

This plan collects and stores your default log types for 30 days, which you can view in AMP.

By default, users are automatically subscribed to this plan.

To make sure that you do not pass the default log collection limit, Armor recommends that you review the:

  1. Daily Log Storage Usage graph in the Summary section

  2. Total Log Storage graph in the Retention Plan section

Compliance Professional

13 months

This plan collects and stores your default log types for 13 months at an additional cost.

Logs from the previous 30 days are visible in AMP; however, to view logs older than 30 days, you must send a support ticket.

For existing virtual machines:

After you select this plan, existing virtual machines will not be automatically enrolled in this plan; you must update each virtual machine separately.

To learn more, see Upgrade log retention for existing virtual machines.

 

View Log Collections Projections

You can use these instructions to review AMP’s prediction regarding future log collection. You can use this information to estimate log collection cost.

  1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.

  2. Click Log & Data Management.

  3. Click Retention Plan.

  4. In the bottom of the screen, review the Total Log Storage graph. 

    • The dotted line indicates AMP’s prediction for your future log collections.

To learn how to submit a request to Armor Support, see Create a support ticket.

Review the following requirements before submitting your log extraction request to Armor Support.

 

Review Requirements

Requirement Type

Description

Requirement Type

Description

Supported Storage Methods

s3 bucket

  1. A globally unique S3 bucket name must be provided to Armor Support

  2. Access to the S3 bucket must be provided (IAM)

    1. Access keys

  3. File type: JSON



Physical hard drive*

  1. File type: JSON

*Physical hard drive is for Armor Enterprise Cloud customers only

Unsupported Storage Methods

Armor does not support the following storage methods:

  1. Azure Blobs

  2. GCP Storage

  3. CSV format (Excel)

 

 

Log and Data Management Home

 



 

 

 

 

 

Â