Integrating with AWS Kinesis

Overview

Blumira connects to AWS using Kinesis Data Stream to log security events. Blumira then intelligently analyzes those logs to automatically detect suspected threats, notify you of those threats, and provide you with an actionable response.

Note: The AWS integration includes data from up to 1 hour prior to the integration.

Before you begin

Before configuring AWS Security Logging for Blumira, we recommend reviewing Getting started with AWS security monitoring.

To add the AWS Cloud Connector in Blumira, you must gather these values from AWS Kinesis:

• Stream Name (not the full ARN, only the stream name)
• Access Key ID
• Secret Access Key
• AWS Logging Region

Configuring AWS Kinesis Data Stream

To configure the Kinesis Data Stream:

1. From the AWS Console, validate that we are operating in the region in which you want to configure AWS logging.
2. From the Kinesis service, select Kinesis Data Streams, then click Create data stream.
3. In the Data stream name box, type a name for the stream.
   Tip: We recommend using the format "company name-region.”
4. Under Data stream capacity, select Provisioned for capacity mode, and set the number of provisioned shards (we recommend that you start with one).
   
   
   
   
5. Click Create data stream.
   
   
6. Under Stream details, copy and save the stream's Amazon resource name (ARN) for use in later steps.

Configuring the AWS Identity and Access Management policy

After you configure the Kinesis data stream, you must configure the Identity and Access Management (IAM) policy to allow Blumira to ingest your log data from the stream. You will need the ARN value gathered in the previous step.

To configure the IAM policy for Blumira:

1. From the IAM service, click Users in the access management navigation, then click Add Users.
   
   
   
   
2. In the Specify user details window, type the user name you want to use for Blumira access then click Next.
3. In the Set permissions window, under Permissions options, select Attach policies directly.
   
   
   
   
4. Under Permissions policies, click Create policy.
5. In the Create policy window, complete the following steps:
   1. Under Service, click Choose a service then select Kinesis.
   2. Under Actions, click the Access level check boxes next to List and Read.
   3. Under Resources, select Specific.
   4. To specificy the stream resource, click Add ARN in the stream row.
   5. In the Add ARN(s) window, paste the stream's ARN value that you copied in the previous procedure.
      
      
      
      
   6. Click Add.
6. Click Next: Tags.

7. (Optional) Add a tag name; this is not a required field.

8. Click Next: Review.
9. Type a name for your policy, then click Create policy.
10. Close the policy window that opened automatically, and then click Refresh.
11. Search for the policy you created, click the checkbox to the left of it, and then click Next.
12. Click Create user.
13. Click your newly created user, then click the Security Credentials tab below the summary section.
14. Scroll down to the Access keys section and click Create access key.
15. Select Application running outside AWS.

16. Click Next.

    
    
    

17. (Optional) Type a description tag, such as “Blumira Kinesis Access Key”.

18. Save the secret access key and access key ID to be used in the AWS Cloud Connector in Blumira.
19. Click Done.

Integrating with AWS using a Cloud Connector

Cloud Connectors automate the configuration of your integrations without requiring you to use a sensor. After you obtain your integration's configuration parameters, you can then enable Blumira to collect your logs.

To configure the Blumira Cloud Connector:

1. In the Blumira app, navigate to Settings > Cloud Connectors.
2. Click + Add Cloud Connector.
3. In the Available Cloud Connectors window, click the connector that you want to add.
4. If you want to change the name of the connector, type the new name in the Cloud Connector Name box.
5. Enter the credentials that you collected in the previous steps.
6. Click Connect.
7. On the Cloud Connectors screen, under Current Status, you can view the configuration’s progress. When the configuration completes, the status changes to Online (green dot).

Important: If you previously deployed a sensor module for this integration, then you must remove it via the Sensors page (Settings > Sensors) to avoid log duplication.

Next Steps

After you integrate with AWS Kinesis Data Stream and IAM, go to the following sections to connect these other AWS products with your Kinesis data stream to send logs to Blumira:

1. Configure AWS CloudTrail
2. Configure AWS CloudWatch
3. Configure AWS VPC Flow Logs
4. Configure AWS GuardDuty