Integrating with AWS Kinesis

Overview

Blumira connects to AWS using Kinesis Data Stream to log security events. Blumira then intelligently analyzes those logs to automatically detect suspected threats, notify you of those threats, and provide you with an actionable response.

Note: The AWS integration includes data from up to 1 hour prior to the integration.

Before you begin

Before configuring AWS Security Logging for Blumira, we recommend reviewing Getting started with AWS security monitoring.

To add the AWS Cloud Connector in Blumira, you must gather these values from AWS Kinesis:

• Stream Name (not the full ARN, only the stream name)
• Access Key ID
• Secret Access Key
• AWS Logging Region

Configuring AWS Kinesis Data Stream

To configure the Kinesis Data Stream:

1. From the AWS Console, validate that we are operating in the region in which you want to configure AWS logging.
2. From the Kinesis service, select Kinesis Data Streams, then click Create data stream.
3. In the Data stream name box, type a name for the stream.
   Tip: We recommend using the format "company name-region.”
4. Under Data stream capacity, select Provisioned for capacity mode, and set the number of provisioned shards (we recommend that you start with one).
   
   
   
   
5. Click Create data stream.
   
   
6. Under Stream details, copy and save the stream's Amazon resource name (ARN) for use in later steps.

Configuring the AWS Identity and Access Management policy

After you configure the Kinesis data stream, you must configure the Identity and Access Management (IAM) policy to allow Blumira to ingest your log data from the stream. You will need the ARN value gathered in the previous step.

To configure the IAM policy for Blumira:

1. From the IAM service, click Users in the access management navigation, then click Create Users.
   
2. In the Specify user details window, type the user name you want to use for Blumira access then click Next.
3. In the Set permissions window, under Permissions options, select Attach policies directly.
   
4. Under Permissions policies, click Create policy.
5. In the Create policy window, which opens in a new tab, complete the following steps:
   1. Click JSON to open the policy editor.
   2. Replace the policy with the following:
      

      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Sid": "VisualEditor0",
                  "Effect": "Allow",
                  "Action": [
                      "kinesis:SubscribeToShard",
                      "kinesis:DescribeStreamSummary",
                      "kinesis:DescribeStreamConsumer",
                      "kinesis:GetShardIterator",
                      "kinesis:GetRecords",
                      "kinesis:DescribeStream",
                      "kinesis:ListStreamConsumers",
                      "kinesis:ListTagsForStream"
                  ],
                  "Resource": "{KINESISARN}"
              },
              {
                  "Sid": "VisualEditor1",
                  "Effect": "Allow",
                  "Action": [
                      "kinesis:ListStreams",
                      "kinesis:ListShards",
                      "kinesis:DescribeLimits"
                  ],
                  "Resource": "*"
              }
          ]
      }
      

   3. In Line 17, replace {KINESISARN} with the ARN you copied in previous steps.
   4. Click Next.
   5. Type a name for your policy, then click Create policy.
   6. Close the policy tab.
6. Click Refresh.
7. Search for the policy you created, click the check box to the left of it, and then click Next.
8. Click Create user.
9. Click your newly created user, then click the Security Credentials tab below the summary section.
10. Scroll down to the Access keys section and click Create access key.
11. Select Application running outside AWS.

12. Click Next.

    
    
    

13. (Optional) Type a description tag, such as “Blumira Kinesis Access Key”.

14. Save the secret access key and access key ID to be used in the AWS Cloud Connector in Blumira.
15. Click Done.

Integrating with AWS using a Cloud Connector

Cloud Connectors automate the configuration of your integrations without requiring you to use a sensor. After you obtain your integration's configuration parameters, you can then enable Blumira to collect your logs.

To configure the Blumira Cloud Connector:

1. In the Blumira app, navigate to Settings > Cloud Connectors.
2. Click + Add Cloud Connector.
3. In the Available Cloud Connectors window, click the connector you want to add.
4. In the Cloud Connector Name box, type a name to help identify the specific integration. 
5. Enter the credentials that you collected in the previous steps.
6. Click Connect.

Next Steps

After you integrate with AWS Kinesis Data Stream and IAM, go to the following sections to connect these other AWS products with your Kinesis data stream to send logs to Blumira:

1. Configure AWS CloudTrail
2. Configure AWS CloudWatch
3. Configure AWS VPC Flow Logs
4. Configure AWS GuardDuty