sj-williams
commented
4 months ago Based on docs, required steps are as follows:
- S3 Bucket for receiving Route53 log
- SQS and perms set up
- Route53 Resolver with query logging config: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_resolver_rule_association https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_resolver_query_log_config
Background
The SOC (Security Operations Center) are collating logs around the MoJ into a security tool by Palo Alto called Cortex XIAM https://www.paloaltonetworks.com/cortex/cortex-xsiam
By pushing our logs to SOC they will actively monitor and raise potential threats with us
Approach
Work with Leonardo Marini to integrate with Cortex. Modernisation Platform has done this already so there may be some reusable code - https://github.com/ministryofjustice/modernisation-platform/blob/main/terraform/environments/core-vpc/firehose.tf
Route53: Ingest Network Route 53 Logs from Amazon S3
Which part of the user docs does this impact
Security monitoring
Communicate changes
No communication changes needed
Questions / Assumptions
Definition of done
Reference
How to write good user stories