Figure out how to collect AWS Network Firewall using Amazon Data Firehose

[zmoog]

Goal

Suppose I own an AWS account, and I want to export AWS Firewall log events from AWS to an Elastic cluster.

Context

What are the AWS Network Firewall logs?

Requirements & Limitations

• supports EC (Elastic Cloud) deployments only
• EC deployment must be on AWS (deployments on Azure or GCP are not supported)
• does not support AWS PrivateLink yet (but it's coming soon)

Preparation

• install the latest AWS integration on your Elastic cluster

Steps

• Overview
• Select a resource
• Create a Firehose stream
• Set up logging
• Verify

[zmoog]

Select a resource

• use an existing AWS Network Firewall
• create a new AWS Network Firewall for testing
• Set up logging

Use an existing AWS Network Firewall

Create a new AWS Network Firewall for testing

• Open the VPC service in the AWS console.
• Create a VPC and other networking resources.
• Create an AWS Network Firewall
• Set up the firewall policy

Open the VPC service in the AWS console

The best option to create a VPC for a quick test is to use the wizard in the AWS console.

Create a VPC and other networking resources

The default settings are fine, you only need to pick a good name for your VPC resources.

Create an AWS Network Firewall

Set up the firewall policy

• create a rule group

Deploy an EC2 to generate network traffic

• launch an EC2, select the VPC we just created, enable "Auto-assign public IP"

Set up logging

To enable logging, edit your firewall setting by opening the "Logging" section.

If you want to quickly check your Network Firewall logs before setting up Firehose, you can enable logging on CloudWatch, and then inspect the log events:

Visit CloudWatch and open your log group. If everything is working correctly, you will see something like this:

[zmoog]

Create a Firehose stream

We need a Firehose stream to collect the AWS Network Firewall logs and send them to a data stream on an Elastic stack.

To create a Firehose stream, you can use the instructions at Monitor Amazon Web Services (AWS) with Amazon Data Firehose up to step 3. However, you must set two things differently.

• Name
• Parameters

Name

Pick a name for your Firehose stream.

Parameters

Follow the instructions up to step 3 except for the "parameters".

Use the following parameters:

Name	Value
es_datastream_name	logs-aws.firewall_logs-default

[zmoog]

Set up logging

[zmoog]

Verify

WIP