Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update supported log types with recent logs #5700

Closed
wants to merge 3 commits into from
+70 −19
Closed

Update supported log types with recent logs #5700

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
deeef6c
Update supported log types with recent logs
Naarcha-AWS Nov 29, 2023
8afd1b6
Merge branch 'main' into security-log-types-update
Naarcha-AWS Nov 29, 2023
320514c
Apply suggestions from code review
Naarcha-AWS Dec 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
89 changes: 70 additions & 19 deletions _security-analytics/sec-analytics-config/log-types.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,28 +14,79 @@

<img src="{{site.url}}{{site.baseurl}}/images/Security/c-log-type.png" alt="The Log types landing page." width="85%">

The following table shows the log types that are currently supported by Security Analytics for ingestion, mapping, and monitoring.

| Category | Log type | Description |
| :--- |:--- |:--- |
| Access Management | `Ad_ldap` | Active Directory logs that track LDAP queries, errors from the LDAP server, timeout events, and unsecure LDAP binds. |
| Access Management | `Apache_access` | Apache access logs that record data for all requests processed by an Apache HTTP server. |
| Access Management | `Okta` | Okta logs that record Okta events from a range of actions, such as downloading an export file, requesting application access, or revoking privileges. |
| Applications | `GitHub` | GitHub logs that monitor workflows created by [GitHub Actions](https://docs.github.com/en/actions/learn-github-actions/understanding-github-actions). |
| Applications| `Gworkspace` | Google Workspace logs that monitor log entries such as admin actions, group and group membership actions, and events related to logging in. |
| Applications| `M365` | Microsoft 365 audit logs that collect a range of data for Microsoft 365, including records from call details, performance data, SQL Server, security events, and access control activity. |
| Cloud Services | `Azure` | Microsoft Azure logs that monitor log data for cloud applications managed by Azure Cloud Services. |
| Cloud Services | `CloudTrail` | AWS CloudTrail logs that monitor events for an AWS CloudTrail account. OpenSearch can ingest CloudTrail log data from both [Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html) (Amazon S3) accounts and [Amazon Security Lake](https://docs.aws.amazon.com/security-lake/latest/userguide/what-is-security-lake.html) service accounts. |
| Cloud Services | `S3` | Amazon S3 logs that track requests for access to an S3 bucket. |
| Network Activity| `Dns` | DNS logs that store DNS activity. |
| Network Activity | `Network` | Network logs that record events that happen in a system's network, such as login attempts and application events. |
| Network Activity | `vpcflow` | [VPC Flow Logs](https://docs.aws.amazon.com/prescriptive-guidance/latest/logging-monitoring-for-application-owners/vpc-flow-logs.html) that capture information about the IP traffic going to and from network interfaces in your virtual private cloud (VPC). |
| Security | `Waf` | Web Application Firewall (WAF) logs (introduced in OpenSearch 2.11) for users that require monitoring of the WAF use case that's provided out of the box with Security Analytics. The role of WAF is to monitor and filter HTTP traffic between a web application and the internet. WAF prevents common security attacks, such as cross-site scripting (XSS) and SQL Injection (SQi). |
| System Activity | `Linux` | Linux system logs that record Linux syslog events. |
| System Activity | `Windows` | Windows logs that record events that have happened in the operating system, applications, and other Windows system services. |
The following tables show the log types that are currently supported by Security Analytics for ingestion, mapping, and monitoring.

## Access Management

Check failure on line 19 in _security-analytics/sec-analytics-config/log-types.md

View workflow job for this annotation

GitHub Actions / vale

[vale] _security-analytics/sec-analytics-config/log-types.md#L19 

[OpenSearch.HeadingCapitalization] 'Access Management' is a heading and should be in sentence case.
Raw output 
{"message": "[OpenSearch.HeadingCapitalization] 'Access Management' is a heading and should be in sentence case.", "location": {"path": "_security-analytics/sec-analytics-config/log-types.md", "range": {"start": {"line": 19, "column": 4}}}, "severity": "ERROR"}

| Log type | Description |
|:--- |:--- |
| `ad_ldap` | Active Directory logs that track LDAP queries, errors from the LDAP server, timeout events, and unsecure LDAP binds. |

Check failure on line 23 in _security-analytics/sec-analytics-config/log-types.md

View workflow job for this annotation

GitHub Actions / vale

[vale] _security-analytics/sec-analytics-config/log-types.md#L23 

[OpenSearch.Spelling] Error: unsecure. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.
Raw output 
{"message": "[OpenSearch.Spelling] Error: unsecure. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.", "location": {"path": "_security-analytics/sec-analytics-config/log-types.md", "range": {"start": {"line": 23, "column": 111}}}, "severity": "ERROR"}
| `apache_access` | Apache access logs that record data for all requests processed by an Apache HTTP server. |
| `okta` | Okta logs that record Okta events from a range of actions, such as downloading an export file, requesting application access, or revoking privileges. |

### Applications

| Log type | Description |
|:--- |:--- |
| `gitHub` | GitHub logs that monitor workflows created by [GitHub Actions](https://docs.github.com/en/actions/learn-github-actions/understanding-github-actions). |
| `gworkspace` | Google Workspace logs that monitor log entries such as admin actions, group and group membership actions, and events related to logging in. |
| `m365` | Microsoft 365 audit logs that collect a range of data for Microsoft 365, including records from call details, performance data, SQL Server, security events, and access control activity. |

### Cloud Services

Check failure on line 35 in _security-analytics/sec-analytics-config/log-types.md

View workflow job for this annotation

GitHub Actions / vale

[vale] _security-analytics/sec-analytics-config/log-types.md#L35 

[OpenSearch.HeadingCapitalization] 'Cloud Services' is a heading and should be in sentence case.
Raw output 
{"message": "[OpenSearch.HeadingCapitalization] 'Cloud Services' is a heading and should be in sentence case.", "location": {"path": "_security-analytics/sec-analytics-config/log-types.md", "range": {"start": {"line": 35, "column": 5}}}, "severity": "ERROR"}

| Log type | Description |
|:--- |:--- |
| `ad_ldap` | Active Directory logs that track LDAP queries, errors from the LDAP server, timeout events, and unsecure LDAP binds. |

Check failure on line 39 in _security-analytics/sec-analytics-config/log-types.md

View workflow job for this annotation

GitHub Actions / vale

[vale] _security-analytics/sec-analytics-config/log-types.md#L39 

[OpenSearch.Spelling] Error: unsecure. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.
Raw output 
{"message": "[OpenSearch.Spelling] Error: unsecure. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.", "location": {"path": "_security-analytics/sec-analytics-config/log-types.md", "range": {"start": {"line": 39, "column": 111}}}, "severity": "ERROR"}
| `apache_access` | Apache access logs that record data for all requests processed by an Apache HTTP server. |
| `okta` | Okta logs that record Okta events from a range of actions, such as downloading an export file, requesting application access, or revoking privileges. |
| `azure` | Microsoft Azure logs that monitor log data for cloud applications managed by Azure Cloud Services. |
| `cloudtrail` | AWS CloudTrail logs that monitor events for an AWS CloudTrail account. OpenSearch can ingest CloudTrail log data from both [Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html) (Amazon S3) accounts and [Amazon Security Lake](https://docs.aws.amazon.com/security-lake/latest/userguide/what-is-security-lake.html) service accounts. |
| `s3` | Amazon S3 logs that track requests for access to an S3 bucket. |

### Network activity

Check failure on line 46 in _security-analytics/sec-analytics-config/log-types.md

View workflow job for this annotation

GitHub Actions / vale

[vale] _security-analytics/sec-analytics-config/log-types.md#L46 

[OpenSearch.HeadingCapitalization] 'Network activity' is a heading and should be in sentence case.
Raw output 
{"message": "[OpenSearch.HeadingCapitalization] 'Network activity' is a heading and should be in sentence case.", "location": {"path": "_security-analytics/sec-analytics-config/log-types.md", "range": {"start": {"line": 46, "column": 5}}}, "severity": "ERROR"}

| Log type | Description |
|:--- |:--- |
| `dns` | DNS logs that store DNS activity. |
| `network` | Network logs that record events that happen in a system's network, such as login attempts and application events. |
| `vpcflow` | [VPC Flow Logs](https://docs.aws.amazon.com/prescriptive-guidance/latest/logging-monitoring-for-application-owners/vpc-flow-logs.html) that capture information about the IP traffic going to and from network interfaces in your virtual private cloud (VPC). |

### Security

| Log type | Description |
|:--- |:--- |
| `waf` | Web Application Firewall (WAF) logs (introduced in OpenSearch 2.11) for users that require monitoring of the WAF use case that's provided out of the box with Security Analytics. The role of WAF is to monitor and filter HTTP traffic between a web application and the internet. WAF prevents common security attacks, such as cross-site scripting (XSS) and SQL Injection (SQi). |

Check failure on line 58 in _security-analytics/sec-analytics-config/log-types.md

View workflow job for this annotation

GitHub Actions / vale

[vale] _security-analytics/sec-analytics-config/log-types.md#L58 

[OpenSearch.Spelling] Error: SQi. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.
Raw output 
{"message": "[OpenSearch.Spelling] Error: SQi. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.", "location": {"path": "_security-analytics/sec-analytics-config/log-types.md", "range": {"start": {"line": 58, "column": 379}}}, "severity": "ERROR"}
| `linux` | Linux system logs that record Linux syslog events. |

Check failure on line 59 in _security-analytics/sec-analytics-config/log-types.md

View workflow job for this annotation

GitHub Actions / vale

[vale] _security-analytics/sec-analytics-config/log-types.md#L59 

[OpenSearch.Spelling] Error: syslog. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.
Raw output 
{"message": "[OpenSearch.Spelling] Error: syslog. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.", "location": {"path": "_security-analytics/sec-analytics-config/log-types.md", "range": {"start": {"line": 59, "column": 49}}}, "severity": "ERROR"}
| `zeek` | Zeek monitoring logs created when Zeek detects new network activity. |

Check failure on line 60 in _security-analytics/sec-analytics-config/log-types.md

View workflow job for this annotation

GitHub Actions / vale

[vale] _security-analytics/sec-analytics-config/log-types.md#L60 

[OpenSearch.Spelling] Error: Zeek. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.
Raw output 
{"message": "[OpenSearch.Spelling] Error: Zeek. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.", "location": {"path": "_security-analytics/sec-analytics-config/log-types.md", "range": {"start": {"line": 60, "column": 12}}}, "severity": "ERROR"}

Check failure on line 60 in _security-analytics/sec-analytics-config/log-types.md

View workflow job for this annotation

GitHub Actions / vale

[vale] _security-analytics/sec-analytics-config/log-types.md#L60 

[OpenSearch.Spelling] Error: Zeek. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.
Raw output 
{"message": "[OpenSearch.Spelling] Error: Zeek. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.", "location": {"path": "_security-analytics/sec-analytics-config/log-types.md", "range": {"start": {"line": 60, "column": 46}}}, "severity": "ERROR"}
| `cisco` | Cisco logs for when a user tries to authenticate to a [Cisco router or firewall](https://www.cisco.com/c/en/us/support/docs/security-vpn/terminal-access-controller-access-control-system-tacacs-/10384-security.html#anc1).


### System acivity

Check failure on line 64 in _security-analytics/sec-analytics-config/log-types.md

View workflow job for this annotation

GitHub Actions / vale

[vale] _security-analytics/sec-analytics-config/log-types.md#L64 

[OpenSearch.Spelling] Error: acivity. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.
Raw output 
{"message": "[OpenSearch.Spelling] Error: acivity. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.", "location": {"path": "_security-analytics/sec-analytics-config/log-types.md", "range": {"start": {"line": 64, "column": 12}}}, "severity": "ERROR"}
Naarcha-AWS marked this conversation as resolved.
Show resolved Hide resolved

| Log type | Description |
|:--- |:--- |
| `windows` | Windows logs that record events that have happened in the operating system, applications, and other Windows system services. |

### System logs

| Log type | Description |
|:--- |:--- |
| [`auditd`](https://linux.die.net/man/8/auditd) | The component in a linux system resposnbile for writing audit records. |

Check failure on line 74 in _security-analytics/sec-analytics-config/log-types.md

View workflow job for this annotation

GitHub Actions / vale

[vale] _security-analytics/sec-analytics-config/log-types.md#L74 

[Vale.Terms] Use 'Linux' instead of 'linux'.
Raw output 
{"message": "[Vale.Terms] Use 'Linux' instead of 'linux'.", "location": {"path": "_security-analytics/sec-analytics-config/log-types.md", "range": {"start": {"line": 74, "column": 71}}}, "severity": "ERROR"}

Check failure on line 74 in _security-analytics/sec-analytics-config/log-types.md

View workflow job for this annotation

GitHub Actions / vale

[vale] _security-analytics/sec-analytics-config/log-types.md#L74 

[OpenSearch.Spelling] Error: linux. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.
Raw output 
{"message": "[OpenSearch.Spelling] Error: linux. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.", "location": {"path": "_security-analytics/sec-analytics-config/log-types.md", "range": {"start": {"line": 74, "column": 71}}}, "severity": "ERROR"}

Check failure on line 74 in _security-analytics/sec-analytics-config/log-types.md

View workflow job for this annotation

GitHub Actions / vale

[vale] _security-analytics/sec-analytics-config/log-types.md#L74 

[OpenSearch.Spelling] Error: resposnbile. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.
Raw output 
{"message": "[OpenSearch.Spelling] Error: resposnbile. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.", "location": {"path": "_security-analytics/sec-analytics-config/log-types.md", "range": {"start": {"line": 74, "column": 84}}}, "severity": "ERROR"}
| `builtin` | The built in security logs for your current operating system, such as Windows or MacOS. |

Check failure on line 75 in _security-analytics/sec-analytics-config/log-types.md

View workflow job for this annotation

GitHub Actions / vale

[vale] _security-analytics/sec-analytics-config/log-types.md#L75 

[Vale.Terms] Use 'macOS' instead of 'MacOS'.
Raw output 
{"message": "[Vale.Terms] Use 'macOS' instead of 'MacOS'.", "location": {"path": "_security-analytics/sec-analytics-config/log-types.md", "range": {"start": {"line": 75, "column": 96}}}, "severity": "ERROR"}
| `file_create` | Detects the creation of cron files or files in cron directories. |
| `modsecurity` | Detects multiple blocks by the `mod_security` module, such as a WAF. |
| `network_connection` | Detects any bash or mining connections to a remote IP address. |
| `other` | Detects any malicous behavior according to Sigma rules. For more information, see the [Sigma rules documentation](https://sigmahq.io/docs/basics/rules.html). |

Check failure on line 79 in _security-analytics/sec-analytics-config/log-types.md

View workflow job for this annotation

GitHub Actions / vale

[vale] _security-analytics/sec-analytics-config/log-types.md#L79 

[OpenSearch.Spelling] Error: malicous. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.
Raw output 
{"message": "[OpenSearch.Spelling] Error: malicous. If you are referencing a setting, variable, format, function, or repository, surround it with tic marks.", "location": {"path": "_security-analytics/sec-analytics-config/log-types.md", "range": {"start": {"line": 79, "column": 25}}}, "severity": "ERROR"}
| `process_creation` | Detects when new processes are created according to Sigma rules. |

### Other

| Log type | Description |
|:--- |:--- |
| Other | `Email` | Logs that record email activity. |



## Page actions

The following list describes the main features found on the **Log types** page and the actions you can take:
Expand Down