AWS CloudTrail integration for Elastic Agent

The AWS CloudTrail integration enables you to collect AWS account activity logs. For more information, refer to Elastic documentation.

Before you begin

Ensure that you have already set up the following resources:

• A StackOps Elastic deployment with its Kibana URL.
• A whitelisted VPC Endpoint between your AWS VPC and StackOps deployment.
• CloudTrail logs that are piped to an S3 Bucket or SQS Queue.
• Elastic Agent installed on your AWS infrastructure.

Adding AWS CloudTrail integration

Pre-requisites:
- S3 Bucket ARN or SQS Queue URL

To add AWS CloudTrail:

1. In Kibana, go to Management > Fleet.

2. Select Agent policies.

3. Select the policy that you want to add the integration to.

4. Select Add integration.

5. Search for and select AWS CloudTrail.

6. Select Add AWS CloudTrail to enable the integration.

7. In Integration settings, provide the following details:

   1. Enter a Name and Description.
   2. Under Advanced options, enter ap-southeast-1 for Default AWS Region.
   3. (Optional) Specify Role ARN.

8. In Collect CloudTrail logs from S3, provide the following details:

   • If using S3 Bucket:
     1. Switch on Collect logs via S3 Bucket.
     2. Enter the [S3] Bucket ARN.
     3. If required, specify other configuration settings in Advanced options.
   • If using SQS Queue (recommended if you are using multiple Elastic Agents):
     1. Enter the [SQS] Queue URL.
     2. If needed, switch on Preserve original event. Note that this may incur additional cost and storage usage.
     3. If required, specify other configuration settings in Advanced options.

9. Select Save and continue, then select Save and deploy changes.

   

By default, the integration will be deployed to all agents attached to this policy.

Verifying the setup

To verify that the logs are successfully piped to Elastic:

1. In Kibana, go to Analytics > Discover.
2. Select logs-* in the data view and search for event.dataset : aws* to view the CloudTrail logs.

For data analysis, you can specify the time period to read the historical data. We recommend using Last 7 days.

Troubleshooting

If you are unable to receive the CloudTrail data, check that you have set up the integration correctly in the steps above. Otherwise, check the agent diagnostics in Fleet:

1. In Kibana, go to Management > Fleet .
2. Select an agent that has the CloudTrail integration.
3. Under Integrations, select the CloudTrail integration, then select Inputs to view the diagnostic status.