Cisco Umbrella

Cisco Umbrella configuration

To configure Cisco Umbrella, see the Cisco Umbrella DNS User Guide. You must configure Cisco Umbrella to export its logs to an Amazon S3 bucket. You can use one of these buckets:

• Your own S3 bucket. See Enable Logging to Your Own S3 Bucket. Create the IAM policy described in Policy configuration.

• A Cisco-managed S3 bucket. See Enable Logging to a Cisco-managed S3 Bucket. You don't create an IAM policy. Instead, do the following:

  • When Umbrella provisions the bucket, the Admin > Log Management page shows the data path, access key, and secret key. Copy the keys then, because Umbrella doesn't store them and requires rotating them every 90 days.

  • Add the keys to a profile in the /root/.aws/credentials file on the Wazuh agent.

  • In Configure Wazuh to process Cisco Umbrella logs, set <name> to the bucket in the data path, for example, cisco-managed-us-east-1. Set <path> to the data path prefix followed by /dnslogs or /proxylogs, for example, 123456_abcdef0123456789/dnslogs.

Policy configuration

If you use a Cisco-managed bucket, skip this section. Follow the create an AWS policy guide to create a policy using the Amazon Web Services console.

The policies below follow the principle of least privilege, so they give the AWS IAM user only the minimum permissions it needs.

To allow an AWS user to use the Wazuh module for AWS with read-only permissions, it must have a policy like the following attached:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>/*",
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>"
            ]
        }
    ]
}

To delete the log files after Wazuh collects them, use the following policy instead:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>/*",
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>"
            ]
        }
    ]
}

Wazuh deletes the log files from the bucket only if you set remove_from_bucket to yes in the bucket configuration. This option is off by default and isn't in the sample configuration, so you need the second policy only if you turn it on.

After creating a policy, you can attach it directly to a user or to a group to which the user belongs. In attaching a policy to an IAM user group, you see how to attach a policy to a group. More information on how to use other methods is available in the AWS documentation.