Dokumen ini menjelaskan cara menyerap log AWS Network Firewall ke Google Security Operations. AWS Network Firewall adalah layanan terkelola yang memberikan perlindungan pada VPC Anda terhadap traffic berbahaya. Dengan mengirimkan log Network Firewall ke Google SecOps, Anda dapat meningkatkan kualitas pemantauan, analisis, dan deteksi ancaman.
Sebelum memulai
Pastikan Anda memiliki prasyarat berikut:
Instance Google SecOps
Akses istimewa ke AWS
Cara mengonfigurasi Logging untuk AWS Network Firewall
Untuk setiap jenis log yang dipilih, pilih S3 untuk jenis tujuan.
Klik Simpan.
Menyiapkan feed
Ada dua titik entri berbeda untuk menyiapkan feed di platform Google SecOps:
Setelan SIEM > Feed > Tambahkan Baru
Hub Konten > Paket Konten > Mulai
Cara menyiapkan feed AWS Network Firewall
Klik paket Amazon Cloud Platform.
Cari jenis log AWS Network Firewall.
Tentukan nilai di kolom berikut.
Jenis Sumber: Amazon SQS V2
Nama Antrean: Nama antrean SQS yang akan dibaca
URI S3: URI bucket.
s3://your-log-bucket-name/
Ganti your-log-bucket-name dengan nama sebenarnya bucket S3 Anda.
Opsi penghapusan sumber: Pilih opsi penghapusan sesuai dengan preferensi penyerapan Anda.
Usia File Maksimum: Menyertakan file yang diubah dalam beberapa hari terakhir. Defaultnya adalah 180 hari.
ID Kunci Akses Antrean SQS: Kunci akses akun yang berupa string alfanumerik 20 karakter.
Kunci Akses Rahasia Antrean SQS: Kunci akses akun yang berupa string alfanumerik 40 karakter.
Opsi lanjutan
Nama Feed: Nilai yang telah diisi otomatis yang mengidentifikasi feed.
Namespace Aset: Namespace yang terkait dengan feed.
Label Penyerapan: Label yang diterapkan ke semua peristiwa dari feed ini.
Klik Buat feed.
Untuk mengetahui informasi selengkapnya tentang cara mengonfigurasi beberapa feed untuk berbagai jenis log dalam keluarga produk ini, lihat Mengonfigurasi feed menurut produk.
Tabel Pemetaan UDM
Kolom Log
Pemetaan UDM
Logika
availability_zone
target.resource.attribute.cloud.availability_zone
Dipetakan langsung dari kolom availability_zone.
event.app_proto
network.application_protocol
Dipetakan langsung dari kolom event.app_proto, dikonversi menjadi huruf besar jika bukan salah satu nilai yang ditentukan (ikev2, tftp, failed, snmp, tls, ftp). HTTP2 diganti dengan HTTP.
event.dest_ip
target.ip
Dipetakan langsung dari kolom event.dest_ip.
event.dest_port
target.port
Dipetakan langsung dari kolom event.dest_port, dikonversi menjadi bilangan bulat.
event.event_type
additional.fields[event_type_label].key
Kuncinya dikodekan secara permanen sebagai "event_type".
Dipetakan langsung dari kolom event.tcp.tcp_flags.
event_timestamp
metadata.event_timestamp.seconds
Dipetakan langsung dari kolom event_timestamp, diuraikan sebagai stempel waktu.
event_timestamp
timestamp.seconds
Dipetakan langsung dari kolom event_timestamp, diuraikan sebagai stempel waktu.
firewall_name
metadata.product_event_type
Dipetakan langsung dari kolom firewall_name. Tetapkan ke "NETWORK_CONNECTION" jika event.src_ip dan event.dest_ip ada, jika tidak, tetapkan ke "GENERIC_EVENT". Dikodekan secara permanen ke "AWS Network Firewall". Dikodekan secara permanen ke "AWS".
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis guide outlines how to ingest AWS Network Firewall logs into Google Security Operations (SecOps) for enhanced monitoring and threat detection.\u003c/p\u003e\n"],["\u003cp\u003eTo begin, ensure you have a Google SecOps instance and privileged access to AWS before configuring logging for the AWS Network Firewall.\u003c/p\u003e\n"],["\u003cp\u003eIn the AWS Management Console, you must enable logging for the desired log types (Flow, Alert, and TLS) and direct them to an S3 bucket.\u003c/p\u003e\n"],["\u003cp\u003eWithin Google SecOps, create a new feed specifying Amazon S3 as the source type and AWS Network Firewall as the log type, providing the necessary S3 bucket details and credentials.\u003c/p\u003e\n"],["\u003cp\u003eA detailed UDM mapping table is provided to illustrate how AWS Network Firewall log fields correspond to the Google SecOps data model.\u003c/p\u003e\n"]]],[],null,["# Collect AWS Network Firewall logs\n=================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document explains how to ingest AWS Network Firewall logs to Google Security Operations. AWS Network Firewall is a managed service that provides protection to your VPC against malicious traffic. By sending Network Firewall logs to Google SecOps, you can improve your monitoring, analysis, and threat detection.\n\nBefore you begin\n----------------\n\nEnsure you have the following prerequisites:\n\n- Google SecOps instance\n- Privileged access to AWS\n\nHow to configure Logging for AWS Network Firewall\n-------------------------------------------------\n\n1. Sign in to the [AWS Management Console](https://aws.amazon.com/console/).\n2. Open the [Amazon VPC console](https://console.aws.amazon.com/vpc/).\n3. In the navigation pane, select **Firewalls**.\n4. Select the name of the firewall that you want to edit.\n5. Select the **Firewall details** tab.\n6. In the **Logging** section, click **Edit**.\n7. Select the log types: **Flow** , **Alert** and **TLS**.\n8. For each selected log type, choose **S3** for the destination type.\n\n | **Note:** In order to change the destination for an existing log type, you must first disable logging for the policy. \n | Then, edit the policy and specify the new destination(s) for the log type.\n9. Click **Save**.\n\nSet up feeds\n------------\n\nThere are two different entry points to set up feeds in the\nGoogle SecOps platform:\n\n- **SIEM Settings \\\u003e Feeds \\\u003e Add New**\n- **Content Hub \\\u003e Content Packs \\\u003e Get Started**\n\nHow to set up the AWS Network Firewall feed\n-------------------------------------------\n\n1. Click the **Amazon Cloud Platform** pack.\n2. Locate the **AWS Network Firewall** log type.\n3. Specify the values in the following fields.\n\n - **Source Type**: Amazon SQS V2\n - **Queue Name**: The SQS queue name to read from\n - **S3 URI** : The bucket URI.\n - `s3://your-log-bucket-name/`\n - Replace `your-log-bucket-name` with the actual name of your S3 bucket.\n - **Source deletion options**: Select the deletion option according to your ingestion preferences.\n\n | **Note:** If you select the `Delete transferred files` or `Delete transferred files and empty directories` option, make sure that you granted appropriate permissions to the service account.\n - **Maximum File Age**: Include files modified in the last number of days. Default is 180 days.\n\n - **SQS Queue Access Key ID**: An account access key that is a 20-character alphanumeric string.\n\n - **SQS Queue Secret Access Key**: An account access key that is a 40-character alphanumeric string.\n\n **Advanced options**\n - **Feed Name**: A prepopulated value that identifies the feed.\n - **Asset Namespace**: Namespace associated with the feed.\n - **Ingestion Labels**: Labels applied to all events from this feed.\n4. Click **Create feed**.\n\n| **Note:** The Content Hub is not available on the SIEM standalone platform. To upgrade, contact your Google SecOps representative.\n\nFor more information about configuring multiple feeds for different log types within this product family, see [Configure feeds by product](/chronicle/docs/ingestion/ingestion-entities/configure-multiple-feeds).\n\nUDM Mapping Table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
