Dokumen ini menjelaskan cara menyerap log AWS Session Manager ke Google Security Operations. AWS Session Manager memberikan akses yang aman dan dapat diaudit ke instance Amazon EC2 dan server lokal. Dengan mengintegrasikan lognya ke Google SecOps, Anda dapat meningkatkan postur keamanan dan melacak peristiwa akses jarak jauh.
Sebelum memulai
Pastikan Anda memiliki prasyarat berikut:
Instance Google SecOps
Akses istimewa ke AWS
Mengonfigurasi AWS IAM dan S3
Buat bucket Amazon S3 dengan mengikuti panduan pengguna ini: Membuat bucket
Simpan Nama dan Region bucket untuk digunakan nanti.
Hapus centang pada kotak Izinkan hanya bucket S3 terenkripsi.
Pilih bucket Amazon S3 yang telah dibuat di akun Anda untuk menyimpan data log sesi.
Masukkan nama bucket Amazon S3 yang telah dibuat di akun Anda untuk menyimpan data log sesi.
Klik Simpan.
Menyiapkan feed
Ada dua titik entri berbeda untuk menyiapkan feed di platform Google SecOps:
Setelan SIEM > Feed > Tambahkan Baru
Hub Konten > Paket Konten > Mulai
Cara menyiapkan feed AWS Session Manager
Klik paket Amazon Cloud Platform.
Cari jenis log AWS Session Manager.
Tentukan nilai di kolom berikut.
Jenis Sumber: Amazon SQS V2
Nama Antrean: Nama antrean SQS yang akan dibaca
URI S3: URI bucket.
s3://your-log-bucket-name/
Ganti your-log-bucket-name dengan nama sebenarnya bucket S3 Anda.
Opsi penghapusan sumber: Pilih opsi penghapusan sesuai dengan preferensi penyerapan Anda.
Usia File Maksimum: Menyertakan file yang diubah dalam beberapa hari terakhir. Defaultnya adalah 180 hari.
ID Kunci Akses Antrean SQS: Kunci akses akun yang berupa string alfanumerik 20 karakter.
Kunci Akses Rahasia Antrean SQS: Kunci akses akun yang berupa string alfanumerik 40 karakter.
Opsi lanjutan
Nama Feed: Nilai yang telah diisi otomatis yang mengidentifikasi feed.
Namespace Aset: Namespace yang terkait dengan feed.
Label Penyerapan: Label yang diterapkan ke semua peristiwa dari feed ini.
Klik Buat feed.
Untuk mengetahui informasi selengkapnya tentang cara mengonfigurasi beberapa feed untuk berbagai jenis log dalam keluarga produk ini, lihat Mengonfigurasi feed menurut produk.
Tabel Pemetaan UDM
Kolom Log
Pemetaan UDM
Logika
--cid
metadata.description
Bagian kolom deskripsi jika ada dalam log
--collector.filesystem.ignored-mount-points
metadata.description
Bagian kolom deskripsi jika ada dalam log
--collector.vmstat.fields
metadata.description
Bagian kolom deskripsi jika ada dalam log
--message-log
metadata.description
Bagian kolom deskripsi jika ada dalam log
--name
metadata.description
Bagian kolom deskripsi jika ada dalam log
--net
metadata.description
Bagian kolom deskripsi jika ada dalam log
--path.procfs
metadata.description
Bagian kolom deskripsi jika ada dalam log
--path.rootfs
metadata.description
Bagian kolom deskripsi jika ada dalam log
--path.sysfs
metadata.description
Bagian kolom deskripsi jika ada dalam log
-v /:/rootfs:ro
metadata.description
Bagian kolom deskripsi jika ada dalam log
-v /proc:/host/proc
metadata.description
Bagian kolom deskripsi jika ada dalam log
-v /sys:/host/sys
metadata.description
Bagian kolom deskripsi jika ada dalam log
CID
metadata.description
Bagian kolom deskripsi jika ada dalam log
ERROR
security_result.severity
Diekstrak dari pesan log menggunakan pencocokan pola grok.
falconctl
metadata.description
Bagian kolom deskripsi jika ada dalam log
ip-1-2-4-2
principal.ip
Diekstrak dari pesan log menggunakan pencocokan pola grok dan dikonversi ke format alamat IP standar.
ip-1-2-8-6
principal.ip
Diekstrak dari pesan log menggunakan pencocokan pola grok dan dikonversi ke format alamat IP standar.
java
target.process.command_line
Diekstrak dari pesan log menggunakan pencocokan pola grok.
Jun13
metadata.event_timestamp.seconds
Bagian kolom stempel waktu jika ada dalam log, digabungkan dengan kolom month_date dan time_stamp.
[kworker/u16:8-kverityd]
target.process.command_line
Diekstrak dari pesan log menggunakan pencocokan pola grok.
root
principal.user.userid
Diekstrak dari pesan log menggunakan pencocokan pola grok.
metadata.event_type
Ditentukan berdasarkan keberadaan dan nilai kolom lainnya: - "STATUS_UPDATE" jika src_ip ada. - "NETWORK_CONNECTION" jika src_ip dan dest_ip ada. - "USER_UNCATEGORIZED" jika user_id ada. - "GENERIC_EVENT" jika tidak.
metadata.log_type
Tetapkan ke "AWS_SESSION_MANAGER".
metadata.product_name
Tetapkan ke "AWS Session Manager".
metadata.vendor_name
Tetapkan ke "Amazon".
target.process.pid
Diekstrak dari pesan log menggunakan pencocokan pola grok.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis guide outlines how to ingest AWS Session Manager logs into Google Security Operations (SecOps) to enhance security and track remote access events.\u003c/p\u003e\n"],["\u003cp\u003eBefore configuring the log ingestion, you need to have a Google SecOps instance and privileged access to AWS, as well as creating an Amazon S3 bucket and an IAM user with appropriate permissions.\u003c/p\u003e\n"],["\u003cp\u003eYou must configure AWS Session Manager to save logs to a designated S3 bucket by enabling S3 logging in the Session Manager preferences and selecting the proper bucket.\u003c/p\u003e\n"],["\u003cp\u003eTo complete the integration, create a new feed in Google SecOps by specifying the Amazon S3 source type, AWS Session Manager log type, the S3 bucket region and URI, and AWS access credentials.\u003c/p\u003e\n"],["\u003cp\u003eThe log data fields collected from AWS Session Manager are mapped to the Google SecOps UDM fields to help make the data more useful.\u003c/p\u003e\n"]]],[],null,["# Collect AWS Session Manager logs\n================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document explains how to ingest AWS Session Manager logs to Google Security Operations. AWS Session Manager provides secure and auditable access to Amazon EC2 instances and on-premises servers. By integrating its logs into Google SecOps, you can enhance your security posture and track remote access events.\n\nBefore you begin\n----------------\n\nEnsure you have the following prerequisites:\n\n- Google SecOps instance\n- Privileged access to AWS\n\nConfigure AWS IAM and S3\n------------------------\n\n1. Create an **Amazon S3 bucket** following this user guide: [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html)\n2. Save the bucket **Name** and **Region** for later use.\n3. Create a user following this user guide: [Creating an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html#id_users_create_console).\n4. Select the created **User**.\n5. Select the **Security credentials** tab.\n6. Click **Create Access Key** in the **Access Keys** section.\n7. Select **Third-party service** as the **Use case**.\n8. Click **Next**.\n9. Optional: add a description tag.\n10. Click **Create access key**.\n11. Click **Download CSV file** to save the **Access Key** and **Secret Access Key** for later use.\n12. Click **Done**.\n13. Select the **Permissions** tab.\n14. Click **Add permissions** in the **Permissions policies** section.\n15. Select **Add permissions**.\n16. Select **Attach policies directly**.\n17. Search for and select the **AmazonS3FullAccess** policy.\n18. Click **Next**.\n19. Click **Add permissions**.\n\nHow to configure AWS Session Manager to Save Logs in S3\n-------------------------------------------------------\n\n1. Go to the [AWS Systems Manager console](https://console.aws.amazon.com/systems-manager/).\n2. In the navigation pane, select **Session Manager**.\n3. Click the **Preferences** tab.\n4. Click **Edit**.\n5. Under S3 logging, select the **Enable** checkbox.\n6. Deselect the **Allow only encrypted S3 buckets** checkbox.\n7. Select an Amazon S3 bucket that has already been created in your account to store session log data.\n8. Enter the name of an Amazon S3 bucket that has already been created in your account to store session log data.\n9. Click **Save**.\n\nSet up feeds\n------------\n\nThere are two different entry points to set up feeds in the\nGoogle SecOps platform:\n\n- **SIEM Settings \\\u003e Feeds \\\u003e Add New**\n- **Content Hub \\\u003e Content Packs \\\u003e Get Started**\n\nHow to set up the AWS Session Manager feed\n------------------------------------------\n\n1. Click the **Amazon Cloud Platform** pack.\n2. Locate the **AWS Session Manager** log type.\n3. Specify the values in the following fields.\n\n - **Source Type**: Amazon SQS V2\n - **Queue Name**: The SQS queue name to read from\n - **S3 URI** : The bucket URI.\n - `s3://your-log-bucket-name/`\n - Replace `your-log-bucket-name` with the actual name of your S3 bucket.\n - **Source deletion options**: Select the deletion option according to your ingestion preferences.\n\n | **Note:** If you select the `Delete transferred files` or `Delete transferred files and empty directories` option, make sure that you granted appropriate permissions to the service account.\n - **Maximum File Age**: Include files modified in the last number of days. Default is 180 days.\n\n - **SQS Queue Access Key ID**: An account access key that is a 20-character alphanumeric string.\n\n - **SQS Queue Secret Access Key**: An account access key that is a 40-character alphanumeric string.\n\n **Advanced options**\n - **Feed Name**: A prepopulated value that identifies the feed.\n - **Asset Namespace**: Namespace associated with the feed.\n - **Ingestion Labels**: Labels applied to all events from this feed.\n4. Click **Create feed**.\n\n| **Note:** The Content Hub is not available on the SIEM standalone platform. To upgrade, contact your Google SecOps representative.\n\nFor more information about configuring multiple feeds for different log types within this product family, see [Configure feeds by product](/chronicle/docs/ingestion/ingestion-entities/configure-multiple-feeds).\n\nUDM Mapping Table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
