Collect Uptycs EDR logs

This document explains how you can ingest Uptycs EDR logs to Google Security Operations using Amazon S3. The parser transforms raw JSON logs into a unified data model (UDM). It first extracts fields from the JSON, performs data cleaning and enrichment, then maps the relevant information to corresponding UDM fields, handling various data types and edge cases to ensure accurate and consistent representation within the UDM schema.

Before you begin

Make sure you have the following prerequisites:

• A Google SecOps instance
• Privileged access to Uptycs
• Privileged access to AWS (S3, IAM)

Get Uptycs prerequisites

1. Sign in to the Uptycs Admin Console.
2. Go to Configuration > Users.
3. Select your user or create a service account user.
4. Click User API key.
5. Copy and save in a secure location the following details:
   • API Key
   • API Secret
   • Customer ID
   • API Domain (derived from your Uptycs URL, for example, mystack.uptycs.io)

Configure AWS S3 bucket and IAM for Google SecOps

1. Create Amazon S3 bucket following this user guide: Creating a bucket.
2. Save bucket Name and Region for future reference (for example, uptycs-telemetry-export).
3. Create a User following this user guide: Creating an IAM user.
4. Select the created User.
5. Select Security credentials tab.
6. Click Create Access Key in section Access Keys.
7. Select Third-party service as Use case.
8. Click Next.
9. Optional: Add a description tag.
10. Click Create access key.
11. Click Download CSV file to save the Access Key and Secret Access Key for future reference.
12. Click Done.
13. Select Permissions tab.
14. Click Add permissions in section Permissions policies.
15. Select Add permissions.
16. Select Attach policies directly.
17. Search for AmazonS3FullAccess policy.
18. Select the policy.
19. Click Next.
20. Click Add permissions.

Configure the IAM policy and role for S3 uploads

1. In the AWS console, go to IAM > Policies.
2. Click Create policy > JSON tab.

3. Enter the following policy:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "AllowPutObjects",
         "Effect": "Allow",
         "Action": "s3:PutObject",
         "Resource": "arn:aws:s3:::uptycs-telemetry-export/*"
       },
       {
         "Sid": "AllowListBucket",
         "Effect": "Allow",
         "Action": "s3:ListBucket",
         "Resource": "arn:aws:s3:::uptycs-telemetry-export"
       }
     ]
   }
   

   • Replace uptycs-telemetry-export if you entered a different bucket name.

4. Click Next > Create policy.

5. Name the policy uptycs-s3-write-policy.

6. Go to IAM > Users.

7. Select the user created for Uptycs exports.

8. Click Add permissions > Attach policies directly.

9. Search for and select uptycs-s3-write-policy.

10. Click Next > Add permissions.

Configure Uptycs Export Raw Telemetry

1. Sign in to the Uptycs Console.
2. Go to the export configuration section.
3. Configure the S3 export destination.
4. Provide the following configuration details:
   • Export Type: Select Raw Telemetry.
   • Destination: Select Amazon S3.
   • Format: Select JSON.
   • S3 Bucket: Enter uptycs-telemetry-export.
   • S3 Path Prefix: Enter telemetry/.
   • AWS Region: Select your bucket region.
   • AWS Access Key ID: Enter the Access Key from the IAM user.
   • AWS Secret Access Key: Enter the Secret Access Key.
   • Event Types: Select all required telemetry types.
5. Test and enable the export.

Create read-only IAM user for Google SecOps

1. Go to AWS Console > IAM > Users.
2. Click Add users.
3. Provide the following configuration details:
   • User: Enter secops-reader.
   • Access type: Select Access key – Programmatic access.
4. Click Create user.
5. Attach minimal read policy (custom): Users > secops-reader > Permissions > Add permissions > Attach policies directly > Create policy.

6. In the JSON editor, enter the following policy:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": ["s3:GetObject"],
         "Resource": "arn:aws:s3:::uptycs-telemetry-export/*"
       },
       {
         "Effect": "Allow",
         "Action": ["s3:ListBucket"],
         "Resource": "arn:aws:s3:::uptycs-telemetry-export"
       }
     ]
   }
   

7. Set the name to secops-reader-policy.

8. Go to Create policy > search/select > Next > Add permissions.

9. Go to Security credentials > Access keys > Create access key.

10. Download the CSV (these values are entered into the feed).

Configure a feed in Google SecOps to ingest Uptycs logs

1. Go to SIEM Settings > Feeds.
2. Click + Add New Feed.
3. In the Feed name field, enter a name for the feed (for example, Uptycs EDR logs).
4. Select Amazon S3 V2 as the Source type.
5. Select Uptycs EDR as the Log type.
6. Click Next.
7. Specify values for the following input parameters:
   • S3 URI: s3://uptycs-telemetry-export/telemetry/
   • Source deletion options: Select deletion option according to your preference.
   • Maximum File Age: Include files modified in the last number of days. Default is 180 days.
   • Access Key ID: User access key with access to the S3 bucket.
   • Secret Access Key: User secret key with access to the S3 bucket.
   • Asset namespace: The asset namespace.
   • Ingestion labels: The label applied to the events from this feed.
8. Click Next.
9. Review your new feed configuration in the Finalize screen, and then click Submit.

UDM Mapping Table

Need more help? Get answers from Community members and Google SecOps professionals.