Requirements

In order to forward Events/Logs to the AWS S3 Bucket, the following is required:

1. Create a new or use an existing AWS S3 Bucket.

2. Apply the following policy to the AWS S3 Bucket to permit the Multicloud Defense Controller to access and write to the bucket:

   
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": "<controller-role-arn>"
         },
         "Action": "s3:*",
         "Resource": [
           "arn:aws:s3:::<s3bucketname>/*",
           "arn:aws:s3:::<s3bucketname>"
         ]
       }
     ]
   }

Profile Parameters

Requirements

In order to forward logs to Datadog, the following information is required:

• Datadog account

• Endpoint URL

• API Key

Tip	To Sign up for a Datadog account, refer to Datadog Account (https://www.datadoghq.com/). To create a Datadog API Key, refer to Datadog API Key (https://app.datadoghq.com/account/login?next=%2Faccount%2Fsettings#api).

Profile Parameters

Requirements

The GCP multicloud defense-firewall Service Account must be assigned Logs Writer role in order for the Gateway to write events to the GCP Stackdriver Log.

Profile Parameters

Field Integer to String Mappings

When events are forwarded from the Controller, the Controller introduces mappings of event field values to friendly names. When events are forwarded directly from the Gateway (e.g., GCP Logging), the Controller is not involved and thus the event field values are not mapped to friendly names. In order to interpret these fields, the user is responsible for performing the field value to friendly name mapping.

The fields, sub-fields and their value to friendly mapping are provided below:

Requirements

In order to forward logs to Microsoft Sentinel, the following information is required:

• Create an Azure Log Analytics Workspace.

• Define an Azure Log Table.

Profile Parameters

Requirements

In order to forward logs to Splunk, the following information is required:

• Splunk account

• Splunk Collector URL

• Event Collector Key

• Index Name

Tip	For information on the Splunk Event Collector, refer to Splunk HTTP Event Collector (https://docs.splunk.com/Documentation/Splunk/8.1.0/Data/UsetheHTTPEventCollector).

Profile Parameters

Requirements

In order to forward logs to Sumo Logic, the following information is required:

• Sumo Logic account

• Sumo Logic collector endpoint

Tip	For information on how to setup Sumo Logic Collector, refer to Sumo Logic Setup Guide (https://help.sumologic.com/docs/send-data/setup-wizard/).

Profile Parameters

Profile Parameters

Note	The following levels of severity (highest to lowest) are available:

• Emergency

• Alert

• Criticial

• Error

• Warning

• Notice

• Info

• Debug

All events for the category that contain the severity level specified or higher will be sent to the syslog server.

Requirements

If you are forwarding logs to a service that requires an authetnication token or password, have that configured and readily available when creating this profile.

Profile Parameters