🪵 Send logs to XSIAM SoC

[bagg3rs]

User Story

As a SoC
I want security logs from all things
So that we have a central source of security logs in order to process for threats correlations

Value / Purpose

Security Operations Center needs our logs and they will process with Palo Alto Cortex to check for bad things.

Useful Contacts

Rich, Julia

Proposal

Do what MP/CP did see thread

Additional Information

See thread here

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/Ingest-Network-Route-53-Logs-from-Amazon-S3

Definition of Done

• Terraform deployed to enable logs (see thread above MP and CP have done this)
• Logs sent
• Logs verified by SoC team
• Add runbook

[darren1988]

To be refined and planned into next sprint

[YvanMOJdigital]

Waiting for team to send current error logs before planning this.

[darren1988]

logs for review:

https://docs.google.com/spreadsheets/d/1QO56aMBeX4rIKKT2loo-6DB0BBIPog5v/edit?gid=2007438121#gid=2007438121

[julialawrence]

Spoke with MP. Their code, while getting the job done is not quite ready to be reused. They're continuing to work on it. Recommend we park until the issues are worked out. If we want to go our own way, we will need a spike first to settle on an approach.

[julialawrence]

Further, Cortex is currently struggling to ingest the logs from MP as the number of entries and the length of individual events aren't being properly tokenized. We might want to await developments on this too.

[tjemideGH]

@darren1988
I have reviewed the incidents, and 71 appear to be false positives, and 17 seem not to be False Positive.

Please see the attached links to my review. I created a new column that explained my rationale for the review. Reason for Potential False Positive and Reason for Medium Severity and Not False Positive

[tjemideGH]

I have completed the review and send it to SOC for review. The SOC has sent the two 71 false positives, and 17 seem not to be False Positive to MIP to come up with a plan of action. No further action required from AP. The SOC confirmed that this ticket can be closed.