...

Steps to enable Cisco Umbrella logs

Action

Steps

SQS Standard queue creation

  1. Go to Simple Queue Service and click Create queue.

  2. In the Details section:

    1. Choose Standard queue type.

    2. Set the Name field value you prefer.

  3. In the Configuration section:

    1. Set the Message retention period field value to 5 Days.

    2. Leave the rest values from Configuration section with the default ones.

  4. In the Access policy section:

    1. Choose method Advanced.

    2. Replace "Principal": {"AWS":"<account_id>"} with "Principal": "*" (leave rest of JSON as come)

  5. (Not mandatory) Tags section:

    1. Create one tag with Key “usedBy“ and Value “devo-collector“

  6. Click on Create queue button.

S3 bucket creation/configuration

  1. Go to S3 and click on Create bucket button.

  2. Set the preferred value in Bucket name field.

  3. Choose any Region value.

  4. Click the Next button.

  5. (Not mandatory) Create one tag with Key usedBy and Value devo-collector.

  6. Leave rest of fields with default values, click the Next button.

  7. Leave all values with default ones, click the Next button.

  8. Click the Create bucket button.

  9. Mark the checkbox next to the previously created S3 bucket.

  10. In the popup box, click the Copy Bucket ARN button and save the content for being used in the next steps.

  11. In S3 bucket list, click the previously created bucket name link.

  12. Click the Properties tab.

  13. Click the Events box.

  14. Click the + Add notification link.

  15. Set the preferred value in the Name field.

  16. Mark the All object create events checkbox.

  17. In the Send to field, select the SQS Queue as value.

  18. Select the previously created SQS queue in the SQS field.

Enable Logging to Your Own S3 Bucket

  1. Refer to vendor’s configuration steps: Enable Logging to Your Own S3 Bucket.

Minimum configuration required for basic pulling

...