Content Comparison

...

Devo recommends sending VPC data without using CloudWatch. If you wish to use CloudWatch instead of following these instructions, select the aws_sqs_cloudwatch_vpc service. The parsed logs will be the same.

1. Authorize SQS Data Access.

2. Add data to the S3 bucket.

   1. Select the VPC.

   2. Create flow log.

      Image RemovedImage Added

   3. Name the Flow “Devo.”

   4. Devo recommends Filter All so that wrongly rejected and wrongly accepted traffic can be analyzed.

   5. Select Send to an Amazon S3 bucket.

      

   6. Use the ARN of the S3 bucket you created during the authorization process.

...

g. Keeping the defaults for the other settings, create the flow.

Run It

In the Cloud Collector App, create an SQS Collector instance using this parameters template, replacing the values enclosed in < >.

{
  "inputs": {
    "sqs_collector": {
      "id": "<FIVE_UNIQUE_DIGITS>",
      "services": {
        "aws_sqs_vpc": {}
      },
      "credentials": {
              "aws_cross_account_role": "arn:<PARTITION>:iam::<YOUR_AWS_ACCOUNT_NUMBER>:role/<YOUR_ROLE>",
              "aws_external_id": "<EXTERNAL_ID>"
      },
      "region": "<REGION>",
      "base_url": "https://sqs.<REGION>.amazonaws.com/<YOUR_AWS_ACCOUNT_NUMBER>/<QUEUE_NAME>"
    }
  }
}

Secure It

Devo Exchange includes an alert pack for Netflow data, including VPC Flow by using netstat.netflow.all as data source.

...