Page Comparison

...

An analyst wants to detect unauthorized access behavior in isolated virtual networks within AWS.  Using the VPC SQS collector to send Flow logs to Devo, the analyst will find any unauthorized IP traffic.  As a result, the analyst will block the intruder, preventing them from disrupting private network services.

...

1. Authorize SQS Data Access.

2. Add data to the S3 bucket.

   1. Select the VPC.

   2. Create flow log.

      Image RemovedImage Added

   3. Name the Flow “Devo.”

   4. Devo recommends Filter All so that wrongly rejected and wrongly accepted traffic can be analyzed.

   5. Select Send to an Amazon S3 bucket.

      Image RemovedImage Added

   6. Use the ARN of the S3 bucket you created during the authorization process.

      

   7. Keeping the defaults for the other settings, create the flow.

...