Send Clumio audit logs to AWS CloudTrail Lake

Customers can ingest and analyze events in an AWS CloudTrail compatible schema from Clumio, as well as other third-party and non-AWS sources to streamline auditing, security investigation, and operational troubleshooting.

With the release of CloudTrail Lake, AWS made it simpler to manage audit logs from disparate sources. CloudTrail Lake is a managed security and audit data lake that lets organizations aggregate, immutably store, and query events recorded by AWS CloudTrail. This can be done across different regions and accounts. By default, an event data store keeps events for one year, and you can extend retention up to 10 years to help you meet compliance requirements.

Once the integration is enabled, you can capture and store audit activity across various categories. With this information, you can easily answer many security and compliance-related questions such as:

• Authentication: Was there a high volume of unsuccessful logins to the Clumio console, indicating a brute force entry attempt or an issue with your Single Sign On provider?

• User management: When was a user added to the Development Organization in Clumio, and when were they given the backup Admin role?

• Backups: When was a backup policy accidentally changed? This will help you quickly determine when a backup policy was changed or created to ensure you’re always meeting both long-term compliance requirements and maintaining any minimum required RPO’s (recovery point objectives).

• Restores: Is someone browsing the CEO’s email history, or trying to recover Payroll information from a system backup? This activity is tracked even if a restore hasn’t been initiated.

• S3 protection groups: When was a new S3 production bucket added to a protection group? Why was a bucket removed?

Configuration

1. Get Clumio's external ID

   First, in Clumio, navigate directly to the Administration > Security page. Click Edit in the AWS CloudTrail integration panel.

   You must have the Super Admin role to set up the integration.

   Copy the external ID unique to your integration with CloudTrail. Copy this value, and continue to setup the next portion of the integration in AWS directly.

2. Configure the integration in AWS

   After logging on to the AWS Console, navigate to CloudTrail, where you will find a new Integrations section under Lake. Click Add Integration to configure the Clumio integration.

   See Working with AWS CloudTrail Lake.

   Give a name to the channel that Clumio will use to send the audit logs data and then select Clumio as the source. 

3. Next, you need a location to deliver the Clumio audit logs and determine how long you would like to get the logs. You can either use an existing event data store or create a new one for this integration.

4. Configure the resource policy that provides Clumio with a secure way to send the audit log data across the channel. Paste in the external ID we copied from the Clumio interface.

5. Lastly, apply any tags you may want to add to the resource and select Add Integration.

   The integration is now set up.

6. Copy the Channel ARN value and bring it back to Clumio, to complete the setup. 

7. Connect your Clumio environment to CloudTrail Lake.

   Return to the Clumio console and add the Channel ARN value, then click Connect to CloudTrail.

   An initial event will be sent to the CloudTrail Lake event data store, allowing you to verify connectivity. From there, your Clumio audit events will be regularly sent to the CloudTrail Lake data store.

   Additionally, you’ll be able to monitor the health of the integration at any time through the Audit Log report. 

8. Query logs from CloudTrail Lake.

   CloudTrail Lake allows you to write robust SQL-based queries on the Clumio audit events sent to the event data store. 

Here's an example query that shows all recent audit logs from Clumio:

SELECT eventData.uid, eventData.eventTime, eventData.eventname, eventData.additionaleventdata, eventData FROM [event_data_store_id] ORDER BY eventTime DESC

Audit event categories

Clumio sends events from every category in the Audit log report to CloudTrail Lake.

In CloudTrail Lake, each event's eventName is the category and the action joined by a colon, such as THREAT_DETECT:UPDATE. Both parts use Clumio's internal names rather than the labels in the Audit log report, so use the names above when you query. For example, a full restore appears as RESTORE:REGULAR.