Configuring AWS Inspector Connectors

The AWS Inspector connector allows Stellar Cyber to ingest scan events from AWS Inspector.

Amazon Inspector is a vulnerability management service. It discovers and scans Amazon EC2 instances, container images in Amazon ECR, and Lambda functions. When Amazon Inspector detects a software vulnerability or unintended network exposure, it creates a finding, which is a detailed report about the issue.

Stellar Cyber connectors with the Collect function (collectors) may skip collecting some data when the ingestion volume is large, which potentially can lead to data loss. This can happen when the processing capacity of the collector is exceeded.

Connector Overview: AWS Inspector

Adding an AWS Inspector Connector

To add an AWS Inspector connector:

1. Obtain AWS Inspector credentials
2. Add the connector in Stellar Cyber
3. Test the connector
4. Verify ingestion

Obtaining AWS Inspector Credentials

There are two authentication methods: Access Key / Secret Key or IAM Role (IAM Assume Role).

Configuring Credentials for Access Key / Secret Key

To configure the credentials for Access Key / Secret Key Auth Method:

1. Log in to the IAM Console with your AWS account ID, your IAM user name, and password. You must have the permissions required to create access keys for a user.

2. Choose Users, then click the user name, and click Security credentials.

   

3. In the Access keys section, choose Create access key. Access keys have two parts: an access key and a secret access key. Click Create access key.

   

4. On the Access key best practices & alternatives page, choose Other and then choose Next.

   

5. (Optional) On the Set description tag page, enter a description.

6. Click Create access key.

7. On the Retrieve access keys page, choose Show to reveal the value of the user's secret access key. Save the access key and secret access key in a secure location. You will need them when configuring the connector in Stellar Cyber.

   

8. Click Done.

For Access Key / Secret Key Auth Method, attach the policy to the user. See Attach Permissions Policies to User. For IAM Role Auth Method, attach the policy to the IAM role. See Configuring Credentials for IAM Role.

Attach Permissions Policies to User

1. In the AWS Management Console, Services, navigate to Identity and Access Management (IAM) and click Users.

   

2. Find your user on the Users page and select it.

3. In the Permissions tab, click Add permissions > Add permissions.

   

4. Select Attach policies directly.

   

5. Select the following permissions: AmazonInspectorReadOnlyAccess and AmazonInspector2ReadOnlyAccess. (In the Search box, you can type inspector.)

6. Click Next.

7. Click Add permissions.

8. The Permissions policies are attached to the user.

   

Configuring Credentials for IAM Role

To configure the credentials for IAM Role (IAM Assume Role) Auth Method:

1. In the AWS Management Console, Services, navigate to Identity and Access Management (IAM) and click Roles.

   

2. Click Create Role.

   

3. Click Custom trust policy.

   

4. Using the example below as a guide, edit the JSON policy document.

   The following is just an EXAMPLE. You must modify this JSON to match the resources in your own environment.

   Copy

   AWS Inspector custom trust policy

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "Statement1",
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::001xxxxxx433:user/<username>"
               },
               "Action": "sts:AssumeRole"
           }
       ]
   }

5. Click Next.

6. Select the following permissions: AmazonInspectorReadOnlyAccess and AmazonInspector2ReadOnlyAccess. (In the Search box, you can type inspector.)

   

7. Click Next.

8. Enter a Role name.

   

9. Click Create role.

   

10. Find your role name on the Roles page and select it.

    

11. Copy your ARN, which you will need when configuring the connector in Stellar Cyber.

Adding the Connector in Stellar Cyber

With the credential and log information available, you can now add the AWS Inspector connector in Stellar Cyber:

1. Log in to Stellar Cyber.

2. Click System | Connectors (under Integrations). The Connector Overview appears.

   

3. Click Create. The General tab of the Add Connector screen appears. The information on this tab cannot be changed after you add the connector.

   

   The asterisk (*) indicates a required field.

4. Choose Vulnerability Scanner from the Category drop-down.

5. Choose AWS Inspector from the Type drop-down.

6. For this connector, the supported Function is Collect, which is enabled already.

7. Enter a Name.

   Notes:

   • This field does not accept multibyte characters.
   • It is recommended that you follow a naming convention such as tenantname-connectortype.

8. Choose a Tenant Name. The Interflow records created by this connector include this tenant name.

9. Choose the device on which to run the connector.

   • Certain connectors can be run on either a Sensor or a Data Processor. The available devices are displayed in the Run On menu. If you want to associate your collector with a sensor, you must have configured that sensor prior to configuring the connector or you will not be able to select it during initial configuration. If you select Data Processor, you will need to associate the connector with a Data Analyzer profile as a separate step. That step is not required for a sensor, which is configured with only one possible profile.

   • If the device you're connecting to is on premises, we recommend you run on the local sensor. If you're connecting to a cloud service, we recommend you run on the DP.

10. (Optional) When the Function is Collect, you can apply Log Filters. For information, see Managing Log Filters.

11. Click Next. The Configuration tab appears.

    

    The asterisk (*) indicates a required field.

12. Choose the Auth Method to use Access Key / Secret Key or IAM Role.

    For Access Key / Secret Key Auth Method:

    1. Enter the Access Key you noted above in Configuring Credentials for Access Key / Secret Key.

    2. Enter the Secret Key you noted above.

    For IAM Role Auth Method:

    

    The asterisk (*) indicates a required field.

    1. Enter the Source Account Access Key you noted above in Configuring Credentials for Access Key / Secret Key.

    2. Enter the Source Account Secret Key.

    3. Enter the IAM Role ARN that you noted above in Configuring Credentials for IAM Role.

13. Choose a Region from the available regions in the drop-down.

14. Choose the Interval (min). This is how often the logs are collected.

15. (Optional) Click Disable SSL Certificate Verification if you want to disable SSL certificate verification. Only disable SSL certificates if you have a reason to, otherwise, it is not a good security practice.

16. Click Next. The final confirmation tab appears.

    

17. Click Submit.

    To pull data, a connector must be added to a Data Analyzer profile if it is running on the Data Processor.

18. If you are adding rather than editing a connector with the Collect function enabled and you specified for it to run on a Data Processor, a dialog box now prompts you to add the connector to the default Data Analyzer profile. Click Cancel to leave it out of the default profile or click OK to add it to the default profile.

    • This prompt only occurs during the initial create connector process when Collect is enabled.

    • Certain connectors can be run on either a Sensor or a Data Processor, and some are best run on one versus the other. In any case, when the connector is run on a Data Processor, that connector must be included in a Data Analyzer profile. If you leave it out of the default profile, you must add it to another profile. You need the Administrator Root scope to add the connector to the Data Analyzer profile. If you do not have privileges to configure Data Analyzer profiles, a dialog displays recommending you ask your administrator to add it for you.

    • The first time you add a Collect connector to a profile, it pulls data immediately and then not again until the scheduled interval has elapsed. If the connector configuration dialog did not offer an option to set a specific interval, it is run every five minutes. Exceptions to this default interval are the Proofpoint on Demand (pulls data every 1 hour) and Azure Event Hub (continuously pulls data) connectors. The intervals for each connector are listed in the Connector Types & Functions topic.

    The Connector Overview appears.

The new connector is immediately active and starts collecting logs.

Testing the Connector

When you add (or edit) a connector, we recommend that you run a test to validate the connectivity parameters you entered. (The test validates authentication and connectivity).

1. Click System | Connectors (under Integrations). The Connector Overview appears.

   

2. Locate the connector by name that you added, or modified, or that you want to test.

3. Click Test at the right side of that row. The test runs immediately.

   Note that you may run only one test at a time.

Verifying Ingestion

To verify ingestion:

1. Click Investigate | Threat Hunting. The Interflow Search tab appears.
2. Change the Indices to Syslog. The table immediately updates to show ingested Interflow records.