AWS Log Discovery and Collection in USM Anywhere

Overview
USM Anywhere Architecture
USM Anywhere Data Security
USM Anywhere Log Data Enhancement
USM Anywhere Quick Start Guides
USM Anywhere Deployment Guide
- Overview
- USM Anywhere Deployment Types and Scalability
- USM Anywhere Sensor Deployments
  - Overview
  - AWS Sensor Deployment
    - Overview
    - Requirements for AWS Sensor Deployment
    - Deploy the AWS Sensor
    - Connect the AWS Sensor to USM Anywhere
    - Complete the AWS Sensor Setup
    - Enable Connections in an AWS VPC
    - VPC Traffic Mirroring with an AWS Sensor
    - Adding an Additional Sensor for Other AWS Accounts
    - AWS Log Discovery and Collection in USM Anywhere
  - Azure Sensor Deployment
  - GCP Sensor Deployment
  - Hyper-V Sensor Deployment
  - VMware Sensor Deployment
  - Deploying Your Sensor in a DHCP Environment
- The AWS Cloud Connector Deployment in USM Anywhere
- Network Setup and Configuration
- Data Sources and Log Collection
- File Integrity Monitoring
- Alarm and Event Notifications
- Troubleshooting and Remote Sensor Support
USM Anywhere User Guides
- Overview
- Getting Started with USM Anywhere
- USM Anywhere Best Practices
- USM Anywhere Dashboards
- Asset Management
- Alarms Management
- System Events Management
- Console User Events on USM Anywhere
- Configuration Issues Management
- User Behaviour Analytics
- Events Management
- USM Anywhere Scheduler
  - Overview
  - USM Anywhere Scheduler Best Practices
  - Managing Jobs in the Scheduler
  - Scheduling Active Directory Scans from the Job Scheduler Page
  - Scheduling Asset Scans from the Job Scheduler Page
  - Scheduling Asset Groups Scans from the Job Scheduler Page
  - Scheduling User Discovery Jobs from the Job Scheduler Page
  - Scheduling Log Collection from the Job Scheduler Page
    - Overview
    - AWS Log Discovery and Collection in USM Anywhere
    - Azure Log Discovery and Collection in USM Anywhere
- Rules Management
- Vulnerability Assessment
- Open Threat Exchange® and USM Anywhere
- USM Anywhere Sensor Management
- The AWS Cloud Connector in USM Anywhere
- Subscription Management
- USM Anywhere Reports
- Machine Learning
- USM Anywhere User Management
- Using USM Anywhere for PCI Compliance
- USM Anywhere Investigations
- System Status within USM Anywhere
USM Anywhere Agents Guide
USM Anywhere BlueApps Guide

Amazon Web Services (AWS) customers have access to service-specific log files to gain insight into how each AWS service is operating. In addition, applications running in AWS also generate various log files in different formats. With a deployed AWS Sensor, USM Anywhere can collect both logs from AWS, but the procedures are slightly different:

Use a predefined scheduler job USM Anywhere automatically discovers the AWS CloudTrail logs, the Amazon Simple Storage Service (S3) access logs, and some Amazon CloudWatch logs when they are enabled within your AWS account. There are predefined scheduler jobs in USM Anywhere to collect these logs but they are disabled by default. Go to Settings > Scheduler > Log Collection for the full list. You need to enable each job based on which log you want to collect. See Collect AWS CloudTrail Logs on an AWS Sensor, Collect Amazon S3 Access Logs and Collect ELB Access Logs for more information.
Use a customer-defined scheduler job If none of the predefined jobs collect from your log location, you can create a new job under Settings > Scheduler > Log Collection. Depending on where your logs are stored, USM Anywhere provides two ways to collect them:
- Amazon CloudWatch Logs: If you choose to use Amazon CloudWatch Logs in your AWS environment, USM Anywhere can collect CloudWatch logs directly. See Collect AWS CloudTrail Logs on an AWS Sensor for more information. For example, you can collect the Amazon Virtual Private Cloud (VPC) flow logs using this method.
- Amazon S3 bucket: If you choose to store logs in an Amazon S3 bucket instead, USM Anywhere can also collect logs directly from an Amazon S3 bucket. See Collect Other Logs from an Amazon S3 Bucket for more information.

USM Anywhere™

USM Central™

Automated Policy Manager

AWS Log Discovery and Collection in USM Anywhere