Collect AWS CloudTrail Logs on an AWS Sensor

Overview
USM Anywhere Architecture
USM Anywhere Data Security
USM Anywhere Log Data Enhancement
USM Anywhere Quick Start Guides
USM Anywhere Deployment Guide
- Overview
- USM Anywhere Deployment Types and Scalability
- USM Anywhere Sensor Deployments
  - Overview
  - AWS Sensor Deployment
    - Overview
    - Requirements for AWS Sensor Deployment
    - Deploy the AWS Sensor
    - Connect the AWS Sensor to USM Anywhere
    - Complete the AWS Sensor Setup
    - Enable Connections in an AWS VPC
    - VPC Traffic Mirroring with an AWS Sensor
    - Adding an Additional Sensor for Other AWS Accounts
    - AWS Log Discovery and Collection in USM Anywhere
  - Azure Sensor Deployment
  - GCP Sensor Deployment
  - Hyper-V Sensor Deployment
  - VMware Sensor Deployment
  - Deploying Your Sensor in a DHCP Environment
- The AWS Cloud Connector Deployment in USM Anywhere
- Network Setup and Configuration
- Data Sources and Log Collection
- File Integrity Monitoring
- Alarm and Event Notifications
- Troubleshooting and Remote Sensor Support
USM Anywhere User Guides
- Overview
- Getting Started with USM Anywhere
- USM Anywhere Best Practices
- USM Anywhere Dashboards
- Asset Management
- Alarms Management
- System Events Management
- Console User Events on USM Anywhere
- Configuration Issues Management
- User Behaviour Analytics
- Events Management
- USM Anywhere Scheduler
  - Overview
  - USM Anywhere Scheduler Best Practices
  - Managing Jobs in the Scheduler
  - Scheduling Active Directory Scans from the Job Scheduler Page
  - Scheduling Asset Scans from the Job Scheduler Page
  - Scheduling Asset Groups Scans from the Job Scheduler Page
  - Scheduling User Discovery Jobs from the Job Scheduler Page
  - Scheduling Log Collection from the Job Scheduler Page
    - Overview
    - AWS Log Discovery and Collection in USM Anywhere
    - Azure Log Discovery and Collection in USM Anywhere
- Rules Management
- Vulnerability Assessment
- Open Threat Exchange® and USM Anywhere
- USM Anywhere Sensor Management
- The AWS Cloud Connector in USM Anywhere
- Subscription Management
- USM Anywhere Reports
- Machine Learning
- USM Anywhere User Management
- Using USM Anywhere for PCI Compliance
- USM Anywhere Investigations
- System Status within USM Anywhere
USM Anywhere Agents Guide
USM Anywhere BlueApps Guide

Amazon Web Services (AWS) CloudTrail provides a complete audit log for all actions taken with the Amazon API, either through the web user interface (UI), the AWS Command Line Interface (CLI), or an AWS software development kit (SDK). Ongoing monitoring of this log gives you visibility of end user and automated actions in your environment. This helps you quickly detect abuse cases and security incidents, such as a user trying to make changes to an AWS account that are inconsistent with their privileges. USM Anywhere automatically detects AWS CloudTrail and retrieves your AWS CloudTrail logs across all regions within a single AWS account. USM Anywhere also provides you the credentials to securely access your AWS CloudTrail logs. When a new trail is detected, a new log collection job is automatically created and enabled to capture the logs in that trail. Similarly, if a trail is deleted, the existing job that was created for it is automatically deleted. As the AWS Sensor collects this raw log data, USM Anywhere uses its AWS CloudTrail data source to the data and generate meaningful events. Depending on the size and activity in your AWS account, this log collection can produce an excessive number of events. See Managing Collected CloudTrail Event Logs for a list of possible CloudTrail events. Similarly, if your AWS instance includes organizations, you may create a trail that will log all events for any AWS accounts assigned to an organization.

Note: If you choose not to enable AWS CloudTrail, USM Anywhere processes all stored logs at initial startup. See the Amazon documentation for information about enabling AWS CloudTrail. After that initial processing, log collection jobs run every five minutes to ensure that logs are captured and can generate meaningful events in a timely manner.

Note: Sometimes you may see that the CloudTrail events in USM Anywhere display a different username compared to the raw log. This is because CloudTrail provides different types of user identities, one of which is AssumedRole. When the user identity type is set to AssumedRole, it means that the user credential is temporary and the username you see in the raw log is not the actual username. See Amazon documentation for more information.

To enable AWS CloudTrail for your AWS Sensor

Go to Settings > Scheduler.
Search for CloudTrail in the Job Scheduler Filter By field.
In the row for the CloudTrail job, click the icon to enable the AWS CloudTrail jobs. This turns the icon green.

The following video demonstrates how to configure AWS to capture CloudTrail logs and where USM Anywhere displays CloudTrail events:

USM Anywhere™

USM Central™

Automated Policy Manager

Collect AWS CloudTrail Logs on an AWS Sensor