Configure Managed AIRS for AWS logging.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
- Access to Strata Cloud Manager (SCM)
|
Managed AI Runtime security resource is an instance of the Cloud NGFW
service platform, you can
view logs natively in AWS similar to other
Cloud NGFW resources in Strata Cloud Manager.
You can then download the file and use a JSON reader to view the logs in a more
readable format. In addition to the log information, each log entry also contains a
header that records the date, priority, time, firewall host name, log type, year,
month, day, hour, minute, and second.
If you send log files to a Kinesis Firehose, logs are sent to the stream name that
you specify and then to the final destination; such as an S3 Bucket, Datadog, or
Splunk. The source for your Kinesis firehose must be Direct PUT or other
sources. In addition to the log information, each log entry also contains a
header that records the date, priority, time, firewall hostname, log type, year,
month, day, hour, minute, second, region, firewall name, and AWS account ID. The
NGFW adds the region, firewall name, and AWS account ID to the logs to help identify
where the log was generated because this information isn't included in the log file
name. You can then download the JSON file for viewing.
The times and dates recorded in log entries and log file names are displayed in
UTC time. However, the log dates displayed in the AWS console are displayed in
your local time and date.
Although URL filtering data is a subtype of the Threat log category, Cloud NGFW
implements special handling for these logs. URL filtering logs are routed to a
separate, dedicated log group rather than being bundled into the
primary Threat log group. Ensure you look for or allocate a separate log path
explicitly for URL filtering logs when verifying your AWS destination services
(like CloudWatch).
