Security Operations

A guide on using Monad for operational efficiencies to respond to threats more efficiently.

Overview

This guide outlines how to leverage Monad to transform AWS CloudTrail logs and route specific IAM events to the appropriate teams. By applying efficient transformations to clean up the data and routing it appropriately, this solution introduces significant cost savings and operational efficiencies to enable security teams to respond to threats more efficiently.

The primary functions applied in this guide include:

• Renaming and flattening key fields in AWS CloudTrail logs
• Dropping unnecessary data fields to reduce ingestion volume and costs
• Routing IAM-related events directly to the IAM security team's Snowflake instance for immediate review

Outcomes

• Cost Savings: By eliminating noise from unnecessary fields and reducing the volume of ingested data, you minimize storage costs and streamline data pipelines.
• Operational Efficiency: The transformations make the data easier to query and work with, reducing the time spent on manual data manipulation and improving overall workflow efficiency.
• Automated Event Routing: By routing critical IAM events (such as user creation or policy changes) directly to the IAM team, you ensure that important activities are flagged for immediate review without manual intervention.

With this approach, security teams gain better control over AWS CloudTrail data, enhances response times for critical security events, and optimizes resources to focus on high-value activities.

2. Navigate to https://app.monad.com/

Tip: Note: For this guide, we will use existing inputs and outputs. The setup instructions for integrations can be found throughout in the [[Inputs]] and [[Outputs]] sections of our docs.

Creating a New Pipeline

1. Click "Create a new pipeline."
2. Give your pipeline a descriptive name, such as "CloudTrail_Pipeline."
3. Create or add your existing AWS CloudTrail input connector.
4. Create or add your existing Splunk output connector.
5. Click "+Create" to finalize and create your pipeline.

Creating and Optimizing a Transform

1. Click "Transforms" in the side panel.
2. Click "Create new transform."
3. Give your transform a name, for example, "Optimize_CloudTrail_Events."
4. Next, we'll create a few transform operations to optimize our CloudTrail events.

Rename Fields

1. Click "Add an operation"
2. Click "+Create"
3. In the key-value fields, type eventName in the first field and action in the second field.
4. Click "Add"
5. Click "Add an operation."
6. Click "+Create."
7. In the key-value fields, type userIdentity in the first field and actor in the second field.
8. Click "Add."

Flatten User Identity Properties

1. Click "Add an operation."
2. Click "+Create."
3. Select "flatten" from the operation list.
4. Type actor in the key field (previously renamed from userIdentity).
5. Click "Add."

Add Timestamp

1. Click "Add an operation"
2. Click "+Create"
3. Select the "timestamp" operation.
4. In the "Key " field, type event_seen_at.
5. Select the "iso8601" option.
6. Click "Add"

Drop Unnecessary Fields

1. Click "Add an operation."
2. Click "+Create."
3. Select "drop key where value eq" from the operation list.
4. Drop the eventCategory.tlsDetails.clientProvidedHostHeader field.
5. Click "Add."

Applying the Transform to Your Pipeline

1. Navigate to "Pipelines" from the side panel.
2. Click on "CloudTrail_Pipeline."
3. Click "Configure."
4. Apply the "Optimize_CloudTrail_Events" transform to the pipeline:
   • First, remove the default "Always" condition.
   • To remove it, click on the "Always" icon and either press backspace or click the "Remove" button located in the top right corner of the pipeline builder page.

10. ### Adding the Transform and Configuring Data Routing

1. Drag the "Optimize_CloudTrail_Events" transform into the pipeline builder and place it between your input and output.
2. Drag the edges of each node to connect them, creating a connection between all three components: input, transform, and output.

Now that the "Optimize_CloudTrail_Events" transform is applied, we'll add our IAM Security Team's preferred output destination, Snowflake and then we'll apply intelligent data routing to ensure the IAM team receives their highest-priority Cloudtrail events.

Adding the IAM Team's Snowflake Output and Configuring Routing

1. To add the IAM team's existing Snowflake output:

   • Remember, for brevity, we are using existing connectors. To set up new connectors, refer to our documentation.

2. While in configuration mode, drag the Snowflake connector into the pipeline builder graph.

3. Drag the edge of the "Optimize_CloudTrail_Events" transform and connect it to the "Snowflake_IAM" connector.

In the next step, we will apply conditional routing logic to this edge to ensure the IAM team receives key IAM-related events.

Configuring Routing Conditions

1. Click "Edit conditions" in the top right corner.
2. In the 'Operator' section, click the dropdown menu and select the "and" option.
3. Under the "Rules" section, add a new rule and ensure it is of type "Key has one of value."
4. In the "Key" field, type "action."
5. In the "Values" section, add the following values, pressing Enter after each one:
   • CreateUser
   • AttachUserPolicy
   • CreateAccessKey
   • DeleteUser
   • DeleteRole
   • AttachRolePolicy
6. Click "Update."
7. Finally, save the changes to your pipeline by clicking "Save" in the top right corner of the page.

Conclusion

Congratulations! You've successfully completed the guide on transforming AWS CloudTrail logs with Monad and routing key IAM events efficiently. By applying these transformations, you've reduced data volume, cut costs, and streamlined operations, enabling your security teams to respond quickly to critical events.

Results

• Cost savings through reduced data ingestion and storage.
• Improved efficiency with cleaner, easier-to-query CloudTrail data.
• Faster threat response by automatically routing high-priority IAM events to the right teams.

With this setup, your security teams are better equipped to focus on critical tasks and maintain a secure cloud environment. Great job!