AWS AmazonCloudWatch documentation change
Summary
Added parseToOCSF processor documentation for converting logs to OCSF format and updated CSV delimiter examples
Security assessment
The parseToOCSF processor addition helps standardize security logs using OCSF framework, which improves security analysis capabilities. However, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.md b/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.md index 1ddd62e72..2c8feefdf 100644 --- a//AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.md +++ b//AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.md @@ -36,0 +37,2 @@ This section contains information about each processor that you can use in a log + * [parseToOCSF](./CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-parseToOCSF) + @@ -84,0 +87,2 @@ This section contains information about each processor that you can use in a log + * [Transformation metrics and errors](./Transformation-Errors-Metrics.html) + @@ -508,0 +513,31 @@ Output: +### parseToOCSF + +The **parseToOCSF** processor converts logs into [Open Cybersecurity Schema Framework (OCSF)](https://ocsf.io) format. + +The original `@message` content is not changed, the new keys are added to the message. + +Field | Description | Required? | Default | Limits +---|---|---|---|--- +eventSource | The service or process that produces the log events that will be converted with this processor. Valid values are the following: + + * `CloudTrail` for [ CloudTrail logging management events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html), [ Lambda data events in CloudTrail](https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html#cloudtrail-data-events), , or [ Amazon S3 data events in CloudTrail](https://docs.aws.amazon.com/waf/latest/developerguide/logging-examples.html). + * `Route53Resolver` for [ Route 53 Resolver query logs](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-query-logs.html). + * `VPCFlow` for [ Amazon VPC flow logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html). + * `EKSAudit` for [ Amazon EKS audit logs](https://docs.aws.amazon.com/eks/latest/best-practices/auditing-and-logging.html). + * `AWSWAF` for [AWS WAF logs](https://docs.aws.amazon.com/waf/latest/developerguide/logging.html). + +| Yes | - | - +ocsfVersion | The version of the OCSF schema to use for the transformed log events. Currently, the only supported value is `V1.1` | Yes | `V1.1` | - + +**Example** + +The following example transforms Amazon VPC flow logs to OCSF format. + + + [ + "parseToOCSF": { + eventSource: "VPCFlow", + version: "V1.1" + } + ] + @@ -516 +551 @@ source | Path to the field in the log event that will be parsed | No | `@messag -delimiter | The character used to separate each column in the original comma-separated value log event | No | `,` | Maximum length: 1 unless the value is `\t` or `\s` +delimiter | The character used to separate each column in the original comma-separated value log event | No | `,` | Maximum length: 1 @@ -520,2 +554,0 @@ columns | List of names to use for the columns in the transformed log event. | -Setting `delimiter` to `\t` will separate each column on a tab character, and `\t` will separate each column on a single space character. - @@ -527 +560 @@ Suppose part of an ingested log event looks like this: - 'Akua Mansa':28:'New York: USA' + 'Akua Mansa',28,'New York, USA' @@ -533 +565,0 @@ Suppose we use only the **csv** processor: - { @@ -535,3 +567,2 @@ Suppose we use only the **csv** processor: - "delimiter": ":", - "quoteCharacter": "'" - } + "delimiter": ",", + "quoteCharacter": ":""