How to onboard Amazon Web Services with foundational configuration - Follow the foundational configuration AWS onboarding wizard to enable audit log collection and asset discovery, and Cortex Cloud creates a custom CloudFormation template to be deployed in AWS CloudFormation. - Administrator Guide - Cortex CLOUD

1. In Cortex Cloud, select Settings → Data Sources & Integrations.

2. On the Data Sources & Integrations page, click + Add New.

3. On the Add Data Sources or Integrations page, search for Amazon Web Services (AWS), then hover over it and click Add.

• Select the scope for this cloud instance:

  • Organization: (Default) A collection of AWS accounts that are managed centrally.

  • Organizational Unit: A group of AWS accounts within an organization. An organizational unit can also contain other organizational units.

  • Account: A single AWS account.

• Click Show advanced settings to define the following advanced settings:

  • Instance Name: Enter a unique instance name or leave it empty to be automatically populated. The automatic naming convention is AWS-<accountID> or AWS-<organizationID>. Cortex Cloud does not prevent you from reusing instance names, but it is best practice to use a unique name for every cloud instance.

  • Scope Modifications: Use these settings to fine-tune your AWS scope, you can modify the scope by including or excluding specific regions. Additionally, if you selected an organization or organizational unit as the scope, you can modify the scope by including or excluding specific accounts. For more details, see Apply region or account filters.Overview of the onboarding AWS process

  • Additional Security Capabilities: Choose which security capabilities you want to benefit from. Some security capabilities are enabled by default and can be modified. Adding security capability typically requires additional cloud provider permissions. For detailed information on the permissions required, see Cloud service provider permissions.

    • XSIAM analytics: (Enabled by default) Analyzes your endpoint data to develop a baseline and raise Analytics and Analytics BIOC alerts when anomalies and malicious behaviors are detected.

    • Automation: Use automation to pre-configure a list of integrations and associated commands to automate security issue responses. Commands can be utilized individually or as part of custom playbooks for issue remediation.

  • Cloud Tags: Define tags and tag values to be added to any new resource created by Cortex Cloud in AWS. Note: The managed_by = paloaltonetworks tag is automatically added to all resources. This tag is mandatory. You cannot edit or remove this tag.

  • Log Collection Configuration: To maximize security coverage, include the collection of audit logs using CloudTrail. Select the collection method:

    • Automated collection: Select this option to have Cortex Cloud provisions CloudTrail, S3, SQS, SNS, and KMS key resources in your AWS environment to collect audit logs.

      • Collect data events: You can choose to collect data events, which captures S3 object-level and Lambda invocation events enhanced visibility.

      • Cost considerations: Data events can generate high volumes in active environments (millions of events per day for busy S3 buckets). We recommend you review your CloudTrail pricing and expected event volume before enabling.

    • Custom (user defined): (Default) Use this option to use an existing Amazon S3 bucket for storing your CloudTrail logs.

      • When you deploy the authentication template in CloudFormation, you will enter the following details: S3 bucket name, SNS topic ARN, KMS key ARN (optional, if bucket is encrypted).

      • Cortex Cloud creates the SQS queue, CloudTrailReadRole (IAM role - global), S3 event notification subscription.

      • After you deploy the stack in CloudFormation, you must configure the S3 bucket event notification to send to the Cortex Cloud-created SQS queue.

      Important

      It is critical to ensure that your KMS key region and SNS topic region are the exact same as the AWS region where you are deploying the CloudFormation stack.

• Click Save. Cortex Cloud generates a CloudFormation authentication template based on the settings you configured in the AWS onboarding wizard. Cortex Cloud creates an instance in the pending state. For details on pending instances, see Lifecycle and expiration.Overview of the onboarding AWS process

To complete the process, deploy the CloudFormation authentication template in AWS CloudFormation using one of the following methods:

1. Automated: (Recommended) Click Execute in AWS to be redirected to AWS CloudFormation to create the stack. Before you select Automated, verify that you are logged into the correct AWS account in your browser. For account scope, it is the account you are onboarding. For organization or OU scope, it is the management account. Deploying to the wrong account will cause deployment failures or create resources in the wrong location.

   You are redirected to the AWS CloudFormation console with the pre-populated template. Click through the wizard to create the stack.

2. Manual: Click Download CloudFormation to download the CloudFormation authentication template file. Follow the instructions to deploy the CloudFormation authentication template in AWS CloudFormation to create a stack.