Skip to main content
Sumo Logic

Install the PCI Compliance for AWS Cloud Trail App and view the Dashboards

Install the Sumo Logic App

Now that you have set up collection, install the Sumo Logic App for PCI Compliance for AWS CloudTrail to use the preconfigured searches and Dashboards that provide insight into your data. 

To install the app:

  1. Select App Catalog, search for and select the app, and click Add to Library. (In the classic UI, click Library, click Apps, select the app, and click Install. If you don't find the app under Apps, it might be a preview app. Try clicking Preview to find the app.)
  2. Click Preview Dashboards if you'd like to see a preview of the dashboards included with the app before installing.
  3. In the Install Application dialog box, select the installation path (the default is the Personal folder in the library), or click New Folder to add a new folder.
  4. Select either of these options for the log data source.
  • Choose Select from Existing Source Categories, and select the source catalog from the Source Category list.
  • Choose Enter a Custom Data Filter and enter a custom source category beginning with an underscore. Example: (_sourceCategory=MyCategory).
  1. Click Add to Library.

Once an app is installed, it will appear in your Personal folder, or other folder that you specified. From here, you can share it with your organization. See Welcome to the New Library for information on working with the library in the new UI.

Panels will start to fill automatically. It's important to note that each Panel slowly fills with data matching the time range query and received since the Panel was created. Results won't immediately be available, but with a bit of time, you'll see full graphs and maps. 

Dashboards

The Sumo Logic PCI Compliance for AWS Cloud Trail App provides dashboards and sample queries that you can modify for your specific compliance needs.

  • Access Monitoring
  • Login Activity
  • Account and System Monitoring
  • Privileged Activity

PCI Compliance for AWS CloudTrail - PCI Req 01 - Access Monitoring

  • Security Group Activity. Pie chart of the security group activity over the last 24 hours.

  • Security Group Activity. Aggregation table of the security group activity over the last 24 hours.

  • Security Group Activity Over Time. Bar chart of security group activity time sliced by 30 minutes for the last 24 hours.

  • (All AWS Activities) Non Read Only Events. Aggregation table of the user, event, and count of non-read only events.

  • (All AWS Activities) Read Only Events. Aggregation table of the user, event, and count of read only events.

PCI Compliance for AWS CloudTrail - PCI Req 10 - Login Activity

PCI Compliance AWS Cloud Trail

  • Failed API Calls. Total number of failed API calls over the last 24 hours. Adjust time range as needed.

  • Failed API Calls- Reason - Login Credentials and Permission Issues. Aggregation table detailing failed API calls, source IP, destination user, event type, error code, region, and account ID.

  • Failed API Calls - Acct Breakup. Aggregation table of accounts with failed API calls and the number of events.

  • Console Login Failures. Aggregation table of failed logins from the console.

  • Successful Console Logins. Total number of successful logins over the last 24 hours. Adjust time range as needed.

  • Successful Console Logins.  For more details on successful console logins, see the aggregation table of the successful logins over the 24 hours.

PCI Compliance for AWS CloudTrail - PCI Req 08 - Account, System Monitoring

Search user account and IAM activity in compliance with PCI Requirement 08.

PCI Compliance AWS Cloud Trail Account System Monitoring

PCI Compliance AWS Cloud Trail IAM

 

  • Created Users. Aggregation table of users created in the last 24 hours.

  • Deleted Users. Aggregation table of users deleted in the last 24 hours.

  • Created Roles. Aggregation table of users created in the last 24 hours.

  • Deleted Roles. Aggregation table of users deleted in the last 24 hours.

  • Created Access Key. Aggregation table of access keys created in the last 24 hours.

  • Deleted Access Key.  Aggregation table of access keys deleted in the last 24 hours.

  • IAM Activity. Pie chart detailing the percentage of IAM Activity for policies and users over the last 24 hours.

  • IAM Activity. Aggregation table of IAM Activity for policies and users over the last 24 hours.

  • IAM Events Over Time. IAM events over the last 24 hours time sliced by every 30 minutes.

PCI Compliance for AWS CloudTrail - PCI Req 08, 10 - Privileged Activity

Review successful and failed configuration changes, and security group activity.

PCI Compliance AWS Cloud Trail Privileged Activity

PCI Compliance AWS Cloud Trail Priv Activity

 

  • Successful Configuration Changes. Pie chart of the successful configuration changes over the last 24 hours.

  • Successful Configuration Changes. Aggregation table of the successful configuration changes over the last 24 hours.

  • Failed Configuration Changes. Pie chart of the failed configuration changes over the last 24 hours.

  • Failed Configuration Changes. Aggregation table of the failed configuration changes over the last 24 hours.

  • Created Security Groups. Aggregation table of security groups created in the last 24 hours.

  • Deleted Security Groups. Aggregation table of security groups created in the last 24 hours.
  • Security Group Activity Over Time. Histogram of security group activity over the last 24 hours time sliced by hour.