Ensure a Log Metric Filter and Alarm Exist for Security Group Changes

Rule Description: Log Metric Filter and Alarm for Security Group Changes - NIST CSF v1

Rule Summary:

Troubleshooting Steps:

2. 1.
   Check if the necessary AWS services (such as CloudWatch, CloudTrail) are properly configured and enabled.
4. 2.
   Ensure the appropriate IAM permissions are assigned to the account or user responsible for monitoring security group changes.
6. 3.
   Review the CloudTrail logs for any errors or issues related to security group logging and monitoring.

Necessary Code:

Resources:
  SecurityGroupChanges:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref 'LogGroup'
      FilterPattern: '{ ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup) || ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) }'
      MetricTransformations:
        - MetricName: SecurityGroupChanges
          MetricNamespace: AWS/Security
          MetricValue: 1

  SecurityGroupChangesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: SecurityGroupChangesAlarm
      AlarmDescription: Alarm for detecting security group changes
      Namespace: AWS/Security
      MetricName: SecurityGroupChanges
      Statistic: Sum
      Period: 300 # 5 minutes
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      AlarmActions:
        - !Ref 'SNSTopicArn'

Step-by-Step Guide for Remediation:

2. 1.
   Log in to the AWS Management Console.
4. 2.
   Navigate to the CloudWatch service.
6. 3.
   Click on "Log groups" in the left-hand menu.
8. 4.
   Choose the relevant log group where the security group changes should be logged.
10. 5.
    Click on the "Actions" dropdown menu and select "Create metric filter".
12. 6.
    In the "Filter pattern" field, enter the following pattern:

{ ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup) || ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) }

2. 1.
   Configure the "Filter name" and "Metric namespace" fields according to your preference or leave them as default.
4. 2.
   Under "Metric value", enter "1" to count each occurrence of a security group change as one metric.
6. 3.
   Click on "Assign metric".
8. 4.
   In the CloudWatch console, navigate to "Alarms" in the left-hand menu.
10. 5.
    Click on "Create alarm".
12. 6.
    Select "Browse" in the "Metric name" field and choose the metric name created in the previous step.
14. 7.
    Configure the alarm threshold, evaluation period, and other alarm properties according to your requirements.
16. 8.
    Specify the action to be taken when the alarm state is triggered (e.g., sending an email notification).
18. 9.
    Click on "Create alarm" to save the configuration.

Summary: