An insurance firm runs 40 AWS accounts for its business lines. Application logs in each account are written to CloudWatch Logs, and the security operations center in a separate central account runs its SIEM from an Amazon Data Firehose stream.
The SOC needs authentication-failure events from every account within a few seconds of their creation. Only those events should be sent, and the source accounts must keep ownership of their log groups.
The solution must not depend on a scheduled job or a polling process that the team would have to maintain.
Which solution meets these requirements?
Choose one answer.
AA. In each source account, create a subscription filter with a pattern for authentication failures that sends matching events to a CloudWatch Logs destination in the central account, which forwards them to Firehose.
BB. Run a daily CreateExportTask in each account to export the authentication logs to an S3 bucket in the central account, and have the SOC load them into the SIEM each morning.
CC. Give the central account read access to every source log group, and run a scheduled Logs Insights query there every minute that searches for authentication failures and sends the results to the SIEM.
DD. Enable AWS CloudTrail data events in every account and send the trail to the central account, where the SIEM filters the records for authentication failures.
D. Wrong: CloudTrail records API activity, not application log lines, so authentication-failure events from the applications would not appear there. Data events are also not the stream the SOC needs. Learn more: Logging data events (opens in a new tab)
Explanation
Cross-account subscription filters send only matching events from each source log group to a destination in the central account, which forwards them to Firehose in near real time. The source accounts keep ownership of their logs, and nothing needs to poll. Export tasks run in batches, scheduled queries poll, and CloudTrail data events do not carry the application's log lines.
Want more on Log collection, retention, encryption and subscriptions? The 5 full-length practice sets have 13 more Log collection, retention, encryption and subscriptions questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →