AWS Log Sources

Overview

AWS log sources feed security events from your AWS infrastructure into Fencer’s SIEM module. Each log source type captures a different category of activity — from API calls and network flows to load balancer requests and DNS queries. You connect a log source by setting up an AWS monitor connection, which replicates logs from your S3 bucket into Fencer’s data lake for analysis by detection rules.

Batch data sources are deprecated

Fencer is deprecating batch data sources, which replicate logs from your S3 bucket, and moving to streaming ingestion. Contact us to turn on streaming for your organization, then follow the AWS Streaming Monitor setup.

Prerequisites

• An AWS account with the logs you want to ingest stored in an S3 bucket.
• Permission to create IAM roles and S3 replication rules in your AWS account.
• Admin role in Fencer.
• An active subscription with the SIEM feature enabled.

How it works

AWS log sources use S3 cross-account replication to move log data from your AWS environment into Fencer. When you connect a log source, Fencer walks you through a multi-step wizard that configures an IAM role for cross-account access and sets up S3 bucket replication. Once replication is active, new log files flow automatically into Fencer’s data lake, where they are normalized and made available to detection rules and Threat Hunting.

Each log source produces events in a different format. Fencer normalizes all of them into the OCSF (Open Cybersecurity Schema Framework) standard so you can write detection rules and hunt queries that work consistently across log types.

Supported log types

CloudTrail

AWS CloudTrail records API calls and management events across your AWS account. This is the primary log source for detecting unauthorized access, privilege escalation, configuration changes, and suspicious IAM activity. Most AWS detection rules in Fencer target CloudTrail data.

What it captures: API calls (who called what, when, from where), console sign-in events, resource creation and deletion, IAM policy changes, and service configuration modifications.

VPC Flow Logs

VPC Flow Logs capture network traffic metadata for your Virtual Private Cloud. Use these to detect unusual traffic patterns, data exfiltration attempts, communication with known malicious IPs, and network scanning activity.

What it captures: Source and destination IP addresses, ports, protocol, packet and byte counts, and accept/reject status for each network flow.

Fencer also streams VPC Flow Logs in near-real time. See the AWS Streaming Monitor.

ALB Access Logs

Application Load Balancer access logs record details about every request processed by your ALBs. Use these to detect web application attacks, unusual request patterns, and access anomalies.

What it captures: Client IP, request URL, response status code, response time, user agent, SSL cipher, and target group information for each HTTP/HTTPS request.

Fencer also streams ALB access logs in near-real time. See Stream ALB access logs and connection logs.

ALB Connection Logs

ALB connection logs capture connection-level details for your Application Load Balancers. These complement access logs by providing lower-level connection metadata useful for detecting TLS anomalies and connection-based attacks.

What it captures: Client IP, connection time, TLS handshake details, connection status, and closure reason.

Fencer also streams ALB connection logs in near-real time. See Stream ALB access logs and connection logs.

NLB Access Logs

Network Load Balancer access logs record TLS connection details. Use these for detecting network-layer attacks, port scanning, and unusual connection patterns at the transport layer.

What it captures: Client IP, destination IP, ports, connection time, TLS negotiation details, and bytes transferred for each TLS connection. A TCP or UDP listener produces no entries.

Fencer also streams NLB access logs in near-real time. See Stream NLB access logs.

S3 Bucket Access Logs

S3 server access logs record requests made to your S3 buckets. Use these to detect unauthorized data access, unusual download patterns, and potential data exfiltration from your storage resources.

What it captures: Requester identity, bucket name, object key, operation type (GET, PUT, DELETE), response status, and bytes transferred.

Fencer also streams S3 server access logs in near-real time. AWS delivers them on a best-effort basis, with a delay of up to a few hours, and the streaming setup is separate from the batch one. See Stream S3 server access logs.

RDS PostgreSQL Standard Logs

RDS PostgreSQL standard logs capture database activity for your RDS PostgreSQL instances. Use these to detect suspicious database queries, unauthorized access attempts, and configuration changes.

What it captures: Database connections, query execution, authentication events, and error conditions for PostgreSQL instances.

Fencer also streams RDS PostgreSQL logs in near-real time, through a CloudWatch Logs subscription filter on the log group of the DB instance. See Stream RDS PostgreSQL logs.

Route 53 DNS Query Logs

Route 53 DNS query logs record DNS queries received by your Route 53 hosted zones. Use these to detect DNS tunneling, queries to known malicious domains, and unusual DNS resolution patterns.

What it captures: Query name, query type, response code, source IP, and the Route 53 edge location that handled the request.

Connecting a log source

1. Go to Admin > Integrations and find the AWS - Amazon Web Services (Monitor) integration.
2. Click Connect to start the setup wizard.
3. Setup Event Source: Provide the Source Bucket ARN (the S3 bucket where your AWS logs are stored) and select the Log Source Type from the list above.
4. Indicate whether your S3 bucket uses custom KMS encryption. If it does, Fencer provides the additional KMS policy you need to apply.
5. Create the IAM role: Fencer displays the principal ARN and external ID for the trust policy. Create a new IAM role in your AWS account with the provided trust policy and permissions.
6. Enter the Role ARN of the IAM role you created and click Validate Role.
7. Configure bucket replication: Fencer displays the destination bucket ARN and the required replication configuration. Set up an S3 replication rule from your source bucket to Fencer’s destination bucket.
8. Click Complete Setup. Fencer creates the backend resources needed for log ingestion.

Tip

You can connect multiple log source types from the same AWS account. Each log source type requires its own monitor connection with its own source bucket.

Examples

Connecting CloudTrail for threat detection:

1. Enable CloudTrail in your AWS account if you haven’t already, and configure it to deliver logs to an S3 bucket.
2. In Fencer, create an AWS Monitor connection and select AWS CloudTrail as the log source type.
3. Follow the wizard to create the IAM role and S3 replication rule.
4. Once connected, Fencer’s built-in detection rules automatically analyze your CloudTrail events for threats like disabled logging, unauthorized API calls, and IAM privilege escalation.

Troubleshooting

• Logs not appearing after setup — Verify that the S3 replication rule is active and replicating objects. Check the replication metrics in your AWS console. New logs typically appear in Fencer within 10-15 minutes of replication.
• IAM role validation fails — Confirm the trust policy includes the exact principal ARN and external ID shown in the Fencer wizard. Ensure the role has the required S3 permissions.
• KMS-encrypted bucket errors — If your source bucket uses a custom KMS key, apply the KMS policy provided during setup to allow Fencer’s role to decrypt objects.
• “Source bucket not found” — Verify the bucket ARN is correct and that the bucket exists in the same AWS region you selected.

Related pages

• Security Monitoring (SIEM)
• Detection Rules
• Detections
• AWS Streaming Monitor
• AWS Integration