Adds documentation for log type categories #5181

hdhalter · 2023-10-10T19:20:15Z

Description

Categories have been added to log types for easier filtering and sorting.

Issues Resolved

Fixes #5147

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the Developers Certificate of Origin.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Heather Halter <hdhalter@amazon.com>

hdhalter · 2023-10-10T19:39:00Z

To help with the tech/doc review, here are some of the changes:

On Supported log types topic:

In the first paragraph I added the info about the new category feature
The second paragraph was taken from the 'Create custom log detector' page. I just added the bit about the Category column
New column for 'Category' in the table
New Security > Waf log type description
Page actions was taken from 'Create detector' topic, so the only new text is the last bullet about the category.

In the 'Create custom..' topic:

Much of the content was moved, as noted above, to the other page where it was more relevant.
Simplified the steps and added the part about selecting a category.
I also added links back to the log types page.

Signed-off-by: Heather Halter <hdhalter@amazon.com>

_security-analytics/sec-analytics-config/log-types.md

Signed-off-by: Heather Halter <hdhalter@amazon.com>

hdhalter · 2023-10-11T03:49:29Z

I've added a new column called "Log names" with the full names. Can someone please provide more detailed descriptions of the log types? Thanks.

minor changes needed in the names would be Microsoft Azure for Azure, Linux System logs instead of Sys logs Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

Signed-off-by: Heather Halter <hdhalter@amazon.com>

hdhalter · 2023-10-12T16:37:06Z

@jimishs - I removed the Log Name column. Can you please approve? Thanks.

kolchfa-aws

LGTM with comments

_security-analytics/sec-analytics-config/custom-log-type.md

_security-analytics/sec-analytics-config/log-types.md

Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

natebower

@hdhalter Please see my comments and changes and let me know if you have any questions. Thanks!

_security-analytics/sec-analytics-config/custom-log-type.md

_security-analytics/sec-analytics-config/log-types.md

natebower · 2023-10-12T20:49:18Z

_security-analytics/sec-analytics-config/log-types.md

+| Network Activity| `Dns` | DNS logs that store Domain Name System (DNS) activity. |
+| Network Activity | `Network` | Network logs that record events that happen in a system's network, such as login attempts and application events. | 
+| Network Activity | `vpcflow` | [VPC Flow Logs](https://docs.aws.amazon.com/prescriptive-guidance/latest/logging-monitoring-for-application-owners/vpc-flow-logs.html) that capture information about the IP traffic going to and from network interfaces in your VPC. |
+| Security | `Waf` | Web Application Firewall (WAF) logs (introduced in OpenSearch 2.11) for users that require monitoring of the WAF use case that's provided out-of-the box in the Security plugin. The role of WAF is to monitor and filter HTTP traffic between a web application and the internet. WAF prevents common security attacks, such as cross-site scripting (XSS), SQL Injection (SQi), and so on. |


Are we referring to AWS WAF here? If so, the service name must always be "AWS WAF", never shortened to "WAF", and we don't define WAF as "Web Application Firewall". Instead, we say "AWS WAF is a web application firewall."

_security-analytics/sec-analytics-config/log-types.md

Editorial updates. Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

Fixed case in table. Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

Double-checked the UI and category names are capitalized. Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

hdhalter · 2023-10-13T22:24:13Z

@natebower - I've accepted your revisions. Thanks! I am just waiting on confirmation from development about AWS WAF.

* new log categories Signed-off-by: Heather Halter <hdhalter@amazon.com> * fixed topic name in link Signed-off-by: Heather Halter <hdhalter@amazon.com> * added log names to table Signed-off-by: Heather Halter <hdhalter@amazon.com> * Update log-types.md minor changes needed in the names would be Microsoft Azure for Azure, Linux System logs instead of Sys logs Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM> * Update log-types.md Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM> * remove log name column Signed-off-by: Heather Halter <hdhalter@amazon.com> * remove table column formatting Signed-off-by: Heather Halter <hdhalter@amazon.com> * Update _security-analytics/sec-analytics-config/custom-log-type.md Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM> * Update _security-analytics/sec-analytics-config/log-types.md Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM> * Update _security-analytics/sec-analytics-config/log-types.md Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM> * Update _security-analytics/sec-analytics-config/log-types.md Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM> * Update _security-analytics/sec-analytics-config/log-types.md Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM> * Update _security-analytics/sec-analytics-config/log-types.md Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM> * Update _security-analytics/sec-analytics-config/log-types.md Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM> * Update _security-analytics/sec-analytics-config/log-types.md Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM> * Apply suggestions from code review Editorial updates. Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM> * Update log-types.md Fixed case in table. Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM> * Update log-types.md Double-checked the UI and category names are capitalized. Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM> * Update _security-analytics/sec-analytics-config/log-types.md Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM> --------- Signed-off-by: Heather Halter <hdhalter@amazon.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM> Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Co-authored-by: Nathan Bower <nbower@amazon.com>

new log categories

7b13c15

Signed-off-by: Heather Halter <hdhalter@amazon.com>

hdhalter requested review from kolchfa-aws, Naarcha-AWS, vagimeli, ananzh, seanneumann, AMoo-Miki and natebower as code owners October 10, 2023 19:20

hdhalter self-assigned this Oct 10, 2023

hdhalter added 3 - Tech review PR: Tech review in progress release-notes PR: Include this PR in the automated release notes v2.11.0 labels Oct 10, 2023

fixed topic name in link

0e395a3

Signed-off-by: Heather Halter <hdhalter@amazon.com>

praveensameneni approved these changes Oct 10, 2023

View reviewed changes

jimishs reviewed Oct 10, 2023

View reviewed changes

_security-analytics/sec-analytics-config/log-types.md Outdated Show resolved Hide resolved

jimishs reviewed Oct 10, 2023

View reviewed changes

_security-analytics/sec-analytics-config/log-types.md Outdated Show resolved Hide resolved

jimishs reviewed Oct 10, 2023

View reviewed changes

_security-analytics/sec-analytics-config/log-types.md Outdated Show resolved Hide resolved

jimishs suggested changes Oct 10, 2023

View reviewed changes

added log names to table

9535e11

Signed-off-by: Heather Halter <hdhalter@amazon.com>

hdhalter added 2 commits October 11, 2023 12:38

Update log-types.md

6216229

minor changes needed in the names would be Microsoft Azure for Azure, Linux System logs instead of Sys logs Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

Update log-types.md

816eea2

Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

sbcd90 approved these changes Oct 11, 2023

View reviewed changes

hdhalter added 4 - Doc review PR: Doc review in progress and removed 3 - Tech review PR: Tech review in progress labels Oct 11, 2023

hdhalter added 2 commits October 12, 2023 07:58

remove log name column

74ec648

Signed-off-by: Heather Halter <hdhalter@amazon.com>

remove table column formatting

03912cb

Signed-off-by: Heather Halter <hdhalter@amazon.com>

kolchfa-aws approved these changes Oct 12, 2023

View reviewed changes

hdhalter and others added 8 commits October 12, 2023 13:14

Update _security-analytics/sec-analytics-config/custom-log-type.md

a13f1d8

Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

Update _security-analytics/sec-analytics-config/log-types.md

dda705c

Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

Update _security-analytics/sec-analytics-config/log-types.md

d435f72

Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

Update _security-analytics/sec-analytics-config/log-types.md

81c0311

Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

Update _security-analytics/sec-analytics-config/log-types.md

933aedc

Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

Update _security-analytics/sec-analytics-config/log-types.md

36c005c

Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

Update _security-analytics/sec-analytics-config/log-types.md

e21561a

Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

Update _security-analytics/sec-analytics-config/log-types.md

c29c81f

Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

hdhalter added 5 - Editorial review PR: Editorial review in progress and removed 4 - Doc review PR: Doc review in progress labels Oct 12, 2023

natebower reviewed Oct 12, 2023

View reviewed changes

hdhalter and others added 4 commits October 13, 2023 14:45

Apply suggestions from code review

9335475

Editorial updates. Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

Update log-types.md

c63f1e6

Fixed case in table. Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

Update log-types.md

3d311dc

Double-checked the UI and category names are capitalized. Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

Update _security-analytics/sec-analytics-config/log-types.md

03b75ca

Co-authored-by: Nathan Bower <nbower@amazon.com> Signed-off-by: Heather Halter <HDHALTER@AMAZON.COM>

hdhalter removed the 5 - Editorial review PR: Editorial review in progress label Oct 16, 2023

hdhalter merged commit b8c53f6 into main Oct 16, 2023
4 checks passed

hdhalter deleted the log-types-211 branch March 28, 2024 21:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adds documentation for log type categories #5181

Adds documentation for log type categories #5181

hdhalter commented Oct 10, 2023

hdhalter commented Oct 10, 2023

hdhalter commented Oct 11, 2023

hdhalter commented Oct 12, 2023

kolchfa-aws left a comment

natebower left a comment

natebower Oct 12, 2023

hdhalter commented Oct 13, 2023

Adds documentation for log type categories #5181

Adds documentation for log type categories #5181

Conversation

hdhalter commented Oct 10, 2023

Description

Issues Resolved

Checklist

hdhalter commented Oct 10, 2023

hdhalter commented Oct 11, 2023

hdhalter commented Oct 12, 2023

kolchfa-aws left a comment

Choose a reason for hiding this comment

natebower left a comment

Choose a reason for hiding this comment

natebower Oct 12, 2023

Choose a reason for hiding this comment

hdhalter commented Oct 13, 2023