Documentation Center
AlienVault® USM Anywhere™

Creating a New CloudWatch Collection Job

  Role Availability   Read-Only   Analyst   Manager

If you want to create a custom USM Anywhere log collection job for Amazon CloudWatch, use this procedure to create it.

Important: Before you create a new CloudWatch log collection job, you must have CloudWatch enabled in your AWS environment. For more information, see CloudWatch Logs.

If you choose to enable CloudWatch in your AWS environment, you should make sure that you are not collecting more data than you need because this service incurs AWS costs based upon usage. Refer to the pricing information to plan and configure your usage.

To create a new CloudWatch log collection job

  1. Go to SETTINGS > SCHEDULER.
  2. In the left navigation list, click Log Collection.

    Note: You can use the Sensor filter at the top of the list to choose your AWS sensor to easily review the current AWS log jobs.

  3. Click Create Log Collection Job.

    Click Create Log Collection Job to add a scheduled log collection job

    Note: If you recently deployed a new Sensor, it can take 10 to 20 minutes for USM Anywhere to discover the various log sources. After it discovers the logs, you must manually enable the AWS log collection jobs you want before the system collects the log data.

  4. Enter the Name and Description for the job.

    The description is optional, but it is a best practice to provide this information so that others can easily understand what it does.

  5. In the Select App option, select Amazon Web Services.
  6. In the App Action option, select Monitor CloudWatch.

    Note: USM Anywhere automatically transfers CloudWatch log data to an S3 bucket. However, if you have raw data that you collect using another tool, you can either select raw for the Source Format type next, or use an S3 Log Collection job for this purpose instead.

    Select the AWS sensor, the Amazon Web Service app, and the Monitor CloudWatch action

  7. Enter the Region Name, Group Name, and Stream Name information for your AWS account. Region name can be an asterisk (*) to monitor all regions for a given group.

  8. In Source Format, select either of the following log formats.

    • syslog — All messages transmitted to USM Anywhere are processed with the assumption that they are syslog formatted.

      Select this option if you have configured the CloudWatch log agent to directly forward syslog messages to a CloudWatch log group. When you choose syslog as the Source Format, the plugin selection is bypassed and USM Anywhere uses the auto-detect hints from the plugins to match the incoming messages to the correct plugin.

    • raw — Use for non-syslog formatted data.

      If you select this option, you must choose the Plugin Name to designate the plugin that USM Anywhere uses to parse all of the streams in the group.

      Important: If a group contains streams of mixed log formats, USM Anywhere parses all of them with that single plugin, which will produce undesired results. In this case, you will need configure CloudWatch to separate the streams into groups so that each contains only a single log type that can be mapped to the correct plugin.

    Specify the region name, group name, and source format for collecting the CloudWatch logs

    Note: CloudWatch streams should be separated from each other by plugin type.

  9. Set the Schedule to specify when USM Anywhere runs the job.

    First, choose the increment as Hour, Day, Week, Month, or Year. Next, set the interval options for the increment. The selected increment determines the available options.

    For example, on a weekly increment you can select the days of the week to run the job.

    Set the schedule for the job to run each week

    Or, on a monthly increment you can specify a date or a day of the week that occurs within the month.

    Set the schedule for the job to run each month

    To finish, set the Start time. This is the time that the job starts at the specified interval. It uses the time zone configured for your USM Anywhere instance (default is UTC).

  10. Click Save.