Deploy an ExtraHop Flow Sensor with AWS

Collecting flow logs requires the following configuration setup.

1. Configure an IAM policy and IAM role.
2. Deploy the ExtraHop flow sensor instance in AWS.
3. Download and configure an ExtraHop-supplied Lambda function. The Lambda function runs whenever new flow logs become available and then relays any new events to your sensor. See the following AWS documentation for more information: Using AWS Lambda with Amazon Kinesis Firehose.
4. Enable VPC Flow Logs publishing for a set of VPCs in your environment.
5. Add a Lambda trigger.
6. (Optional): Configure Route 53.

1. Create an IAM policy through the JSON tab with the following parameters:

   {
       "Statement": [
           {
               "Action": [
                   "ec2:Describe*"
               ],
               "Effect": "Allow",
               "Resource": "*"
           }
       ],
       "Version": "2012-10-17"
   }
   

   Copy
2. Create an IAM role and attach the permission policy.
   The ExtraHop system requires an instance IAM role to correlate IP addresses from flow logs to instances, gateways, and Lambdas.

1. Deploy a Reveal(x) EDA 1100V by following the Deploy an ExtraHop sensor in AWS guide.
   The EDA 1100V is a packet sensor that becomes a flow logs sensor when the license is entered. The sensor will no longer process packets.

   Tip:	You can subscribe to the Reveal(x) 1100v (BYOL) software through the AWS Marketplace.

2. Log in to the ExtraHop system through https://<extrahop-hostname-or-IP-address>. The username is setup and the password is the string of numbers after the i- in the instance ID.
3. Follow the prompts to accept the license agreement, enter the product key, change the default setup and shell user account passwords, connect to ExtraHop Cloud Services, and connect to Reveal(x) 360.
4. Click the System Settings icon , and then click All Administration.
5. In the Access Settings section, click API Access.
6. In the Generate an API Key section, type a description for the new key and then click Generate.
7. Generate the Flow Log secret from the REST API Explorer.
   1. Click Open ExtraHop API Explorer.
   2. Click Enter API Key and then paste or type your API key into the API Key field.
   3. Click Authorize and then click Close.
   4. Click ExtraHop and then click POST ​/extrahop​/flowlogs​/secret.
   5. Click Try it out and then click Send Request.
   6. In the Response Body section, view and record the secret value. You will need the secret for the EXTRAHOP_SECRET_KEY environment variable in the next procedure.

An ExtraHop-supplied lambda function routes new flow log events to the ExtraHop flow sensor whenever called by a lambda trigger.

1. Download the exflowlogs-lambda.zip file from the ExtraHop downloads page.
2. In AWS, create a Lambda function.
   • The function must have the Go1.x runtime.
   • The function must have an execution role with the following permissions:

     CloudWatch Logs:

     • CreateLogGroup
     • CreateLogStream
     • PutLogEvents

     EC2:

     • CreateNetworkInterface
     • DeleteNetworkInterface
     • DescribeNetworkInterfaces

   • You must enable connectivity between your Lambda function and the VPC and subnet that your collector is on. The function must also be part of a security group that allows traffic between the function and the collector.
   • Upload the exflowlogs-lambda.zip file.
   • Under General configuration settings, set the Memory field to 128 MB.
   • Under General configuration settings, set the Timeout field to 10 seconds.
   • Under Code, Runtime settings, set the handler value to exflowlogs-lambda.
   • In the Environment variables settings, set the following environment variables:

     EDA_HOST: The IP address or hostname of the VPC flow logs sensor.

     EXTRAHOP_SECRET_KEY: The secret you generated through the ExtraHop REST API in the previous procedure.

     VERIFY_EDA_HOST_CERT: If the sensor has the default self-signed certificate, specify 0 to disable certificate verification in the Lambda HTTP client. Otherwise, specify 1.

   Note:

   It can take up to 10 minutes before devices are discovered and metrics are published from flow logs.

1. Navigate to the Amazon Kinesis dashboard.
2. In the left pane, click Delivery streams.
3. Click Create delivery stream.
4. Choose the following source and destinations:

   Source: Direct PUT

   Destination: HTTP Endpoint

5. Type a unique name in the delivery stream name field.
6. Specify the following destination settings:

   HTTP endpoint name: HTTP endpoint

   HTTP endpoint URL: The URL of the Lambda function

   Access key : The flow logs secret you generated when you deployed the sensor.

   Content encoding: GZIP

7. Click Create delivery stream.

1. Select your VPC.
2. Click the Flow logs tab and then click Create flow log
3. Configure the following settings:

   Filter: Accept

   Maximum aggregation interval: 1 Minute

   Destination: Send to Kinesis Firehose in the same account or in a different account

   Kinesis Firehose delivery stream name: Select the stream name you created previously

   Log record format: Select Custom format and then select the log format attributes in the following order:

   • end
   • log-status
   • vpc-id
   • interface-id
   • srcaddr
   • dstaddr
   • srcport
   • dstport
   • protocol
   • tcp-flags
   • packets
   • bytes
   • pkt-srcaddr
   • pkt-dstaddr

   The format preview should appear similar to the following figure.