mirror of
https://github.com/netbirdio/docs.git
synced 2026-04-19 17:06:36 +00:00
Fix missing activity events docs
This commit is contained in:
braginini
162
src/pages/how-to/activity-event-streaming.mdx
Normal file
162
src/pages/how-to/activity-event-streaming.mdx
Normal file
@@ -0,0 +1,162 @@
|
||||
# Stream activity events to third-party SIEM systems
|
||||
|
||||
Security Information and Event Management (SIEM) systems play a critical role in network security by monitoring,
|
||||
detecting, and responding to security threats in real-time. By aggregating and analyzing activity across the network,
|
||||
SIEMs help identify anomalous patterns and potential breaches, providing a centralized view of security events.
|
||||
|
||||
NetBird provides an event streaming feature that allows you to stream network [activity events](/how-to/monitor-system-and-network-activity)
|
||||
to third-party SIEM systems, such as [Datadog](https://www.datadoghq.com/dg/security/siem-solution/), [Amazon S3](https://aws.amazon.com/s3/), [Amazon Data Firehose](https://aws.amazon.com/firehose/), and others.
|
||||
|
||||
This document provides step-by-step instructions and best practices for setting up NetBird activity event streaming
|
||||
integrations to different third-party platforms.
|
||||
|
||||
<Note>
|
||||
This feature is only available in the cloud version of NetBird.
|
||||
</Note>
|
||||
|
||||
## Datadog
|
||||
|
||||
Before you start creating and configuring a Datadog event streaming integration, ensure that you have the following:
|
||||
- A Datadog account with the permissions to create and manage API keys. If you don't have the required permissions, ask your Datadog administrator to grant them to you.
|
||||
|
||||
### Step 1: Create a Datdog API key
|
||||
- Navigate to the [API Keys](https://app.datadoghq.eu/organization-settings/api-keys) page
|
||||
- Click `+ New Key` at the top
|
||||
- Give it a descriptive name like `NetBird Event Streaming`
|
||||
- Click `Create Key`
|
||||
- Copy the key. You will need this key when configuring an integration in NetBird.
|
||||
### Step 2: Create an event streaming integration in NetBird
|
||||
- Navigate to the [Integrations » Event Streaming](https://preview.netbird.io/integrations) tab in the NetBird dashboard
|
||||
<p>
|
||||
<img src="/docs-static/img/how-to-guides/event-streaming-integration.png" alt="event-streaming-integration" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Enable and configure the Datadog integration
|
||||
- First select the region of your Datadog account (for more details see [Datadog Documentation](https://docs.datadoghq.com/getting_started/site/))
|
||||
<p>
|
||||
<img src="/docs-static/img/how-to-guides/datadog-region-select.png" alt="datadog-region-select" className="imagewrapper" width="400" style={{ display: 'block', marginLeft: 'auto', marginRight: 'auto' }} />
|
||||
</p>
|
||||
- Then enter the API key you created in [Step 1](#step-1-create-a-datdog-api-key) and click `Connect`
|
||||
<p>
|
||||
<img src="/docs-static/img/how-to-guides/datadog-api-key.png" alt="datadog-api-key" className="imagewrapper" width="400" style={{ display: 'block', marginLeft: 'auto', marginRight: 'auto' }} />
|
||||
</p>
|
||||
|
||||
## Amazon S3
|
||||
Before you start creating and configuring an Amazon S3 event streaming integration, ensure that you have the following:
|
||||
- An AWS account with the permissions to create and manage S3 buckets.
|
||||
- Permissions to create and manage IAM users, roles and policies.
|
||||
|
||||
If you don't have the required permissions, ask your AWS administrator to grant them to you.
|
||||
|
||||
### Step 1: Create an S3 bucket
|
||||
- Navigate to the [S3 dashboard](https://console.aws.amazon.com/s3/home)
|
||||
- Select the correct region in the top menu
|
||||
- Click `Create bucket`
|
||||
- Give it a descriptive name like `netbird-activity-events`
|
||||
- (Optional) Change bucket configurations to your needs
|
||||
- Click `Create bucket`
|
||||
|
||||
### Step 2: Create an IAM user
|
||||
- Navigate to the [IAM Dashboard](https://console.aws.amazon.com/iam/home)
|
||||
- Create an IAM User (for details see the [Amazon Docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html))
|
||||
- Create a custom policy with the following permissions:
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"s3:PutObject",
|
||||
"s3:PutObjectAcl"
|
||||
],
|
||||
"Resource": "arn:aws:s3:::netbird-activity-events/*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
- Attach the policy to the IAM user
|
||||
- Select the user and navigate to the `Security credentials` tab
|
||||
- Click `Create access key`
|
||||
- Select `Third-party service` and click `Next`
|
||||
- Give it a description
|
||||
- Store `Access key` and `Secret access key` in a secure place. You will need these when configuring an integration in NetBird.
|
||||
|
||||
### Step 3: Create an event streaming integration in NetBird
|
||||
- Navigate to the [Integrations » Event Streaming](https://preview.netbird.io/integrations) tab in the NetBird dashboard
|
||||
<p>
|
||||
<img src="/docs-static/img/how-to-guides/event-streaming-integration.png" alt="event-streaming-integration" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Enable and configure the `Amazon S3` integration
|
||||
- First select the region your S3 bucket is created in
|
||||
<p>
|
||||
<img src="/docs-static/img/how-to-guides/s3-region-select.png" alt="s3-region-select" className="imagewrapper" width="400" style={{ display: 'block', marginLeft: 'auto', marginRight: 'auto' }} />
|
||||
</p>
|
||||
- Then enter the S3 bucket name you created in [Step 1](#step-1-create-an-s3-bucket) and click `Next`
|
||||
<p>
|
||||
<img src="/docs-static/img/how-to-guides/s3-bucket-name.png" alt="s3-bucket-name" className="imagewrapper" width="400" style={{ display: 'block', marginLeft: 'auto', marginRight: 'auto' }} />
|
||||
</p>
|
||||
- Enter the `Access key` and `Secret access key` you created in [Step 2](#step-2-create-an-iam-user) and click `Connect`
|
||||
<p>
|
||||
<img src="/docs-static/img/how-to-guides/s3-iam-credentials.png" alt="s3-iam-credentials" className="imagewrapper" width="400" style={{ display: 'block', marginLeft: 'auto', marginRight: 'auto' }} />
|
||||
</p>
|
||||
|
||||
## Amazon Data Firehose
|
||||
Before you start creating and configuring an Amazon Data Firehose event streaming integration, ensure that you have the following:
|
||||
- An AWS account with the permissions to create and manage data firehose delivery streams.
|
||||
- Permissions to create and manage IAM users, roles and policies.
|
||||
|
||||
If you don't have the required permissions, ask your AWS administrator to grant them to you.
|
||||
|
||||
### Step 1: Create a Data Firehose stream
|
||||
- Navigate to the [Data Firehose Dashboard](https://console.aws.amazon.com/firehose/home)
|
||||
- Click `Create Firehose stream`
|
||||
- As source select `Direct PUT` and the desired destination
|
||||
- Give it a descriptive name like `netbird-activity-events` and configure the stream to your needs
|
||||
|
||||
### Step 2: Create an IAM user
|
||||
- Navigate to the [IAM Dashboard](https://console.aws.amazon.com/iam/home)
|
||||
- Create an IAM User (for details see the [Amazon Docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html))
|
||||
- Create a custom policy with the following permissions (replace the resource with the ARN of your delivery stream):
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"firehose:PutRecord",
|
||||
"firehose:PutRecordBatch"
|
||||
],
|
||||
"Resource": "arn:aws:firehose:region:accountID:deliverystream/netbird-event-streaming"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
- Attach the policy to the IAM user
|
||||
- Select the user and navigate to the `Security credentials` tab
|
||||
- Click `Create access key`
|
||||
- Select `Third-party service` and click `Next`
|
||||
- Give it a description
|
||||
- Store `Access key` and `Secret access key` in a secure place. You will need these when configuring an integration in NetBird.
|
||||
|
||||
### Step 3: Create an event streaming integration in NetBird
|
||||
- Navigate to the [Integrations » Event Streaming](https://preview.netbird.io/integrations) tab in the NetBird dashboard
|
||||
<p>
|
||||
<img src="/docs-static/img/how-to-guides/event-streaming-integration.png" alt="event-streaming-integration" className="imagewrapper-big"/>
|
||||
</p>
|
||||
|
||||
- Enable and configure the `Amazon Data Firehose` integration
|
||||
- First select the region your Firehose stream is created in
|
||||
<p>
|
||||
<img src="/docs-static/img/how-to-guides/firehose-region-select.png" alt="firehose-region-select" className="imagewrapper" width="400" style={{ display: 'block', marginLeft: 'auto', marginRight: 'auto' }} />
|
||||
</p>
|
||||
- Then enter the Firehose stream name you created in [Step 1](#step-1-create-a-data-firehose-stream) and click `Next`
|
||||
<p>
|
||||
<img src="/docs-static/img/how-to-guides/firehose-stream-name.png" alt="firehose-stream-name" className="imagewrapper" width="400" style={{ display: 'block', marginLeft: 'auto', marginRight: 'auto' }} />
|
||||
</p>
|
||||
- Enter the `Access key` and `Secret access key` you created in [Step 2](#step-2-create-an-iam-user-2) and click `Connect`
|
||||
<p>
|
||||
<img src="/docs-static/img/how-to-guides/firehose-iam-credentials.png" alt="firehose-iam-credentials" className="imagewrapper" width="400" style={{ display: 'block', marginLeft: 'auto', marginRight: 'auto' }} />
|
||||
</p>
|
||||
Reference in New Issue
Block a user