USM Anywhere™

The AWS Cloud Connector Deployment in USM Anywhere

The Amazon Web Services (AWS) Amazon Web Services (AWS) is a suite of cloud computing services from Amazon that make up an on-demand platform giving users access to their computing resources. Cloud Connector provides operational visibility into the security of your AWS environment. Based on the collected log information, USM Anywhere receives the data stored in your Amazon Simple Storage Service (S3) buckets, generates the related events for that data within USM Anywhere, and provides real-time alerting to identify malicious activity Activity in a system that exceeds or misuses that access in a manner that negatively affects the confidentiality, integrity, or availability of the organization's information systems..

Important: USM Anywhere starts processing the files contained within Amazon S3 buckets after enabling the AWS Cloud Connector. Any files contained within Amazon S3 buckets before setting up a Cloud Connector will not be processed.

Differences Between an AWS Cloud Connector and a Sensor

Before choosing between an AWS Cloud Connector and a USM Anywhere sensor Sensors are deployed into an on-premises, cloud, or multi-cloud environment to collect logs and other security-related data. This data is normalized and then securely forwarded to USM Anywhere for analysis and correlation., you need to know how they work and the existing differences between them.

This table includes a summary of the main differences between an AWS Cloud Connector and a sensor.

Differences Between an AWS Cloud Connector and a Sensor
Item AWS Cloud Connector Sensor
Deploy a sensor
Create a virtual machine (VM)
Inventory data detection (users and assets)
NIDS
AlienApps
Maintenance, updates, upgrades
Upload an AWS CloudFormation template into the AWS account
Monitor multiple AWS accounts (one connector per account) (one sensor per account)
Receive Amazon S3 events
Log aggregation

Warning: You will have duplicate events if your sensor is monitoring buckets from an AWS account and you configure an AWS Cloud Connector in the same account monitoring the same buckets.

Keep in mind these points when you are going to choose between an AWS Cloud Connector and a USM Anywhere sensor:

Activating an AWS Cloud Connector

To activate an AWS Cloud Connector, you must follow these steps:

  1. Add a new connector.

    See Adding an AWS Cloud Connector for more information.

  2. Download the AWS CloudFormation template.

    See Downloading an Existing AWS Cloud Connector Template for more information.

  3. Create a stack to upload the AWS CloudFormation template.

    See Uploading AWS CloudFormation Templates for more information.

  4. Go to USM Anywhere to enable the AWS Cloud Connector.

    See Cloud Connector List View for more information.