The AWS Cloud Connector Deployment in USM Anywhere

The Amazon Web Services (AWS) Suite of cloud computing services from Amazon that make up an on-demand computing platform. Cloud Connector provides operational visibility into the security of your AWS environment. Based on the collected log information, USM Anywhere receives the data stored in your Amazon Simple Storage Service (S3) buckets or Inventory (Amazon EC2 and RDS instances and AWS IAM users), generates the related events for that data within USM Anywhere, and provides real-time alerting to identify malicious activity Activity in a system that exceeds or misuses that access in a manner that negatively affects the confidentiality, integrity, or availability of the organization's information systems..

Important: USM Anywhere starts processing the files contained within your AWS environment after enabling the AWS Cloud Connector. Any files contained within Amazon S3 buckets before setting up a Cloud Connector will not be processed.

Differences Between an AWS Cloud Connector and a Sensor

Before choosing between an AWS Cloud Connector and a USM Anywhere Sensor Sensors are deployed into an on-premises, cloud, or multi-cloud environment to collect logs and other security-related data. This data is normalized and then securely forwarded to USM Anywhere for analysis and correlation., you need to know how they work and the existing differences between them.

This table includes a summary of the main differences between an AWS Cloud Connector and a sensor.

Differences Between an AWS Cloud Connector and a Sensor
Item AWS Cloud Connector Sensor
Deploy a sensor
Create a virtual machine (VM)
Inventory data detection (users and assets)
NIDS
BlueApps
Maintenance, updates, upgrades
Upload an AWS CloudFormation template into the AWS account
Monitor multiple AWS accounts
(one connector per account)

(one sensor per account)
Receive Amazon S3 events
Log aggregation

Warning: You will have duplicate events if your sensor is monitoring buckets from an AWS account and you configure an AWS Cloud Connector in the same account monitoring the same buckets.

Keep in mind these points when choosing between an AWS Cloud Connector and a USM Anywhere Sensor:

Activating an AWS Cloud Connector

To activate an AWS Cloud Connector:

  1. Add a new connector.

    See Adding an AWS Cloud Connector for more information.

  2. Download the AWS CloudFormation template.

    See Downloading an Existing AWS Cloud Connector Template for more information.

  3. Create a stack to upload the AWS CloudFormation template.

    See Uploading AWS CloudFormation Templates for more information.

  4. Go to USM Anywhere to enable the AWS Cloud Connector.

    See Cloud Connector List View for more information.