Merge pull request #5738 from ministryofjustice/cortex-runbook

📝 adding runbook for pushing logs to SOC Cortex XSIAM

runbooks/source/logs-to-soc-cortex-xsiam.html.md.erb

@@ -0,0 +1,40 @@
+---
+title: Logs going to SOC Palo Alto Cortex Xsiam
+weight: 9100
+last_reviewed_on: 2024-06-18
+review_in: 6 months
+---
+
+# Pushing logs to the SOC team
+Cloud Platform logs from various sources are being pushed to the SOC team's security monitoring solution `Palo Alto Cortex XSIAM`.
+
+We are currently pushing the following logs:
+
+1. Cloudtrail logs
+
+We are planning to push the following logs in the coming sprints. [Epic found here].
+
+2. `live-1` VPC FlowLogs
+3. Route 53 logs
+4. EKS logs
+
+## 1. Cloudtrail logs
+### Architecture
+We have followed Palo Alto's documentation on implementation to allow [Cortex XSIAM to injest logs from Cloudtrail].
+
+Cloudtrail logs are written to a S3 bucket. The implementation consist of enabling the S3 bucket to trigger event notifications to an SQS queue. An IAM user with access keys has been created to grant Cortex XSIAM to accesse the SQS queue and recieves all the log messages. The terraform code for this implementation is found in the [cloud-platform-terraform-infrastructure] repository.
+
+### IAM User access keys rotation
+We need put in a mechanism to periodically rotate the IAM User access keys created for Cortex XSIAM to recieve the logs. [Suggestion and issue] for this has been raised.
+
+## 2. VPC FlowLogs
+To be implemented
+## 3. Route53 logs
+To be implemented
+## 4. EKS logs
+To be implemented
+
+[Cortex XSIAM to injest logs from Cloudtrail]: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/Ingest-Audit-Logs-from-AWS-Cloud-Trail
+[Epic found here]: https://github.com/ministryofjustice/cloud-platform/milestone/35
+[cloud-platform-terraform-infrastructure]: https://github.com/ministryofjustice/cloud-platform-infrastructure/blob/main/terraform/aws-accounts/cloud-platform-aws/account/sqs.tf
+[Suggestion and issue]: https://github.com/ministryofjustice/cloud-platform/issues/5724