AWS VPC Flow

Anomali supports the ingestion of Amazon Web Services (AWS) VPC Flow logs stored in your AWS S3, using Amazon Simple Queue Service (SQS) for notifications.

Once S3 event notifications are configured to send updates to the SQS queue you designate, Anomali automatically pulls the logs from S3 whenever it receives a new notification from the queue.

Onboarding Steps

Step 1: Set up SQS queue

To send VPC logs to Anomali, you will first need to set up an Amazon SQS queue.

Step 2: Enable AWS S3 notifications

Enable AWS S3 notifications for Amazon SQS to receive change notifications when you add logs. See Amazon's guide to configuring AWS S3 notification for SQS for more information.

Step 3: Add VPC as new log source

On the Anomali platform, add VPC as a new log source, as follows:

  1. Navigate to Search > Log Source Management.

  2. Click New to add a new log source.

  3. Enter a name for the log source.

  4. (Optional) Enter a description for the log source.

  5. Select it as the log source.

  6. Select AWS S3 as the ingest method.

  7. Ensure S3 notification are enabled. See Step 2: Enable AWS S3 notifications for more information.

  8. Provide the Basic Configuration details:

    1. AWS SQS Queue URL: Enter the URL of your AWS SQS queue. See Setting up Amazon SQS queue for more information.

    2. AWS Secret Access Key: Provide the AWS secret access key.

    3. AWS Access Key ID: Enter the AWS Access ID.

    4. File Selector: Provide the path to the event log data files. Anomali recommends the following practices for the path:

          • Sourcetype must be the path prefix, as follows:
            <sourcetype>/year=2025/month=04/day=05/path/to/file.
            For example: aws_vpcflow/year=2025/month=03/day=22/events/event_data_logs/.
          • Sourcetype name must not contain any spaces: For example, "aws_vpcflow" is correct, however "aws vpc flow" is incorrect.

  1. (Optional) Next to the Basic Configuration section, click on the Advanced Options link to provide additional information about the event log data:

    1. Enter one or more parameters that provide additional context about the data. For example, "File format" indicates the format of the event log data being shipped, or "File extension" that indicates the extension of the logs.
    2. Enter the corresponding value of the parameter. For example, CSV is a file format. Similarly, ".gzip" is a file extension.

  2. Click Save to add the log source.

Step 4: Configure permissions

You can set permissions to decide which roles can view, add, or edit log sources. To do so, configure the following parameters:

  1. Owner: Select an owner of the view from the list of users. This is the email address of the owner.

  2. Type: Select the type of permission assigned to the view:

    1. Private: Only the owner has read and write privileges, that is, no other user can access or edit the view.

    2. Shared: Allows you to set the read-write privileges for a role that is mapped to different users, granting read-write permissions to all users assigned that role. You can also assign read or write permissions to everyone in your organization.

Step 5: Check log source status

Once added, the status of the log source becomes Create Requested. See Log Source Statuses to understand the different types statuses assigned to log sources.

Step 6: Receive confirmation email

You will receive a notification email from Anomali once you have created a new log source request. The Log Source Management page will show the status as Create Requested.

Once the log source has been provisioned and is ready for use, Anomali will send you another email and the Log Source Management page status for the log source will change to Active.