Set up AWS for Live Search, runLiveSearchQuery, and runGatherLogsTask

Log in to your AWS cloud platform.

Create the S3 bucket. Go to Amazon S3 > Buckets > Create bucket and create an S3 bucket.

The information stored in the bucket will be saved in the following path format depending on the method used:

For runLiveSearchQuery:

 <companyId>/<endpointProtectedEntityId>/osquery_<endpointProtectedEntityId>_<date>.json

For runGatherLogsTask:

ST_<hostname>_<YYYY_MM_DD_HH_mm>.zip

Create an AWS role to provide GravityZone with the required permissions to upload files to the bucket. Go to IAM > Roles > Create role.

In the creation form select Custom trust policy and add a trust policy that has the following format:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::789423628920:root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "000000000000000000000"
                }
            }
        }
    ]
}

This trust policy grants permission for the Bitdefender user to assume the role. Here, the Principal.AWS field specifies the Amazon Resource Name (ARN) of the Bitdefender user, defining who is allowed to assume the role.

For enhanced security, the ExternalId should also be configured. This is a custom string that helps prevent unauthorized access. The value can be any unique identifier and will be passed as a parameter when invoking the runLiveSearchQuery or runGatherLogsTask method via the API.

Add a bucket policy. Go back to the bucket and then go to Permissions. Add the following bucket policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": <roleArn>
            },
            "Action": "s3:PutObject",
            "Resource": <bucketArn>
        }
    ]
}

This policy allows the role to put objects in the S3 bucket.

Create a policy for the role. Go to IAM > Policies > Create policy.

Create the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "s3:PutObject",
            "Resource": <bucketArn>
        }
    ]
}

This policy grants the role permission to execute the PutObject action on the specified S3 bucket.

The Resource field defines the ARN of the target bucket, specifying where the role is allowed to upload objects. For example, "arn:aws:s3:::osquery-bucket-test/*".

Make a request using runLiveSearchQuery or runGatherLogsTask.

Whitelist the S3 bucket domain (if using a Relay). If your endpoints communicate with GravityZone through a Relay and cannot reach the S3 bucket, you need to whitelist the bucket's domain in the Relay's policy settings.

To do this, follow these steps: