Collect Security Center logs with Log Audit Service

How it works

After you enable the log analysis feature for Security Center, logs are stored by default in a Project named sas-log-${Alibaba Cloud account ID}-${region ID} and a Logstore named sas-log. Log Audit Service then collects these logs from multiple regions and accounts into a single Project.

Prerequisites

• Log in to the Security Center console and enable log analysis for Security Center. For instructions, see Enable log analysis.

• To collect logs from multiple accounts, first enable a Resource Directory. Then, use your management account to log in to the Resource Management console and add a delegated administrator account. For instructions, see Manage delegated administrator accounts.

1. Associate a Project

Security Center logs are collected into the associated Project.

1. Log in to the Simple Log Service console. In the Log Application section, on the Audit & Security tab, click Log Audit Service (New Version).

2. On the Log Audit Service (New Version) page, click Associate Project. In the dialog box that appears, configure the Project, and then click Confirm.

   Select the region and the target Project. Add comments if necessary.

2. Create a collection rule

2.1 Configure a collection rule

1. On the Log Audit Service (New Version) page, click the name of the target Project.

2. On the Rules tab, click Create Collection Rule and configure the parameters. The following example centrally ships Security Center logs from two member accounts in the China (Hangzhou) and Singapore regions to the central-sas-log Logstore within the a-multi-accounts-security-log-center Project. For parameter descriptions, see Usage notes of cloud service configuration.

   Example configuration: Set Rule Name to sas-log-rule. For Cloud Service, select Security Center. For Log Type, select Security Center Logs. For Resource Matching Mode, select Attribute Mode. For Region, select China (Hangzhou) and Singapore. For Centralized Destination Project, select the a-multi-accounts-security-log-center Project in the China (Shanghai) region. For Centralized Destination Logstore, select the existing Logstore central-sas-log. Enable Multi-account Settings and select Custom mode.

   In the Resource Directory panel on the left, select the target member accounts and click Confirm.

2.2 Verify the results

1. On the Rules tab, click the name of the collection rule that you created.

2. On the Query and Analysis page, query and analyze logs by using Search syntax and functions. For more information about log types and fields in Security Center logs, see Log types and log fields.

   Select the Security Center Logs tab. The Logstore is central-sas-log. Enter a query statement in the search box and click Search/Analyze.

References

• To allow a RAM user to manage Log Audit Service, use your Alibaba Cloud account to grant the required permissions to the RAM user. For more information, see Grant a RAM user the permissions to use the new version of Log Audit Service.

• To view, create, modify, and delete collection rules, see Manage collection rules in the new version of Log Audit Service.

• For information about other cloud services, including log types, default Project and Logstore names, and billing, see Usage notes of cloud service configuration.