--- title: "Case Study: Splunk Log Aggregation" description: When migrating their workloads into AWS, a federal law enforcement agency had developed security and audit requirements to capture activity in all accounts residing in their GovCloud environment. image: https://resources.simpletechnology.io/hubfs/Splunk.png --- ###### [AWS](https://resources.simpletechnology.io/tag/aws), [Case Study](https://resources.simpletechnology.io/tag/case-study), [Cloud Services](https://resources.simpletechnology.io/tag/cloud-services) # Case Study: Splunk Log Aggregation [ Simple Technology Solutions ](https://resources.simpletechnology.io/author/simple-technology-solutions) Nov 2, 2022 3:22:14 PM SHARE [mailto:?subject=Check%20out%20Case%20Study:%20Splunk%20Log%20Aggregation%20&body=Check%20out%20https://resources.simpletechnology.io/splunk-log-aggregation](mailto:?subject=Check%20out%20Case%20Study:%20Splunk%20Log%20Aggregation%20&body=Check%20out%20https://resources.simpletechnology.io/splunk-log-aggregation)   ![6-1](https://resources.simpletechnology.io/hs-fs/hubfs/6-1.png?width=346&height=173&name=6-1.png)**Background** When migrating their workloads into AWS, a federal law enforcement agency had developed security and audit requirements to capture activity in all accounts residing in their GovCloud environment. Simple Technology Solutions (STS) was tasked to architect a solution to satisfy these needs in a secure and efficient manner. **Analysis** STS proposed and developed a solution that leveraged cloud-native AWS services, as well as third party security logging tools, ultimately using Splunk. Guided by our automation ethos, all resources were to be created using infrastructure as code and deployed through a pipeline. All AWS GovCloud accounts were targeted for complete coverage. **Solution** STS implemented and configured the following AWS services: - **CloudTrail:** Enabled logging and delivery to a secure/lockdown S3 bucket in a separate security account. - **CloudWatch Logs:** Enabled and manipulated with Lambda, then written to S3. - **Config: **Enabled centralized aggregation from all accounts and delivered logs to S3 for ingestion. - **GuardDuty:** Enabled in each account and sent logs to S3 for ingestion. - **Virtual Private Cloud (VPC) Flow Logs:** Enabled on all VPCs and delivery to a secure/locked down S3 bucket in a separated security account. - **IAM: **Created role, policy and instance profile for the Splunk EC2 log collectors in order to access log buckets and AWS services themselves. - **S3: **Used multiple buckets for log storage and ingestion. - **Lambda: **Developed formatting functions to ingest specific AWS service logs and write to S3. Logs would then be picked up by Splunk. **Benefit** All originally targeted services were successfully configured to stream thousands of KBs of logs per day, to the target bucket(s), and Splunk was successful in collecting/parsing logs from each of the five AWS services mentioned above. Information assurance was able to successfully monitor and identify activity within the federal law enforcement agency’s GovCloud AWS environment. STS helped the client improve their centralized logging maturity by following the guidance of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-92, *Guide to Computer Security Log Management*. ![Splunk](https://resources.simpletechnology.io/hs-fs/hubfs/Splunk.png?width=797&height=448&name=Splunk.png)   #### [ Simple Technology Solutions ](https://resources.simpletechnology.io/author/simple-technology-solutions) ## Related posts [![LucidChart Diagram of Enterprise Security Hub Implementation](https://resources.simpletechnology.io/hubfs/Security%20Hub%20Architecture.png) ](https://resources.simpletechnology.io/enterprise-security-hub-implementation) ###### [AWS](https://resources.simpletechnology.io/tag/aws),[cloudsecurity](https://resources.simpletechnology.io/tag/cloudsecurity),[Case Study](https://resources.simpletechnology.io/tag/case-study),[Security](https://resources.simpletechnology.io/tag/security) #### [Case Study: Enterprise Security Hub Implementation](https://resources.simpletechnology.io/enterprise-security-hub-implementation) [Read more ](https://resources.simpletechnology.io/enterprise-security-hub-implementation) [![](https://resources.simpletechnology.io/hubfs/5.%20GOOGLE%20CLOUD%20PLATFORM%20(GCP)%20SERVERLESS%20PROJECT.png) ](https://resources.simpletechnology.io/case-study-google-cloud-platform-serverless-project) ###### [cloudsecurity](https://resources.simpletechnology.io/tag/cloudsecurity),[Cloud Enterprise Architecture](https://resources.simpletechnology.io/tag/cloud-enterprise-architecture),[Cloud Networking](https://resources.simpletechnology.io/tag/cloud-networking) #### [Case Study: Google Cloud Platform (GCP) Serverless Project](https://resources.simpletechnology.io/case-study-google-cloud-platform-serverless-project) #### Background A large US Federal Agency was exploring multi-platform cloud solutions to host resources... [Read more ](https://resources.simpletechnology.io/case-study-google-cloud-platform-serverless-project) #### Subscribe to our resource library! Want to stay in the know? Subscribe and you'll receive an email every time we publish a new resource. ![img-mails](https://f.hubspotusercontent10.net/hubfs/369261/raw_assets/public/Marketplace/leadstreet/themes/popular-theme/images/img-mails.svg)