Full Report
Simplify and centralize security and compliance management by sending audit-worthy events from Wiz into AWS CloudTrail Lake.
Analysis Summary
# Best Practices: Cloud Security Audit Log Centralization and Long-Term Retention
## Overview
These practices focus on leveraging the integration between Wiz (a cloud infrastructure security platform) and AWS CloudTrail Lake to centralize, immutably store, and query security audit logs generated by Wiz. The primary goal is to meet stringent compliance requirements, streamline security investigations, and maintain a long-term, accessible history of security control changes and user activities within the cloud environment.
## Key Recommendations
### Immediate Actions
1. **Enable CloudTrail Lake Ingestion from Wiz:** Configure the integration immediately for all environments needing long-term audit logging (e.g., production, critical dev/staging).
2. **Verify Default Retention Policy:** Confirm that the default 7-year retention policy within CloudTrail Lake is active for the imported Wiz logs, satisfying immediate compliance documentation needs.
3. **Execute Initial Query Syntax Validation:** Run foundational SQL-like queries in CloudTrail Lake against the ingested Wiz data to ensure log availability, correct schema mapping, and data integrity (e.g., confirming you can retrieve successful actions from the last 24 hours).
### Short-term Improvements (1-3 months)
1. **Establish Compliance Reporting Dashboards:** Develop specific, automated dashboards within CloudTrail Lake utilizing Wiz audit events (e.g., configuration rule creation, security control omission logs) to streamline evidence gathering for upcoming audits.
2. **Define Investigation Playbooks:** Create documented security investigation playbooks that explicitly detail how to use CloudTrail Lake queries on Wiz logs to trace user activity, such as tracking password resets, user updates, or connector creation timelines.
3. **Review and Tune Data Filters:** Analyze the volume and relevance of ingested data. Implement filters if necessary to ensure only *audit-worthy* events are being stored fully, balancing comprehensive coverage with storage efficiency, while upholding compliance mandates.
### Long-term Strategy (3+ months)
1. **Integrate with SIEM/Monitoring:** Plan for a long-term strategy to export or link the finalized, immutable data stored in CloudTrail Lake with your primary Security Information and Event Management (SIEM) system for advanced threat correlation across all data sources.
2. **Develop Cross-Cloud Auditing Strategy:** If the organization uses multiple cloud providers, define a strategy to consolidate Wiz logs ingested via CloudTrail Lake alongside audit trails from other cloud security tools/sources for a unified security posture view.
3. **Establish Periodic Audit Review Schedule:** Formalize a recurring schedule (e.g., quarterly) to actively query and validate historical Wiz audit data stored in CloudTrail Lake to proactively identify potential policy drift or unauthorized historical changes missed during real-time monitoring.
## Implementation Guidance
### For Small Organizations
- **Focus on Core Compliance:** Prioritize enabling the integration for the environments hosting the most sensitive data, ensuring you cover the basic audit requirements mandated by industry regulations (e.g., evidence of continuous monitoring).
- **Leverage Default Settings:** Rely heavily on the default 7-year retention policy provided by CloudTrail Lake to minimize initial configuration overhead related to retention scheduling.
### For Medium Organizations
- **Document Key Control Changes:** Specifically focus use-case development around auditing configurations critical to your environment (e.g., infrastructure-as-code deployments, changes to specific high-risk security rules within Wiz).
- **Role-Based Access Control (RBAC):** Implement strict RBAC within CloudTrail Lake to control who can query the immutable Wiz-sourced logs, separating audit reviewers from daily security operations staff where appropriate.
### For Large Enterprises
- **Comprehensive Data Governance:** Establish formal data governance policies defining data classification, retention overrides (if necessary, though 7 years is a strong default), and data access matrices for the CloudTrail Lake data set.
- **Automated Alerting on Anomalies:** Build advanced alerting mechanisms on top of CloudTrail Lake queries that monitor for anomalous sequences in the Wiz audit history (e.g., a cluster of configuration changes followed immediately by a connector deletion).
## Configuration Examples
*Note: Specific configuration steps require accessing Wiz and AWS consoles. The following describes the *intent* of the configuration.*
| Configuration Goal | Target System | Action Template |
| :--- | :--- | :--- |
| **Data Ingestion** | Wiz & AWS CloudTrail Lake | Navigate to CloudTrail Lake settings and configure a new data source ingest event stream originating from the linked Wiz security platform account. |
| **Querying Control Creation** | AWS CloudTrail Lake (SQL) | `SELECT eventTime, userIdentity.arn, eventName FROM <Wiz_Trail_Name> WHERE eventName LIKE 'CloudConfigurationRuleCreation'` |
| **Tracing Security Gaps** | AWS CloudTrail Lake (SQL) | `SELECT eventTime, userIdentity.arn, eventName FROM <Wiz_Trail_Name> WHERE eventName LIKE 'SecurityControlOmitted' AND eventTime BETWEEN '2024-01-01T00:00:00Z' AND '2024-01-31T23:59:59Z'` |
## Compliance Alignment
- **NIST SP 800-53 (Rev. 5):** Supports AU (Audit and Accountability) controls by providing centralized, immutable logging. Specifically strengthens requirements around long-term retention and comprehensive event logging.
- **ISO/IEC 27001/27002:** Directly supports requirements for monitoring, review, and retention of records related to information security events and actions taken.
- **PCI DSS:** Assists in meeting requirements for logging user activity on systems processing cardholder data, particularly evidence of control implementation and changes.
- **HIPAA/HITECH (Healthcare):** Aids in demonstrating the ability to trace all access and changes related to protected health information (PHI) environments via cloud configuration tools.
## Common Pitfalls to Avoid
1. **Assuming Default Retention is Sufficient:** Do not forget to verify the 7-year retention policy is active *specifically* for the Wiz data stream in CloudTrail Lake, especially if custom retention policies are active elsewhere in your AWS environment.
2. **Ignoring Connector Audit Logs:** Failing to query logs related to the *creation* or *deletion* of the Wiz connector itself, as this access point is critical for security investigations.
3. **Over-Reliance on Real-Time Alerts:** While real-time alerts are important, do not use them as the sole source of truth. The long-term, immutable nature of CloudTrail Lake is essential for retrospective compliance validation that real-time systems might miss or overwrite.
## Resources
- **AWS CloudTrail Lake Documentation:** Links related to data source ingestion and querying capabilities (Search: "AWS CloudTrail Lake activity events from non-AWS sources").
- **Wiz Documentation:** Official documentation detailing the setup process for the CloudTrail Lake integration (Search: "Wiz CloudTrail Lake integration").
- **Query Reference:** Utilize documentation detailing SQL-like syntax for querying event data within CloudTrail Lake.