metric filter pattern for IP range

0

hi, i am looking to get an alert if vpc flow log has srcaddr range between 8.29.0.0 to 8.29.255.255 can anyone please help me how can I get pattern for it

1 Answer
0

Hi,

One way to achieve what your want is to publish the VPC flow logs to CloudWatch logs and then use the regular CloudWatch alarms + SNS mechanisms on those CloudWatch logs to filter the events that you want.

See:

  1. https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-cwl.html for publication to CloudWatch
  2. https://blog.serverlessadvocate.com/monitoring-aws-cloudwatch-logs-with-cdk-creating-alarms-for-specific-error-conditions-bae0c4e36f79 for an example done via CDK

Best,

Didier

profile pictureAWS
EXPERT
answered a month ago
profile picture
EXPERT
reviewed a month ago
profile picture
EXPERT
Steve_M
reviewed a month ago
  • Hi, Thanks for the reply, i need possible metric filter pattern to match my condition, can you please help me with that?

  • Sure, can you provide a sample of a VPC message published to CloudWatch containing the address(es) to filter? We'll build then the pattern to filter it.

  • 2 123456789010 eni-1235b8ca123456789 172.31.16.139 172.31.16.21 20641 22 6 20 4249 1418530010 1418530070 ACCEPT OK

  • Ok. So, based on this syntax, you have to create a regex filtering the ip addresses as 4th and 5th field of the log message. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html. Then, with this metric, you raise a CW alarm as soon as metric is non-zero and you route this alarm to SNS where you create a corresponding topic alerting the proper addresses via email.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions