Arctic Wolf AWS Connector — Verification

Cadence: Quarterly + on any new AWS account onboarding Owner: Infrastructure (Rory) Related story: AWMDR-010 Estimated time: 30 minutes

Purpose

Confirm that Arctic Wolf is getting the AWS telemetry it needs across every Cirius AWS account, and understand the split between what the cloud connector sees versus what our AWS-resident custom agents emit.

Pairs with the full ingestion validation runbook.

How the Arctic Wolf AWS connector works

Arctic Wolf's AWS cloud connector is a pull-based integration. Cirius grants an Arctic Wolf IAM role cross-account sts:AssumeRole access to a scoped read-only policy in each AWS account. Arctic Wolf's cloud-side puller periodically calls:

AWS source	API	Ingested telemetry
CloudTrail	cloudtrail:LookupEvents + S3 read	Management events across the org, including IAM, KMS, S3, EC2, STS, Config changes
GuardDuty	guardduty:ListFindings, guardduty:GetFindings	Threat findings (EC2 recon, crypto-mining, IAM anomalies, credential exfiltration)
Security Hub	securityhub:GetFindings	Normalized findings from integrated AWS services (GuardDuty, Macie, Inspector, Audit Manager)
Config (optional)	config:BatchGetResourceConfig	Resource change history for forensic context
VPC Flow Logs (optional)	S3 read	Only where flow logs are actually enabled (see per-account coverage below)

The connector does NOT pull data plane events (S3 object-level reads/writes, Lambda invocations) unless CloudTrail Data Events are explicitly enabled for those resources.

Cirius AWS account inventory

Cirius runs 7 AWS accounts in a single AWS Organization rooted at the management account. All accounts are expected to be wired to the Arctic Wolf connector.

Account	Account ID	Purpose	Arctic Wolf connector status
Management	206820231356	AWS Organizations root, billing, OIDC for GitHub Actions	Expected: connected
Logging	038901680748	CloudTrail, Security Hub delegated admin, Audit Manager, GuardDuty, centralized log storage	Expected: connected (primary — org CloudTrail lives here)
Networking	238342914131	Palo Alto VM-Series, Panorama, Transit Gateway, Twingate	Expected: connected
Prod	807267566999	DR workloads, EC2, Cloud PC	Expected: connected
Dev	040067931468	Development workloads	Expected: connected
Identity	414134953818	Active Directory, identity services	Expected: connected
Backup	863609217450	Veeam backup targets, S3 WORM archive	Expected: connected

Where the CloudTrail org trail lives: the Logging account (038901680748) is the delegated admin for CloudTrail, Security Hub, and Audit Manager. The org trail writes to an S3 bucket in this account, and Arctic Wolf's connector reads from there to get management events across all 7 accounts.

What AW sees via connector vs. what our AWS-resident agents emit

Cirius runs two complementary telemetry paths in AWS:

Path 1 — Arctic Wolf cloud connector (pull)

• CloudTrail (org-wide)
• GuardDuty (per account)
• Security Hub (normalized findings)
• Config (if enabled)

Latency: minutes. Best for post-hoc investigation and standard AWS-native alerts.

Path 2 — Cirius AWS-resident custom collectors

These are Cirius-owned agents running inside AWS, producing telemetry that augments or replaces what the connector could pull:

Component	Location	What it emits
arcticwolfvlc (AWS VLC)	networking account, us-west-2	CEF from the AWS-resident Palo Alto firewall; forwarded directly to AW cloud over TCP 514 within the VPC
Palo Alto firewall syslog	networking account	Traffic, Threat, URL, Wildfire, Data, Config, System logs → aw-vlc
twingate_law_lambda.py	logging account	Twingate activity from S3 → Azure LAW via DCR. Note: this feeds LAW, not AW directly
syslog VM → S3 archive	logging account	Long-term WORM archive for 6-year retention (compliance, not AW)
Veeam replication telemetry	backup account	Backup job status; visible through CloudTrail/Backup APIs, not a separate AW feed

Key gap to understand: Arctic Wolf's AWS connector does not read S3 data plane events or Lambda invocations unless CloudTrail Data Events are enabled. Cirius has not enabled Data Events on either twingate-logs-prod or the backup buckets, by design (cost + noise). If we need visibility into S3 data operations we either enable Data Events or route via Path 2.

Verify connector health

Check 1 — Portal status

1. Arctic Wolf portal → Configuration → Cloud Connectors → AWS.
2. Every listed account should show Active / Healthy with Last Sync < 1h.
3. Any account in Unhealthy or Warning — drill into the detail view; AW will show the specific API call that's failing (usually an IAM permission drift).

Check 2 — IAM role presence

In each AWS account, confirm Arctic Wolf's IAM role exists and has the current trust policy:

for acct in 206820231356 038901680748 238342914131 807267566999 040067931468 414134953818 863609217450; do
  aws iam get-role --role-name <arctic-wolf-role-name> \
    --profile cirius-org-assumerole-${acct} \
    --query 'Role.{Name:RoleName, Trust:AssumeRolePolicyDocument.Statement[0].Principal}' \
    --output json
done

(Substitute the actual role name AW provisioned — it's typically ArcticWolfReadOnly or similar. Check with Concierge if unclear.)

Expected trust: Arctic Wolf's AWS account, scoped with an ExternalId matching our tenant's Concierge-issued value.

Check 3 — Recent activity

In the Arctic Wolf portal, open Search and run:

• source:aws AND account:206820231356 (management account) — filter last 24h, confirm non-zero events.
• Repeat per account ID.

Every account should have at least CloudTrail management events logged daily (login, role assumption). Zero events across 24h on any account is an alarm.

Check 4 — GuardDuty coverage

aws guardduty list-detectors --profile <per-account-profile>
aws guardduty get-detector --detector-id <id> --profile <per-account-profile>

Each account must have:

• A detector present (one per region, per account)
• Status: ENABLED
• Finding publishing frequency: FIFTEEN_MINUTES
• S3 protection enabled where S3 buckets exist (logging, backup at minimum)
• EKS/Kubernetes protection enabled where EKS is present (currently: none, but verify)
• Malware protection enabled on EC2 where present (prod account)

If any detector is missing or in DISABLED status, that account's EC2/IAM detections are blind through the connector — file a ticket immediately.

Check 5 — CloudTrail org trail

aws cloudtrail describe-trails --profile cirius-logging --region us-west-2

Confirm:

• IsOrganizationTrail: true
• IsMultiRegionTrail: true
• LogFileValidationEnabled: true
• S3BucketName is the expected centralized bucket in the logging account
• IncludeGlobalServiceEvents: true

If any of these have drifted, CloudTrail coverage is partial and Arctic Wolf is reading an incomplete stream.

Common issues

Symptom	Cause	Fix
One account unhealthy, others fine	IAM role in that account is missing a new permission AW added	Apply the updated AW-published IAM policy via Terraform (aws-infra)
All accounts unhealthy at once	Arctic Wolf account-side auth broke, or org-wide SCP denies the role	Check SCPs first; if clean, open Concierge P1
GuardDuty findings missing	Detector disabled in a region or per-account	Re-enable via aws guardduty create-detector or check Security Hub delegation
Security Hub findings duplicated	Integration routes both directly and via aggregator	Normal; AW deduplicates by FindingId
Connector latency >1h	Usually AW-side backlog	Concierge case, note per-account impact

Onboarding a new AWS account

When a new account is added to the org:

1. Ensure it joins org CloudTrail automatically (it will, via the org trail).
2. Enable GuardDuty in the account (delegated admin pattern — Logging account auto-enables).
3. Apply the Arctic Wolf IAM role via aws-infra Terraform.
4. Open a Concierge case: "Please add account <ID> to the Cirius AWS connector."
5. Run Check 3 above 24h after AW confirms — expect events.
6. Add the account to the inventory table at the top of this runbook.

Escalation

Issue	Path
Any account unhealthy >4h	AW Concierge case
GuardDuty disabled anywhere	Rory P2
CloudTrail org trail dropped an account	Rory P1 + AWS support
New account not being ingested >24h after onboarding	Concierge P2
Suspected AW role privilege drift	Rory + aws-infra PR to reconcile

Validation log

Quarter	Date	Operator	All accounts healthy	GuardDuty all enabled	CloudTrail org trail OK	Notes
Q2 2026	2026-04-16	kobe	☐	☐	☐	Initial runbook creation