09/26/19: AWS Automatic Mode IDS Tuning Capability

Alert Logic® Essentials™, Professional™, and Cloud Defender™ customers who utilize network intrusion detection (IDS) and have deployments in, or plan to deploy in, Amazon Web Services (AWS) are now able to define their Protection scope and desired Protection preferences. This allows for backend services to analyze the defined scope and set of preferences and to ultimately deploy IDS appliances and other necessary security infrastructure.

This capability is only configurable via API. Tuning service-specific API documentation is available here.

Historical Default Behavior in Automatic Mode

Before availability of this capability, users who chose Automatic Mode for their AWS deployment would, by default, see the following configuration rules:

• Deployment of IDS appliances
  • Placement of one appliance in every Availability Zone (AZ) that has at least one customer asset deployed
  • Instance type of c5.large
  • Auto-scaling is not currently an option, but planned in future work
  • For any AZ that is not populated by at least once customer asset, Alert Logic will automatically remove any deployed appliance from the uninhabited AZ, but will leave one appliance in a Virtual Private Cloud (VPC) where AZs do reside

This configuration has caused some customers, such as those wanting to avoid the monthly cost of deploying an additional appliance, to choose Manual Mode for AWS deployments, which does not support the ability to scale down to zero, relative to demand.

Tuning Options

This new tuning capability enables users to override the default configuration rules of Automatic Mode by providing additional options for tuning preferences, via API. The Alert Logic backend service, Otis, supports three different options for tuning:

1. ids_appliances_placement - Specify which AZs appliances should be deployed to
2. ids_appliances_scaling - Establish the number of appliances to be deployed per AZ
3. ids_appliance_instance_type - Identify which AWS instance type should be used

Tuning Option 1: ids_appliances_placement

 This option defines a policy to manage protection preferences inside a target VPC. You can specify an option scope - either the entire deployment or a specific VPC - that should be covered by the policy.

Supported Policies

• Automatic
  • Security infrastructure is removed from empty AZs automatically, leaving one appliance in VPCs where all AZs are uninhabited
  • Defined either by selecting the number of AZs or by an explicit list of AZs that are to be deployed
• Constant
  • Security infrastructure is never removed
  • Defined by selecting an explicit list of AZs to be deployed

Tuning Option 2: ids_appliances_scaling

This option defines a policy to manage the number of IDS appliances launched inside protected VPCs. You can specify an option scope (deployment of VPC) for which the defined policy is to be applied.

Supported Policies

• Constant
  • Customers can select a predefined number of appliances to deploy - up to eight - in each AZ as part of the AWS auto-scaling group

Tuning Option 3: ids_appliance_instance_type

This option overrides the default instance size (c5.large) that is used in standard Automatic Mode deployments. Any appliance type that you define here will be deployed inside the selected VPCs. You can then specify which deployment or VPC the defined option should be applied for.

Supported AWS Instance Types