AI SIEM — Getting Started Guide

Version: 26h2 | Product: AI SIEM | Perfware.cloud

Prerequisites

• Log Processor must be deployed first (provides VPC, OpenSearch, Cognito)
• AWS account with admin access (or IAM permissions per the deploy policy)
• ACM certificate for HTTPS on the editor (same region as deployment)
• An existing CloudTrail trail delivering to S3. AI SIEM reads from your bucket; it does not create a trail. Confirm with aws cloudtrail describe-trails
• SNS subscription confirmation email access — alerts are not delivered until confirmed

Step 1: Subscribe on AWS Marketplace

1. Navigate to the AI SIEM listing on AWS Marketplace
2. Click Continue to Subscribe
3. Accept terms and wait for subscription activation (~2 minutes)
4. Click Continue to Configuration
5. Select your tier and preferred region, then Continue to Launch

Step 2: Deploy the CloudFormation Stack

On the fulfillment page, provide these parameters:

Step 3: Confirm SNS Subscription

Check the email address(es) provided in AlertEmail. Click the confirmation link in the AWS SNS email. Threat alerts will not be delivered until confirmed.

Step 4: Access the Editor

1. Find the editor URL in the CloudFormation Outputs tab (or navigate to your custom domain)
2. Log in with the Cognito credentials created by Log Processor
3. The threat dashboard shows connected sources, active threats, and system health

Step 5: Configure Data Sources

In the editor, go to Configure → Data Sources. Sources arrive by two different mechanisms, which determines what you need to do:

S3-based sources (need a bucket)

CloudTrail and VPC Flow Logs are read from S3. Enter the bucket that already receives those logs and click Save Sources. AI SIEM then configures an s3:ObjectCreated notification on that bucket pointing at its ingestion queue, and reports the result per bucket.

If saving reports that the bucket could not be configured, it is almost always because the bucket belongs to a different AWS account — common for an organization trail in a log archive account. Run the supplied helper from a machine with credentials for both accounts:

scripts\wire-log-bucket.cmd <stack> <bucket> <region> <bucket-profile>

# same account
scripts\wire-log-bucket.cmd AISIEM my-cloudtrail-logs

# bucket owned by a log archive account
scripts\wire-log-bucket.cmd AISIEM org-trail-logs us-east-1 logarchive

It adds the notification and grants that account permission to send to the ingestion queue. Both changes are merge-safe: existing notifications on the bucket are preserved, and re-running is harmless. Add --dry-run via wire_log_bucket.py to preview changes before touching a shared bucket.

EventBridge sources (nothing to configure)

GuardDuty, Security Hub and AWS Config are delivered by EventBridge rules the stack creates. There is no bucket and no setup. They only produce data when something happens, so zero events is normal on a quiet account.

These only work if the underlying AWS service is enabled. AI SIEM checks this for you and the panel will say AWS service not enabled rather than leaving you guessing. To verify yourself:

aws guardduty list-detectors
aws securityhub describe-hub
aws configservice describe-config-rules --query "ConfigRules[].ConfigRuleName"

Empty results mean the service is off and those rules will never fire. Enabling GuardDuty is the highest-value one; it begins producing findings on its own within a few hours.

Reading the health indicators

Step 5a: Check Everything Is Working

Open FAQ in the editor. Every answer is a live check against the real dependency rather than a configuration readback, so it reflects what your deployment can actually do:

• Entitlement tier — your active Marketplace dimension, and a warning if it does not match the deployed tier
• Bedrock AI backend — performs a real model invocation, which is the only way to detect an unsubmitted Anthropic use case form
• OpenSearch reachability — distinguishes a network problem from an authorisation one
• Events reaching OpenSearch — index and document counts
• Alert email delivery — flags subscriptions still awaiting confirmation, which otherwise fail silently
• Enabled data sources — and warnings for sources enabled without a bucket
• Version — stack, tier, release and build, useful to quote in a support request

Multi-Account Monitoring

AI SIEM is deployed once, in one account, and reads security data from any number of other accounts using cross-account IAM roles. Available on advanced tier and above.

There are two steps, run in two different accounts and in this order:

Step A — in each remote account

Creates the trust roles AI SIEM assumes. Run with credentials for the account you want to monitor, passing the account ID of the account where AI SIEM is deployed:

scripts\setup-remote-access.cmd setup <central-account-id>

This creates two roles:

• AISIEM-remote-read — read CloudTrail and VPC Flow Log objects from S3
• AISIEM-remote-respond — remediation actions, enterprise tier only

Step B — in the AI SIEM account

Registers the remote account and the bucket to read from, so ingestion begins:

scripts\add-account.cmd <stack> <remote-account-id> --trail-bucket <bucket>

You can also list the account IDs in the CrossAccountIds stack parameter, or set OrganizationId to authorise an entire AWS Organization. Either may be used, or both.

Multi-region coverage

• CloudTrail — an organization trail delivers all regions to one bucket, so a single bucket covers everything with no extra work
• VPC Flow Logs — regional. Configure flow logs in each region to deliver to one central bucket
• GuardDuty and Security Hub — EventBridge is regional. Use a delegated administrator with auto-enable across regions, and findings aggregate to the admin account

Helper Scripts

Download the helper scripts (aisiem-scripts.zip). Unzip anywhere and run from that folder. Windows .cmd and Linux/macOS .sh versions are provided for most; a few use Python and need boto3 (pip install boto3). Run them with AWS credentials for the account named in the table below.

Querying Historical Data

Every event is written to an S3 datalake in Parquet, partitioned for efficient Athena queries, regardless of whether it was promoted to OpenSearch. Use this for investigations reaching further back than the OpenSearch retention window:

s3://<stack>-siem-datalake-<account>-<region>/
    cloudtrail/account_id=.../region=.../year=.../month=.../day=.../*.parquet
    flowlogs/account_id=.../region=.../year=.../month=.../day=.../*.parquet
    guardduty/ securityhub/ config-changes/ threats/

A Glue database named <stack>_siem is created with tables over these prefixes. Filter on the partition columns so Athena scans only what it needs:

SELECT * FROM cloudtrail
WHERE account_id = '111111111111'
  AND region = 'us-east-1'
  AND year = '2026' AND month = '08';

Cost Expectations

AI SIEM's own resources are modest and mostly usage-based. The variable cost that surprises people is VPC Flow Logs, billed by AWS at roughly $0.25/GB delivered to S3 plus S3 storage, independent of AI SIEM:

A busy production VPC logging ALL traffic reaches tens of GB per day without difficulty. Setting the flow log traffic type to REJECT typically reduces volume by an order of magnitude and still supports port scanning and blocked-connection detection. CloudTrail management events are far smaller and rarely material.

Step 6: Review Threats

As threats are detected, they appear in the Threats panel with:

• Severity score (0–100)
• Unified timeline showing all correlated events
• MITRE ATT&CK mapping (advanced+)
• AI-generated investigation playbook (advanced+)
• One-click remediation options (enterprise)

Updating

• Open AWS Marketplace → Manage Subscriptions → Set up your account → Update
• Stack updates are non-destructive (all data preserved, no downtime)
• Tier changes: update the Tier parameter and run a stack update

Troubleshooting

When contacting support, include the Version line from the FAQ panel — it identifies your stack, tier, release and build.

Teardown (Uninstalling)

Deleting the CloudFormation stack does not detach the data sources that feed it. Bucket notifications and any VPC Flow Logs created for AI SIEM live outside CloudFormation and survive the delete. Left in place, notifications fire at a queue that no longer exists, and flow logs keep writing to S3 while you continue paying for storage.

Run teardown in this order:

1. Sever sources (dry run first):

   python scripts\sever_sources.py <stack>
   python scripts\sever_sources.py <stack> --apply

   Deletes VPC flow logs, removes this stack's bucket notifications (merge-safe: other tools' notifications are preserved), and stops the CloudTrail trail. Each action is confirmed individually. Add --delete-trail to delete rather than stop the trail. Add --delete-buckets to also destroy the log buckets AI SIEM created (irreversible — requires typing each bucket name to confirm).

2. Delete the stack:

   aws cloudformation delete-stack --stack-name <stack>
   aws cloudformation wait stack-delete-complete --stack-name <stack>

3. Clean OpenSearch artifacts (dashboards, index templates, ISM policy left in the shared domain):

   python scripts\clean_opensearch.py --print-commands

   Prints paste-ready steps for the Dashboards UI and Dev Tools console, since the domain is VPC-only and not reachable from a workstation. Future deployments clean these up automatically on stack delete.

VPC Flow Logs: Cost vs Detection

Flow-log volume is the single largest cost variable. The default traffic type is REJECT, which supports port-scan detection and costs roughly 1–5% of what ALL traffic would. Switching to ALL adds large-transfer exfiltration detection but can raise Lambda and DynamoDB costs significantly at scale.

When ALL is enabled, AI SIEM's ingestion filter automatically drops routine noise before scoring: internal VPC-to-VPC ACCEPT traffic, ACCEPT on safe ports (443, 80, 53) to private destinations, and broken records. Only REJECT flows, large transfers, and ACCEPT to external addresses on unusual ports reach the detection pipeline.

Support

• Documentation: https://perfware.cloud/aisiem
• Email: support@perfware.cloud
• Security inquiries: security@perfware.cloud