Amazon Web Services
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | AWS |
| Publisher | Amazon |
| Used in Solutions | Amazon Web Services |
| Collection Method | Native |
| Connector Definition Files | template_AWS.json |
| Microsoft Learn | View on Learn |
Follow these instructions to connect to AWS and stream your CloudTrail logs into Microsoft Sentinel. For more information, see the Microsoft Sentinel documentation.
Additional Information
- 📖 Setup Guide: Connect Microsoft Sentinel to AWS - Configure your AWS environment for Microsoft Sentinel integration
- 📖 Related Documentation: AWS service logs - Ingest AWS service logs into Microsoft Sentinel
- 📖 Related Documentation: Enable attack disruption on AWS - Configure automatic attack disruption for AWS
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
AWSCloudTrail |
✓ | ✓ | ✓ |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): write permission.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Connect AWS cloud trail with Microsoft Sentinel
The connection necessitates giving Microsoft permissions to access your AWS account. To enable this, follow the instructions under Connect AWS to Microsoft Sentinel and use these parameters when prompted:
Data from all regions will be sent to and stored in the workspace's region.
- Microsoft account ID:
MicrosoftAwsAccountNote: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.
- External ID (Workspace ID):
WorkspaceIdNote: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.
📋 Additional Configuration Step: This connector includes a configuration step of type
AwsCloudTrail. Please refer to the Microsoft Sentinel portal for detailed configuration options for this step.
It takes about 5 minutes until the connection streams data to your workspace.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊