Cribl

Source

AWS CloudTrail

Monitor and audit activity on your AWS account

AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. This event history simplifies security analysis, resource change tracking, and troubleshooting. In addition, you can use CloudTrail to detect unusual activity in your AWS accounts. These capabilities help simplify operational analysis and troubleshooting.

How to get data flowing

This integration is facilitated through the Cribl Stream’s S3 Source.

  • On AWS side, configure CloudTrail to deliver events to your S3 bucket, Configure your S3 bucket to send event notifications to a SQS queue

  • Find the integration in Stream througj Sources > Amazon S3

  • Supply your SQS queue. IAM roles or manual keys are both supported.

  • Stream will start fetching data as SQS messages become available

View Documentation

Cribl, the Data Engine for IT and Security, empowers organizations to transform their data strategy. Customers use Cribl’s suite of products to collect, process, route, and analyze all IT and security data, delivering the flexibility, choice, and control required to adapt to their ever-changing needs.

We offer free training, certifications, and a free tier across our products. Our community Slack features Cribl engineers, partners, and customers who can answer your questions as you get started and continue to build and evolve. We also offer a variety of hands-on-Sandboxes for those interested in how companies globally leverage our products for their data challenges.