New – AWS CloudTrail Lake Helps Ingesting Exercise Occasions From Non-AWS Sources

Voiced by Polly

In November 2013, we introduced AWS CloudTrail to trace person exercise and API utilization. AWS CloudTrail permits auditing, safety monitoring, and operational troubleshooting. CloudTrail data person exercise and API calls throughout AWS companies as occasions. CloudTrail occasions enable you to reply the questions of “who did what, the place, and when?”.

Lately now we have improved the flexibility so that you can simplify your auditing and safety evaluation through the use of AWS CloudTrail Lake. CloudTrail Lake is a managed knowledge lake for capturing, storing, accessing, and analyzing person and API exercise on AWS for audit, safety, and operational functions. You’ll be able to mixture and immutably retailer your exercise occasions, and run SQL-based queries for search and evaluation.

We now have heard your suggestions that aggregating exercise data from numerous functions throughout hybrid environments is complicated and expensive, however essential for a complete image of your group’s safety and compliance posture.

In the present day we’re asserting help of ingestion for exercise occasions from non-AWS sources utilizing CloudTrail Lake, making it a single location of immutable person and API exercise occasions for auditing and safety investigations. Now you possibly can consolidate, immutably retailer, search, and analyze exercise occasions from AWS and non-AWS sources, comparable to in-house or SaaS functions, in a single place.

Utilizing the brand new PutAuditEvents API in CloudTrail Lake, you possibly can centralize person exercise data from disparate sources into CloudTrail Lake, enabling you to investigate, troubleshoot and diagnose points utilizing this knowledge. CloudTrail Lake data all occasions in standardized schema, making it simpler for customers to eat this data to comprehensively and shortly reply to safety incidents or audit requests.

CloudTrail Lake can also be built-in with chosen AWS Companions, comparable to Cloud Storage Safety, Clumio, CrowdStrike, CyberArk, GitHub, Kong Inc, LaunchDarkly, MontyCloud, Netskope, Nordcloud, Okta, One Identification,, Snyk, and Wiz, permitting you to simply allow audit logging by means of the CloudTrail console.

Getting Began to Combine Exterior Sources
You can begin to ingest exercise occasions from your individual knowledge sources or associate functions by selecting Integrations beneath the Lake menu within the AWS CloudTrail console.

To create a brand new integration, select Add integration and enter your channel identify. You’ll be able to select the associate software supply from which you need to get occasions. For those who’re integrating with occasions from your individual functions hosted on-premises or within the cloud, select My customized integration.

For Occasion supply location, you possibly can select locations in your occasions from this integration. This enables your software or companions to ship occasions to your occasion knowledge retailer of CloudTrail Lake. An occasion knowledge retailer can retain your exercise occasions for every week to as much as seven years. Then you possibly can run queries on the occasion knowledge retailer.

Select both Use present occasion knowledge shops or Create new occasion knowledge retailer—to obtain occasions from integrations. To be taught extra about occasion knowledge retailer, see Create an occasion knowledge retailer within the AWS documentation.

You can even arrange the permissions coverage for the channel useful resource created with this integration. The knowledge required for the coverage depends on the combination sort of every associate functions.

There are two forms of integrations: direct and answer. With direct integrations, the associate calls the PutAuditEvents API to ship occasions to the occasion knowledge retailer in your AWS account. On this case, you might want to present Exterior ID, the distinctive account identifier supplied by the associate. You’ll be able to see a hyperlink to associate web site for the step-by-step information. With answer integrations, the appliance runs in your AWS account and the appliance calls the PutAuditEvents API to ship occasions to the occasion knowledge retailer in your AWS account.

To search out the Integration sort in your associate, select the Out there sources tab from the integrations web page.

After creating an integration, you will have to supply this Channel ARN to the supply or associate software. Till these steps are completed, the standing will stay as incomplete. As soon as CloudTrail Lake begins receiving occasions for the built-in associate or software, the standing discipline shall be up to date to mirror the present state.

To ingest your software’s exercise occasions into your integration, name the PutAuditEvents API so as to add the payload of occasions. Ensure that there isn’t a delicate or personally figuring out data within the occasion payload earlier than ingesting it into CloudTrail Lake.

You can also make a JSON array of occasion objects, which features a required user-generated ID from the occasion, the required payload of the occasion as the worth of EventData, and an elective checksum to assist validate the integrity of the occasion after ingestion into CloudTrail Lake.

  "AuditEvents": [
      "Id": "event_ID",
      "EventData": "event_payload", "EventDataChecksum": "optional_checksum",
   ... ]

The next instance reveals tips on how to use the put-audit-events AWS CLI command.

$ aws cloudtrail-data put-audit-events 
--channel-arn $ChannelArn 
--external-id $UniqueExternalIDFromPartner 

  "Id": "87f22433-0f1f-4a85-9664-d50a3545baef",
  "EventData":""eventVersion":.01","eventSource":"MyCustomLog2", ...",

  "Id": "7e5966e7-a999-486d-b241-b33a1671aa74",
  "EventData":""eventVersion":.02","eventSource":"MyCustomLog1", ...",

On the Editor tab within the CloudTrail Lake, write your individual queries for a brand new built-in occasion knowledge retailer to examine delivered occasions.

You can also make your individual integration question, like getting all principals throughout AWS and exterior assets which have made API calls after a specific date:

SELECT userIdentity.principalId FROM $AWS_EVENT_DATA_STORE_ID 
WHERE eventTime > '2022-09-24 00:00:00'
SELECT eventData.userIdentity.principalId FROM $PARTNER_EVENT_DATA_STORE_ID
WHRERE eventData.eventTime > '2022-09-24 00:00:00'

To be taught extra, see CloudTrail Lake occasion schema and pattern queries that will help you get began.

Launch Companions
You’ll be able to see the listing of our launch companions to help a CloudTrail Lake integration possibility within the Out there sources tab. Listed here are weblog posts and bulletins from our companions who collaborated on this launch (some shall be added within the subsequent few days).

Now Out there
AWS CloudTrail Lake now helps ingesting exercise occasions from exterior sources in all AWS Areas the place CloudTrail Lake is obtainable in the present day. To be taught extra, see the AWS documentation and every associate’s getting began guides.

In case you are inquisitive about turning into an AWS CloudTrail Associate, you possibly can contact your common associate contacts.