Get in touch
← Sentinel Explorer
↳ GitHub sourceConnector

Amazon Web Services

View on GitHub ↗Original file ↗

Description

Follow these instructions to connect to AWS and stream your CloudTrail logs into Microsoft Sentinel. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2218883&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).
Declared status
2
Declared author / publisher
Amazon

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

AWSCloudTrail

Declared permissions

write permission.
Workspace
Workspace

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

Connect AWS cloud trail with Microsoft Sentinel​
The connection necessitates giving Microsoft permissions to access your AWS account. To enable this, follow the instructions under [Connect AWS to Microsoft Sentinel](https://aka.ms/AWSConnector) and use these parameters when prompted: > Data from all regions will be sent to and stored in the workspace's region. > It takes about 5 minutes until the connection streams data to your workspace.
Microsoft account ID
External ID (Workspace ID)
The integration is applicable for AWS public cloud accounts.

Related content

Links established from declared identifiers and solution manifests.

Analytics rules75
AWSCloudTrail - Amazon ECR image scanning disabledMediumAWSCloudTrail - AWS GuardDuty detector disabled or suspendedHighAWSCloudTrail - Changes to Amazon VPC settingsLowAWSCloudTrail - Changes to AWS Elastic Load Balancer security groupsLowAWSCloudTrail - Changes to AWS Security Group ingress and egress settingsLowAWSCloudTrail - Changes to internet facing AWS RDS Database instancesLowAWSCloudTrail - CloudFormation policy created then used for privilege escalationHighAWSCloudTrail - Created CRUD S3 policy and then privilege escalationMediumAWSCloudTrail - Creating keys with encrypt policy without MFAMediumAWSCloudTrail - Creation of Access Key for IAM UserMediumAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalationMediumAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalationMediumAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalationMediumAWSCloudTrail - Creation of DataPipeline policy and then privilege escalationHighAWSCloudTrail - Creation of EC2 policy and then privilege escalationHighAWSCloudTrail - Creation of Glue policy and then privilege escalationMediumAWSCloudTrail - Creation of Lambda policy and then privilege escalationMediumAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalationMediumAWSCloudTrail - Creation of SSM policy and then privilege escalationMediumAWSCloudTrail - EC2 Startup Shell Script ChangedMediumAWSCloudTrail - ECR image scan findings high or criticalHighAWSCloudTrail - Failed Attempts to Change AWS CloudTrail LogsLowAWSCloudTrail - Full Admin policy created and then attached to Roles, Users or GroupsMediumAWSCloudTrail - Login to AWS Management Console without MFALowAWSCloudTrail - Monitor AWS Credential abuse or hijackingLowAWSCloudTrail - Network ACL with all the open ports to a specified CIDRHighAWSCloudTrail - NRT Login to AWS Management Console without MFALowAWSCloudTrail - Policy version set to defaultMediumAWSCloudTrail - Privilege escalation via CloudFormation policyMediumAWSCloudTrail - Privilege escalation via CRUD DynamoDB policyMediumAWSCloudTrail - Privilege escalation via CRUD IAM policyMediumAWSCloudTrail - Privilege escalation via CRUD KMS policyMediumAWSCloudTrail - Privilege escalation via CRUD Lambda policyMediumAWSCloudTrail - Privilege escalation via CRUD S3 policyMediumAWSCloudTrail - Privilege escalation via DataPipeline policyMediumAWSCloudTrail - Privilege escalation via EC2 policyMediumAWSCloudTrail - Privilege escalation via Glue policyMediumAWSCloudTrail - Privilege escalation via Lambda policyMediumAWSCloudTrail - Privilege escalation via SSM policyMediumAWSCloudTrail - Privilege escalation with admin managed policyMediumAWSCloudTrail - Privilege escalation with AdministratorAccess managed policyMediumAWSCloudTrail - Privilege escalation with FullAccess managed policyMediumAWSCloudTrail - RDS instance publicly exposedMediumAWSCloudTrail - S3 bucket access point publicly exposedMediumAWSCloudTrail - S3 bucket exposed via ACLMediumAWSCloudTrail - S3 bucket exposed via policyMediumAWSCloudTrail - S3 bucket suspicious ransomware activityHighAWSCloudTrail - S3 Object Exfiltration from Anonymous UserMediumAWSCloudTrail - S3 object publicly exposedMediumAWSCloudTrail - SAML update identity providerHighAWSCloudTrail - SSM document is publicly exposedMediumAWSCloudTrail - Successful API executed from a Tor exit nodeHighAWSCloudTrail - Successful brute force attack on S3 BucketHighAWSCloudTrail - Successful Tampering with AWS CloudTrail LogsHighAWSCloudTrail - Suspicious AWS CLI Command ExecutionMediumAWSCloudTrail - Suspicious AWS EC2 Compute Resource DeploymentsMediumAWSCloudTrail - Suspicious command sent to EC2HighAWSCloudTrail - Suspicious overly permissive KMS key policy createdHighAWSCloudTrail - Unauthorized EC2 Instance Setup AttemptMediumAWSCloudTrail - User IAM EnumerationMediumCross-Cloud Password Spray detectionMediumFailed AWS Console logons but success logon to AzureADMediumFailed AzureAD logons but success logon to AWS ConsoleMediumHigh-Risk Cross-Cloud User ImpersonationMediumLog4j vulnerability exploit aka Log4Shell IP IOCHighMalformed user agentMediumMulti-Factor Authentication Disabled for a UserMediumNew UserAgent observed in last 24 hoursLowSuccessful AWS Console Login from IP Address Observed Conducting Password SprayMediumSuspicious access of BEC related documents in AWS S3 bucketsMediumSuspicious AWS console logins by credential access alertsMediumTI Map IP entity to AWSCloudTrailMediumTI map IP entity to AWSCloudTrailMediumUser agent search for log4j exploitation attemptHighUser impersonation by Identity Protection alertsMedium
Solutions5
Workbooks2

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
AWS
Additional source files 2Solutions/Amazon Web Services/Data Connectors/template_AWS.jsonsource ↗Solutions/Amazon Web Services/Data/Solution_AmazonWebServices.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.