Get in touch
← Sentinel Explorer
↳ GitHub sourceConnector

Amazon Web Services S3

View on GitHub ↗Original file ↗

Description

This connector allows you to ingest AWS service logs, collected in AWS S3 buckets, to Microsoft Sentinel. The currently supported data types are: * AWS CloudTrail * VPC Flow Logs * AWS GuardDuty * AWS CloudWatch For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2218883&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).
Declared status
2
Declared author / publisher
Amazon

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

AWSGuardDutyAWSVPCFlowAWSCloudTrailAWSCloudWatch

Declared permissions

write permission.
Workspace
Workspace
Environment
you must have the following AWS resources defined and configured: S3, Simple Queue Service (SQS), IAM roles and permissions policies, and the AWS services whose logs you want to collect.

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

1. Set up your AWS environment
There are two options for setting up your AWS environment to send logs from an S3 bucket to your Log Analytics Workspace:
Setup with PowerShell script (recommended)
Run script to set up the environment
External ID (Workspace ID)
Manual Setup
Follow the instruction in the following link to set up the environment: [Connect AWS S3 to Microsoft Sentinel](https://aka.ms/AWSS3Connector)
2. Add connection

Related content

Links established from declared identifiers and solution manifests.

Analytics rules25
Anomaly found in Network Session Traffic (ASIM Network Session schema)MediumAWSCloudTrail - Changes to Amazon VPC settingsLowAWSCloudTrail - Changes to AWS Elastic Load Balancer security groupsLowAWSCloudTrail - Changes to AWS Security Group ingress and egress settingsLowAWSCloudTrail - Changes to internet facing AWS RDS Database instancesLowAWSCloudTrail - Failed Attempts to Change AWS CloudTrail LogsLowAWSCloudTrail - Full Admin policy created and then attached to Roles, Users or GroupsMediumAWSCloudTrail - Login to AWS Management Console without MFALowAWSCloudTrail - Monitor AWS Credential abuse or hijackingLowAWSCloudTrail - NRT Login to AWS Management Console without MFALowAWSCloudTrail - Successful Tampering with AWS CloudTrail LogsHighAWSGuardDuty - GuardDuty AlertMediumCross-Cloud Suspicious Compute resource creation in GCPLowCross-Cloud Unauthorized Credential Access Detection From AWS RDS LoginMediumDetect port misuse by anomaly based detection (ASIM Network Session schema)MediumDetect port misuse by static threshold (ASIM Network Session schema)MediumExcessive number of failed connections from a single source (ASIM Network Session schema)MediumGreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)MediumNetwork Port Sweep from External Network (ASIM Network Session schema)HighPort scan detected (ASIM Network Session schema)MediumPossible Phishing with CSL and Network SessionsMediumPotential beaconing activity (ASIM Network Session schema)LowTI Map IP entity to Network Session Events (ASIM Network Session schema)MediumTI map IP entity to Network Session Events (ASIM Network Session schema)MediumUnauthorized user access across AWS and AzureMedium
Solutions1
Workbooks1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
AwsS3
Additional source files 2Solutions/Amazon Web Services/Data Connectors/template_AwsS3.jsonsource ↗Solutions/Amazon Web Services/Data/Solution_AmazonWebServices.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.