Échangeons
← Sentinel Explorer
↳ Source GitHubConnecteur

Amazon Web Services S3

Voir sur GitHub ↗Fichier original ↗

Description

This connector allows you to ingest AWS service logs, collected in AWS S3 buckets, to Microsoft Sentinel. The currently supported data types are: * AWS CloudTrail * VPC Flow Logs * AWS GuardDuty * AWS CloudWatch For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2218883&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).
Statut déclaré
2
Auteur / éditeur déclaré
Amazon

Sources déclarées

Métadonnées du fichier source. Aucune dépendance déduite du KQL.

Types de données

AWSGuardDutyAWSVPCFlowAWSCloudTrailAWSCloudWatch

Permissions déclarées

write permission.
Workspace
Workspace
Environment
you must have the following AWS resources defined and configured: S3, Simple Queue Service (SQS), IAM roles and permissions policies, and the AWS services whose logs you want to collect.

Instructions du connecteur

Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.

1. Set up your AWS environment
There are two options for setting up your AWS environment to send logs from an S3 bucket to your Log Analytics Workspace:
Setup with PowerShell script (recommended)
Run script to set up the environment
External ID (Workspace ID)
Manual Setup
Follow the instruction in the following link to set up the environment: [Connect AWS S3 to Microsoft Sentinel](https://aka.ms/AWSS3Connector)
2. Add connection

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Règles analytiques25
Anomaly found in Network Session Traffic (ASIM Network Session schema)MediumAWSCloudTrail - Changes to Amazon VPC settingsLowAWSCloudTrail - Changes to AWS Elastic Load Balancer security groupsLowAWSCloudTrail - Changes to AWS Security Group ingress and egress settingsLowAWSCloudTrail - Changes to internet facing AWS RDS Database instancesLowAWSCloudTrail - Failed Attempts to Change AWS CloudTrail LogsLowAWSCloudTrail - Full Admin policy created and then attached to Roles, Users or GroupsMediumAWSCloudTrail - Login to AWS Management Console without MFALowAWSCloudTrail - Monitor AWS Credential abuse or hijackingLowAWSCloudTrail - NRT Login to AWS Management Console without MFALowAWSCloudTrail - Successful Tampering with AWS CloudTrail LogsHighAWSGuardDuty - GuardDuty AlertMediumCross-Cloud Suspicious Compute resource creation in GCPLowCross-Cloud Unauthorized Credential Access Detection From AWS RDS LoginMediumDetect port misuse by anomaly based detection (ASIM Network Session schema)MediumDetect port misuse by static threshold (ASIM Network Session schema)MediumExcessive number of failed connections from a single source (ASIM Network Session schema)MediumGreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)MediumNetwork Port Sweep from External Network (ASIM Network Session schema)HighPort scan detected (ASIM Network Session schema)MediumPossible Phishing with CSL and Network SessionsMediumPotential beaconing activity (ASIM Network Session schema)LowTI Map IP entity to Network Session Events (ASIM Network Session schema)MediumTI map IP entity to Network Session Events (ASIM Network Session schema)MediumUnauthorized user access across AWS and AzureMedium
Solutions1
Workbooks1

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Identifiant source
AwsS3
Autres fichiers source 2Solutions/Amazon Web Services/Data Connectors/template_AwsS3.jsonsource ↗Solutions/Amazon Web Services/Data/Solution_AmazonWebServices.jsonsolution-membership ↗
GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.