| Vendor | AWS CloudTrail |
|---|---|
| Collection Method | API |
| Query Syntax: event.provider | CloudTrail |
| Billable Sources Calculation | 1 Source Per Integration. |
| Additional Information | Can be configured at both the account and organization level. |
To create the integration between Huntress and AWS CloudTrail, follow these steps:
- From the Source Management -> Categories page, select "View Details" on the AWS CloudTrail tile.
- Select the green "+Add" button in the top right.
Enter a name for the integration and then a description if desired.
Select Save
- Download the CloudFormation template file by right clicking the link and selecting "Save Link As...".
- Select the link, "navigate to the CloudFormation Stacks create page" to open a new tab on the AWS console. Sign in as an account owner.
- Upload the template file downloaded in step 6.
- Enter a Stack name. Leave the BucketName string empty.
- Select Next.
- Select Next under the Configure Stack Options page, no changes are necessary here.
- Select Submit in the Review and Complete page.
- Confirm the status in the Huntress AWS CloudTrail configuration page updates to show "Subscribed".
- Within 10-20 minutes, logs should begin showing in the Huntress SIEM.