Hi,
I want to ingest S3 bucket logs using BindPlane. Is it possible to do this without an agent, using only a configuration that specifies the source and destination? If so, how can I handle authentication on the AWS S3 side?
If it's not possible to do it without an agent:
When using an agent to ingest S3 logs, do I need to create an IAM user with the necessary permissions and store the credentials in the agent for authentication?
Hi!
Bindplane has the following documentation to ingest from an S3 bucket : https://bindplane.com/docs/resources/sources/aws-s3-event
you will need to create an SQS queue.
Google SecOps already supports this natively, you can either configure an SQS or S3 feed directly in the feeds UI :
https://cloud.google.com/chronicle/docs/administration/feed-management#add-new-feed
Hi! @amithpatil
I’d like to use BindPlane to filter the logs. in order to make that, is there any solution?
Hi! @amithpatil
I’d like to use BindPlane to filter the logs. in order to make that, is there any solution?
@yasinmnk you can use Amazon fire hose if you want to filter the logs before sending it to SecOps s1] along with lambda functions.
If you want to use bindplane, you'll need to filter the logs via a processor r2] and add it between the source and destination
p1] https://cloud.google.com/chronicle/docs/administration/feed-management#setup-aws-firehose
p2] https://bindplane.com/docs/resources/processors/filter-by-regex
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.