+7Hi,
I want to ingest S3 bucket logs using BindPlane. Is it possible to do this without an agent, using only a configuration that specifies the source and destination? If so, how can I handle authentication on the AWS S3 side?
If it's not possible to do it without an agent:
When using an agent to ingest S3 logs, do I need to create an IAM user with the necessary permissions and store the credentials in the agent for authentication?
+3Hi!
Bindplane has the following documentation to ingest from an S3 bucket : https://bindplane.com/docs/resources/sources/aws-s3-event
you will need to create an SQS queue.
Google SecOps already supports this natively, you can either configure an SQS or S3 feed directly in the feeds UI :
https://cloud.google.com/chronicle/docs/administration/feed-management#add-new-feed
+7Hi! @amithpatil
I’d like to use BindPlane to filter the logs. in order to make that, is there any solution?
+3Hi! @amithpatil
I’d like to use BindPlane to filter the logs. in order to make that, is there any solution?
@yasinmnk you can use Amazon fire hose if you want to filter the logs before sending it to SecOps [1] along with lambda functions.
If you want to use bindplane, you'll need to filter the logs via a processor [2] and add it between the source and destination
[1] https://cloud.google.com/chronicle/docs/administration/feed-management#setup-aws-firehose
[2] https://bindplane.com/docs/resources/processors/filter-by-regex
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
