Chronicle Integration with AWS S3 Bucket and I have IOC server in S3 BUCKET

Hi ​@itsbirju ,

For the high level steps, you will need to ;

1. Prepare the pre-requisites listed here on AWS for the S3 bucket ACL.
2. Place the 2 IP ranges listed in this section in the allow list for these buckets.
3. Go to SIEM > Settings > Available Log Types . Lookup for your IOC product name, if it does not exist; Click on Request a Log Type to create a new log type.
4. Go to the SIEM, and add a feed with the steps listed here, but make sure you are choosing

   Amazon S3 V2 and your correct log_type in step 3, then use the access key and secret generated in Step 1.

5. Finish the feed setup and test the connection.

6. If you get the connection successful notification message. Then you can start ingesting the logs.

7. The logs will require a custom parser mostly, in your custom parser you will need to use the IOC fields listed here. You can also use a sample parser/mappings as a reference, for example Anomali Threat IOCs field mappings page can show you the main UDM fields -in the second column- used. The main fields are all under entity.metadata.

If you could share with me a sample IOC message, I could try to build a sample custom parser as a demo for that case.