In some cases, your CloudWatch logs may not match the format accepted by Microsoft Sentinel - .csv file in a GZIP format without a header. In this article, you use a lambda function within the Amazon Web Services (AWS) environment to send CloudWatch events to an S3 bucket, and convert the format to the accepted format.
Create a Lambda function to send CloudWatch events to an S3 bucket
Prerequisites
None
Create the lambda function
The lambda function uses Python 3.9 runtime and x86_64 architecture.
In the AWS Management Console, select the lambda service.
Select Create function.
Type a name for the function and select Python 3.9 as the runtime and x86_64 as the architecture.
Select Create function.
Under Choose a layer, select a layer and select Add.
Select Permissions, and under Execution role, select Role name.
Under Permissions policies, select Add permissions > Attach policies.
Search for the AmazonS3FullAccess and CloudWatchLogsReadOnlyAccess policies and attach them.
Return to the function, select Code, and paste the code link under Code source.
Fill the parameters as required.
Select Deploy, and then select Test.
Create an event by filling in the required fields.
Select Test to see how the event appears in the S3 bucket.
Feedback
Kommer snart: I hele 2024 udfaser vi GitHub-problemer som feedbackmekanisme for indhold og erstatter det med et nyt feedbacksystem. Du kan få flere oplysninger under: https://aka.ms/ContentUserFeedback.
Indsend og få vist feedback om