In some cases, your CloudWatch logs may not match the format accepted by Microsoft Sentinel - .csv file in a GZIP format without a header. In this article, you use a lambda function (view the source code) within the Amazon Web Services (AWS) environment to send CloudWatch events to an S3 bucket, and convert the format to the accepted format.
Create a Lambda function to send CloudWatch events to an S3 bucket
Prerequisites
None
Create the lambda function
The lambda function uses Python 3.9 runtime and x86_64 architecture.
In the AWS Management Console, select the lambda service.
Select Create function.
Type a name for the function and select Python 3.9 as the runtime and x86_64 as the architecture.
Select Create function.
Under Choose a layer, select a layer and select Add.
Select Permissions, and under Execution role, select Role name.
Under Permissions policies, select Add permissions > Attach policies.
Search for the AmazonS3FullAccess and CloudWatchLogsReadOnlyAccess policies and attach them.
Return to the function, select Code, and paste the code link under Code source.
The default values for the parameters are set using environment variables. If necessary, you can manually adjust these values directly in the code.
Select Deploy, and then select Test.
Create an event by filling in the required fields.
Select Test to see how the event appears in the S3 bucket.
