Skip to content

Commit

Permalink
Commit changes made by code formatters
Browse files Browse the repository at this point in the history
  • Loading branch information
github-actions[bot] committed Jun 18, 2024
1 parent a322229 commit 376edf6
Showing 1 changed file with 1 addition and 2 deletions.
3 changes: 1 addition & 2 deletions runbooks/source/logs-to-soc-cortex-xsiam.html.md.erb
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ We are planning to push the following logs in the coming sprints. [Epic found he

## 1. Cloudtrail logs
### Architecture
We have followed Palo Alto's documentation on implementation to allow [Cortex XSIAM to injest logs from Cloudtrail].
We have followed Palo Alto's documentation on implementation to allow [Cortex XSIAM to injest logs from Cloudtrail].

Cloudtrail logs are written to a S3 bucket. The implementation consist of enabling the S3 bucket to trigger event notifications to an SQS queue. An IAM user with access keys has been created to grant Cortex XSIAM to accesse the SQS queue and recieves all the log messages. The terraform code for this implementation is found in the [cloud-platform-terraform-infrastructure] repository.

Expand All @@ -34,7 +34,6 @@ To be implemented
## 4. EKS logs
To be implemented


[Cortex XSIAM to injest logs from Cloudtrail]: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/Ingest-Audit-Logs-from-AWS-Cloud-Trail
[Epic found here]: https://github.com/ministryofjustice/cloud-platform/milestone/35
[cloud-platform-terraform-infrastructure]: https://github.com/ministryofjustice/cloud-platform-infrastructure/blob/main/terraform/aws-accounts/cloud-platform-aws/account/sqs.tf
Expand Down

0 comments on commit 376edf6

Please sign in to comment.