From 376edf67a12b4ef8c5d9418ff2b280c9ff003941 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 18 Jun 2024 16:13:14 +0000 Subject: [PATCH] Commit changes made by code formatters --- runbooks/source/logs-to-soc-cortex-xsiam.html.md.erb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/runbooks/source/logs-to-soc-cortex-xsiam.html.md.erb b/runbooks/source/logs-to-soc-cortex-xsiam.html.md.erb index 21c9ec84..e6e5b9ab 100644 --- a/runbooks/source/logs-to-soc-cortex-xsiam.html.md.erb +++ b/runbooks/source/logs-to-soc-cortex-xsiam.html.md.erb @@ -20,7 +20,7 @@ We are planning to push the following logs in the coming sprints. [Epic found he ## 1. Cloudtrail logs ### Architecture -We have followed Palo Alto's documentation on implementation to allow [Cortex XSIAM to injest logs from Cloudtrail]. +We have followed Palo Alto's documentation on implementation to allow [Cortex XSIAM to injest logs from Cloudtrail]. Cloudtrail logs are written to a S3 bucket. The implementation consist of enabling the S3 bucket to trigger event notifications to an SQS queue. An IAM user with access keys has been created to grant Cortex XSIAM to accesse the SQS queue and recieves all the log messages. The terraform code for this implementation is found in the [cloud-platform-terraform-infrastructure] repository. @@ -34,7 +34,6 @@ To be implemented ## 4. EKS logs To be implemented - [Cortex XSIAM to injest logs from Cloudtrail]: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/Ingest-Audit-Logs-from-AWS-Cloud-Trail [Epic found here]: https://github.com/ministryofjustice/cloud-platform/milestone/35 [cloud-platform-terraform-infrastructure]: https://github.com/ministryofjustice/cloud-platform-infrastructure/blob/main/terraform/aws-accounts/cloud-platform-aws/account/sqs.tf