Ingest AWS CloudTrail Logs to Microsoft Sentinel
Published: 2022-04-06 17:46:36

[Microsoft Sentinel](https://docs.microsoft.com/en-us/azure/sentinel/) is a Cloud Native _security information and event management_ (SIEM) and _security orchestration, automation, and response_ (SOAR) solution with built-in AI for analytics. It removes the cost and complexity of achieving the central and focused near real time view of the active threats in your environment.

The Data connectors page, accessible from the Microsoft Sentinel navigation menu, shows the full list of connectors that Microsoft Sentinel provides, and their status. We will use the `Amazon Web Services S3` connector to pull AWS CloudTrail logs into Microsoft Sentinel. 


![Microsoft Sentinel Connector](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e38ddjb9vnk56n5nt489.png)

For this connector to work we need to grant Microsoft Sentinel access to the AWS CloudTrail logs that we configured previously. By setting up this connector there is a trust relationship established between Amazon Web Services and Microsoft Sentinel. This can be achieved by creating a role that gives permission to Microsoft Sentinel to access CloudTrail logs.

In the previous [blog](https://dev.to/aws-builders/configuring-amazon-sqs-queues-using-terraform-9g2) we had already created that role with necessary permission to access CloudTrail logs. 

The Role ARN and SQS Queue url in output will be handy for the connector configuration-

```
Changes to Outputs:
  + sentinelrole = "arn:aws:iam::123456789012:role/AzureSentinelRole"
  + sqsurl       = "https://sqs.ap-southeast-1.amazonaws.com/123456789012/awscbcloudtrailqueue"
```

On the Microsoft Sentinel blade navigate to Data connectors. Select **`Amazon Web Services S3`** and in the details page click on **`Open connector page`** to configure  connector.

![S3 Connector](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v3r7aiti13ojy9ap7841.png)

| Field      | Value | 
| :---        |    ----:    | 
| ROLE ARN    | arn:aws:iam::123456789012:role/AzureSentinelRole       |
| SQS URL     | https://sqs.ap-southeast-1.amazonaws.com/123456789012/awscbcloudtrailqueue        | 

Terraform code for automating the whole setup on AWS side can be found [here](https://github.com/sujaypillai/awscb001)

You could check the status of the connector from the Connector page as shown below:

![Connector Status](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n09bt8lzc3j9zx3l797v.png)

Click on **`AWSCloudTrail`** or navigate to the Log Analytics workspace to see the CloudTrail logs from your AWS Account

![CloudTrail query](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/newdkado7jz0bopj6znp.png)

On successful connection Microsoft Sentinel creates a table called **`AWSCloudTrail`** with the columns as documented [here](https://docs.microsoft.com/en-us/azure/azure-monitor/reference/tables/AWSCloudTrail)

We can write custom queries using [Kusto Query](https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/) on top of this data and return result as shown below:


![KustoQuery](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1wcysymgm91ijl6ej6sy.png)

Microsoft Sentinel allows you to create custom workbooks across your data, and also comes with built-in workbook templates to allow you to quickly gain insights across your data. Once such workbook is `AWS S3 Workbook` built by Microsoft Sentinel Community.


![SentinelWorkbook](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wamgnw2tcbzk66hehqgo.png)


![SentinelWorkbook1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ja0q3g026lvglnwklgyu.png)

**SentinelHealth** data table provides insights on health drifts, such as latest failure events per connector, or connectors with changes from success to failure states, which you can use to create alerts and other automated actions.


![SentinelHealth](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dxif4q2rexl3tmr7hev7.png)