From 1e4d10abea7415c148868603ce4f87eb32868e19 Mon Sep 17 00:00:00 2001 From: Sebastien Quioc Date: Tue, 16 Jan 2024 11:15:36 +0100 Subject: [PATCH 1/2] fix(AWS): update the connectors to use for the AWS FlowLogs integration --- .../collect/integrations/cloud_and_saas/aws/aws_flow_logs.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/xdr/features/collect/integrations/cloud_and_saas/aws/aws_flow_logs.md b/docs/xdr/features/collect/integrations/cloud_and_saas/aws/aws_flow_logs.md index 2fff90e2aa..1e466206a9 100644 --- a/docs/xdr/features/collect/integrations/cloud_and_saas/aws/aws_flow_logs.md +++ b/docs/xdr/features/collect/integrations/cloud_and_saas/aws/aws_flow_logs.md @@ -40,7 +40,9 @@ Go to the [intake page](https://app.sekoia.io/operations/intakes) and create a n To start to pull events, you have to: -1. Go to the [playbook page](https://app.sekoia.io/operations/playbooks) and create a new playbook with the [AWS Fetch new logs on S3 connector](../../../../automate/library/aws.md#fetch-new-logs-on-s3). +1. Go to the [playbook page](https://app.sekoia.io/operations/playbooks) and create a new playbook with: + - the [AWS Fetch new Flowlogs on S3 connector](../../../../automate/library/aws.md#fetch-new-flowlogs-on-s3) for plain text files + - the [AWS Fetch new FlowLogs Parquet records on S3 connector](../../../../automate/library/aws.md#fetch-new-flowlogs-parquet-records-on-s3) for parquet files 2. Set up the module configuration with the [AWS Access Key](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html), the secret key and the region name. Set up the trigger configuration with the name of the SQS queue and the intake key, from the intake previously created. 3. Start the playbook and enjoy your events. From 51237f39148b6e4c9d67938c6f21d83539c05a47 Mon Sep 17 00:00:00 2001 From: Sebastien Quioc Date: Tue, 16 Jan 2024 11:24:01 +0100 Subject: [PATCH 2/2] fix(AWS): point out that gzipped files are supported --- .../collect/integrations/cloud_and_saas/aws/aws_flow_logs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/xdr/features/collect/integrations/cloud_and_saas/aws/aws_flow_logs.md b/docs/xdr/features/collect/integrations/cloud_and_saas/aws/aws_flow_logs.md index 1e466206a9..72a73efec4 100644 --- a/docs/xdr/features/collect/integrations/cloud_and_saas/aws/aws_flow_logs.md +++ b/docs/xdr/features/collect/integrations/cloud_and_saas/aws/aws_flow_logs.md @@ -41,7 +41,7 @@ Go to the [intake page](https://app.sekoia.io/operations/intakes) and create a n To start to pull events, you have to: 1. Go to the [playbook page](https://app.sekoia.io/operations/playbooks) and create a new playbook with: - - the [AWS Fetch new Flowlogs on S3 connector](../../../../automate/library/aws.md#fetch-new-flowlogs-on-s3) for plain text files + - the [AWS Fetch new Flowlogs on S3 connector](../../../../automate/library/aws.md#fetch-new-flowlogs-on-s3) for plain text files (gzipped included) - the [AWS Fetch new FlowLogs Parquet records on S3 connector](../../../../automate/library/aws.md#fetch-new-flowlogs-parquet-records-on-s3) for parquet files 2. Set up the module configuration with the [AWS Access Key](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html), the secret key and the region name. Set up the trigger configuration with the name of the SQS queue and the intake key, from the intake previously created. 3. Start the playbook and enjoy your events.