Support for Custom Log in Amazon Web Services S3 Data Connector

[miszczu]

When running ./ConfigAwsConnector.ps1 script it is possible to create a configuration for custom AWS logs:

To begin you will choose the AWS logs to configure.

Please enter the AWS log type to configure (VPC, CloudTrail, GuardDuty, CloudWatch, CustomLog): CustomLog

The script executes successfully, creating the relevant SQS queue and outputting settings for the Amazon Web Services (AWS) S3 data connector:

Use the values below to configure the Amazon Web Service S3 data connector in the Azure Sentinel portal.

Role Arn: arn:aws:iam::***:role/***
Sqs Url: https://sqs.***.amazonaws.com/***/***

However, when attempting to configure the data connector in Microsoft Sentinel, there is no option available for "CustomLog."

Question:
How can I connect Microsoft Sentinel to AWS custom log data? The available documentation seems to lack guidance for this specific scenario.

[v-sudkharat]

Hi @miszczu, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates. Thanks!

[v-sudkharat]

Hi @miszczu,

Sorry for the delayed response.

We had a discussion with the concerned team regarding this issue. The custom logs for the Data Connector blade are currently in private preview. The team is planning to make it GA, but at the moment, we can't provide an exact ETA.

However, since you have reached out, we can share some steps that will help you access those custom logs in the Data Connector, which is still in private preview.
Kindly share your contact email with us so we can reach out to you.

Please note: The connector is still in private preview and may not be supported by the team in case of any issues or consequences that arise.

Closing this issue from GitHub. If you still need support for this issue, feel free to re-open it any time. Thank you for your co-operation.

[miszczu]

Hi @v-sudkharat,

please share the steps for setting this up to following email address: <redacted>

[v-sudkharat]

@miszczu, Unable to send steps in your shared mail id, due to org compliance, kindly, share another id.

[miszczu]

@v-sudkharat Oh right, please use following address in that case: <redacted>