Configuring an Amazon AWS CloudTrail log source by using the Amazon Web Services protocol and CloudWatch Logs

If you want to collect AWS CloudTrail logs from Amazon CloudWatch logs, configure a log source on the QRadar Console so that Amazon AWS CloudTrail can communicate with QRadar by using the Amazon Web Services protocol.

Procedure

  1. Creating an Identity and Access (IAM) user in the AWS Management Console
  2. Creating a log group in Amazon CloudWatch Logs to retrieve logs in QRadar
  3. Configure Amazon AWS CloudTrail to send log files to CloudWatch Logs
  4. Configuring security credentials for your AWS user account
  5. Adding an Amazon AWS CloudTrail log source by using the Amazon Web Services protocol and CloudWatch Logs