Configuring an Amazon AWS CloudTrail data source by using the Amazon AWS S3 REST API connector

If you want to collect AWS CloudTrail logs from Amazon S3 buckets, configure a data source in QRadar® Log Insights so that Amazon AWS CloudTrail can communicate with QRadar Log Insights by using the Amazon AWS S3 REST API connector.

Procedure

Choose which method you will use to configure an Amazon AWS CloudTrail data source by using the Amazon AWS S3 REST API connector.

Configuring an Amazon AWS CloudTrail log source that uses an S3 bucket with an SQS queue
Configuring an Amazon AWS CloudTrail data source that uses an S3 bucket with a directory prefix