Prerequisites

• Ensure you have the necessary permissions:

  • In Cortex, you must have a Cortex role with Data Sources - View & Edit permissions (to add/configure cloud accounts in Cortex). This role is included in the following built-in roles: Instance Administrator, Security Admin, and IT Admin.
  • In AWS, ensure the AWS CLI is configured with permissions to create IAM roles/policies, SQS queues, and SNS subscriptions.
• You must have the following set up in your AWS account:

  • CloudTrail: The AWS service that records everything that happens in your account. The CloudTrail must already be turned on and running.
  • S3 Bucket: A cloud storage folder where CloudTrail saves its log files. The S3 bucket must already exist and CloudTrail must already be configured to write logs into it.
  • SNS: A notification service that forwards messages from CloudTrail to SQS. The SNS topic must already exist and CloudTrail must already be configured to send notifications to it.

Note: For audit log collection to function as expected, the CloudTrail, S3 bucket and SNS topic must be in the same management account.