AWS Automation and Collection

Use Amazon data for Cortex AgentiX.

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

Integrate with Amazon Web Services (AWS) to automate and orchestrate security operations across AWS services. This connector runs automation and remediation commands, fetches issues, ingests threat intelligence indicators, and retrieves secrets across services such as EC2, IAM, GuardDuty, Security Hub, S3, Lambda, CloudTrail, CloudWatch Logs, Organizations, WAF, EKS, DynamoDB, and Secrets Manager.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• Amazon DynamoDB: This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS - AccessAnalyzer: Amazon Web Services IAM Access Analyzer. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS - ACM: Amazon Web Services Certificate Manager Service (ACM). This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS - Athena - Beta: This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS - CloudTrail: Amazon Web Services CloudTrail. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS - CloudWatchLogs: Amazon Web Services CloudWatch Logs (logs). This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS - EC2: Amazon Web Services Elastic Compute Cloud (EC2). This connector is available with any active Cortex XSIAM, Cortex Cloud Runtime Security, or Cortex AgentiX license.
• AWS - GuardDuty: Amazon Web Services Guard Duty Service (gd). This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS - IAM: Amazon Web Services Identity and Access Management (IAM). This connector is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud, Cortex Cloud Runtime Security, Cortex XDR, or Cortex AgentiX license.
• AWS - IAM Identity Center: Amazon Web Services IAM Identity Center. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS - Lambda: Amazon Web Services Serverless Compute service (lambda). This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS - Organizations: Manage Amazon Web Services accounts and their resources. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS - Route53: Amazon Web Services Managed Cloud DNS Service. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS - S3: Amazon Web Services Simple Storage Service (S3). This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS - Security Hub: Amazon Web Services Security Hub Service. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS - SNS: Amazon Web Services Simple Notification Service (SNS). This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS - SQS: Amazon Web Services Simple Queuing Service. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS - System Manager: AWS Systems Manager is the operations hub for your AWS applications and resources and a secure end-to-end management solution for hybrid cloud environments that enables safe and secure operations at scale. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS Feed: This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS Network Firewall: AWS Network Firewall is a stateful, managed network firewall and intrusion detection and prevention service for Amazon Virtual Private Cloud (Amazon VPC). This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS Sagemaker: AWS Sagemaker - Demisto Phishing Email Classifier. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS Security Lake: Amazon Security Lake is a fully managed security data lake service. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS-EKS: The AWS EKS integration allows for the management and operation of Amazon Elastic Kubernetes Service (EKS) clusters. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS-ILM: Integrate with AWS's services to execute CRUD and Group operations for employee lifecycle processes. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AwsSecretsManager: AWS Secrets Manager helps you to securely encrypt, store, and retrieve credentials for your databases and other services. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS-SNS-Listener: Amazon Simple Notification Service (SNS) is a managed service that provides message delivery from publishers to subscribers. This connector is available with any active Cortex XSIAM or Cortex AgentiX license.
• AWS-WAF: Amazon Web Services Web Application Firewall (WAF). This connector is available with any active Cortex XSIAM or Cortex AgentiX license.

To configure this connector, follow the steps outlined in the configuration wizard.