> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/ingest-aws-api-gateway.md).
# Ingest AWS API Gateway
Ingest AWS API Gateway logs into Cortex XSIAM for API traffic analysis, threat detection, and risk assessment.
Integrate AWS API Gateway with Cortex XSIAM to begin scanning the APIs for potential threats and vulnerabilities.
Settings in Cortex XSIAM
In Cortex XSIAM, set up the **AWS API Gateway** data source to integrate with the AWS API Gateway.
1. From **Settings** → **Data Sources** , click  and search for **AWS API Gateway** and then click **Connect** or **Connect Another Instance**.
2. In the **AWS API Collector** wizard, enter a relevant name and click **Create and Proceed**.
3. Copy the key and save it for later.
Note
You must generate a new key if you did not save.
4. Click **Close**.
Settings in AWS Management Console
Configure the settings in the AWS Management Console to integrate with Cortex XSIAM:
1. Log in to the [AWS Management Console](https://aws.amazon.com/console/).
2. In AWS Management Console, navigate to **API Gateway**.
1. Expand the left-hand menu of the API project.
2. Go to **Settings** → **Logging** and click **Edit**. Verify that the **CloudWatch log role ARN** is filled.
3. Click **Stages** and from **Stages**, select the relevant stage.
4. From **Logs and Tracing**, click **Edit** and configure the following:
* **CloudWatch Logs**: Select **Errors and info logs**
* Select **Data tracing**
* Select **Detailed metrics**
5. Click **Save**.
This creates a unique log group inside CloudWatch.
3. Open CloudWatch in another window by typing **CloudWatch** in the search bar.
1. Go to **Logs** → **Log groups** and search for the log group just created.
The group name follows the following format: `“API-Gateway-Execution-Logs_/”`
2. Click the log group, and from the **Log group details**, copy the **ARN**.
4. Return to **Edit logs and tracing**, go to **enable the custom access logging** , and paste the ARN without the \* in the **Access log destination ARN** field.
Example 45.
ARN: `arn:aws:logs:us-east-1:123456789012:log-group:API-Gateway-Execution-Logs_153tp249k2/Prod:*`
Paste in **Access log destination ARN**: `arn:aws:logs:us-east-1:123456789012:log-group:API-Gateway-Execution-Logs_153tp249k2/Prod`
5. In **Log format**, type the following and click **Save**:
```programlisting
($context.requestId) accountID: $context.accountId;
requestTimeMs: $context.requestTimeEpoch;
path: $context.path;
region: us-east-1;
apiID: $context.apiId;
stage: $context.stage;
extensionVersion: 1.0
```
6. Click **Create Firehose stream**.
1. Configure the following:
* **Source**: **Direct PUT**
* **Destination**: **HTTP Endpoint**
* **Firehose stream name**: Add a relevant name.
2. In **Destination settings**, configure the following:
* **HTTP endpoint URL** : Add the API URL from Cortex XSIAM.
* **Authentication**: Select **Use access key**.
* **Access key**: Paste the generated token from **AWS API Gateway**.
* **Content encoding**: Select **GZIP**.
3. In **Backup settings**, configure the following:
* **Source record backup in Amazon S3**: select **Failed date only**.
* **S3 backup bucket**: select a bucket or enter a bucket URI.
4. Click **Create**.
It takes up to 5 minutes for the stream to be activated.
7. Refer to [Subscription filters with Amazon Data Firehose](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.html#FirehoseExample). To create an IAM Role and provide CloudWatch with the appropriate permissions for the streaming, refer to steps 8-11.
After the Data Firehose delivery stream is active and you have created the IAM role, you can create the CloudWatch Logs subscription filter. The subscription filter immediately starts the flow of real-time log data from the chosen log group to your Amazon Data Firehose delivery stream:
```programlisting
aws logs put-subscription-filter \
--log-group-name "" \
--filter-name "" \
--filter-pattern "" \
--destination-arn "arn:aws:firehose:region:123456789012:deliverystream/" \
--role-arn "arn:aws:iam:::role/"
```
Important
Leave –filter-pattern empty as displayed above.
After you create the filter, go back to **Data Sources** → **AWS API Gateway** to see the logs starting to come in.
Note
If no logs are showing, send some API requests on Postman or CURL.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/ingest-aws-api-gateway.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.