aws securitylake create-custom-log-source

Adds a third-party custom source in Amazon Security Lake, from the Amazon Web Services Region where you want to create a custom source. AWS CLI reference

1 example 4 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

To add a custom source as an Amazon Security Lake source

The following create-custom-log-source example adds a custom source as a Security Lake source in the designated log provider account and the designated Region.

aws securitylake create-custom-log-source --source-name "VPC_FLOW" --event-classes '["DNS_ACTIVITY", "NETWORK_ACTIVITY"]' --configuration '{"crawlerConfiguration": {"roleArn": "arn:aws:glue:us-west-2:123456789012:crawler/E1WG1ZNPRXT0D4"},"providerIdentity": {"principal": "123456789111","externalId": "123456789012"}}'

Identify

--source-nameSpecify the name for a third-party custom source.

--event-classesThe Open Cybersecurity Schema Framework (OCSF) event classes which describes the type of data that the custom source will send to Security Lake.

--configurationThe configuration used for the third-party custom source.

Its output

{
    "source": {
        "attributes": {
            "crawlerArn": "arn:aws:glue:us-west-2:123456789012:crawler/E1WG1ZNPRXT0D4",
            "databaseArn": "arn:aws:glue:us-west-2:123456789012:database/E1WG1ZNPRXT0D4",
            "tableArn": "arn:aws:glue:us-west-2:123456789012:table/E1WG1ZNPRXT0D4"
        },
        "provider": {
            "location": "amzn-s3-demo-bucket--usw2-az1--x-s3",
            "roleArn": "arn:aws:iam::123456789012:role/AmazonSecurityLake-Provider-testCustom2-eu-west-2"
        },
        "sourceName": "testCustom2",
        "sourceVersion": "2.0"
    }
}

For more information, see Adding a custom source in the Amazon Security Lake User Guide.

Options

4 in the AWS CLI reference

--configurationThe configuration used for the third-party custom source.

--event-classesThe Open Cybersecurity Schema Framework (OCSF) event classes which describes the type of data that the custom source will send to Security Lake.

--source-nameSpecify the name for a third-party custom source.

--source-versionSpecify the source version for the third-party custom source, to limit log collection to a specific version of custom data source.