Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-aws-cloudtrail

AWS CloudTrail

You can integrate AWS CloudTrail with Sophos XDR so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

AWS CloudTrail product overview

AWS CloudTrail is an AWS service that enables governance, compliance, and operational and risk auditing of an AWS account by recording API activity — including calls made through the AWS Management Console, SDKs, command-line tools, and other AWS services — and delivering an event history that captures the caller identity, time, source IP, request parameters, and response.

What we ingest

Sophos XDR collects AWS CloudTrail logs from an Amazon S3 bucket: you deploy a CloudFormation template that provisions a Lambda function, which forwards CloudTrail log files to Sophos XDR as they are delivered to the bucket. The following log categories are collected:

  • Account and API activity: AWS management and API-call events across AWS services.
  • Console authentication: AWS Management Console sign-in events.
  • S3 data events: Amazon S3 object-level operations.

Event and data types

We ingest the following event and data types from AWS CloudTrail:

  • Account and API activity: AWS API calls and management (control-plane) operations across AWS services, including the caller identity, source IP, request parameters, and response. Normalized to cloud audit telemetry.
  • Console authentication: AWS Management Console sign-in events, including root and IAM user logins and success or failure, with the user and source. Normalized to authentication telemetry.
  • S3 data events: Amazon S3 object-level operations such as PutObject, including the bucket, object, and actor. Normalized to file modification telemetry.

Data provided by this integration

Data provided by AWS CloudTrail gets normalized to the following schemas:

  • auth
  • cloudaudit
  • filemod

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation