Using an existing AWS CloudTrail

Find out how to add an environment using an existing CloudTrail.

1. In AWS, go to your CloudTrail dashboard and copy your export bucket name.

   This is used to configure the SNS topic and used in Sophos Cloud Optix later.

2. You can also copy the bucket prefix to use later. Bucket prefixes are optional, see step 5 in Creating a Trail for more detail.

   

3. In AWS, create an SNS topic in same region where your S3 bucket is used to export CloudTrail, or edit an existing SNS topic.
4. Copy the name of this SNS topic.
5. In the JSON editor, specify the access policy as follows:
   • Replace the Resource value with the SNS ARN you are using.
   • Replace the bucket name in Condition with the CloudTrail bucket name you copied earlier.

   

   In AWS the access policy is shown as optional, but it isn't optional with Sophos Cloud Optix. It is required to set up S3 bucket notifications.

6. Save the SNS topic.

7. In AWS, go to your S3 bucket.
8. To set up a new notification event, select Properties > Events > Add notification.

   Check that you don't have any existing notifications set on CloudTrail create events.

9. Enter a name for the notification event.
10. Select All object create events
11. Enter : json.gz as the Suffix value
12. To create your Prefix value, enter the bucket prefix you copied earlier, then /AWSLogs/, then your account ID, then /CloudTrail/.

    The format must be: <Bucket prefix>/AWSLogs/<AccountId>/Cloudtrail/

    If you are using an AWS Organizations managed CloudTrail, or you are exporting CloudTrails from multiple accounts into a single account. In those cases you must create a separate event for each account ID.

13. Set Send to to SNS and use the name of the SNS topic you created earlier.

    

14. Click Save.