Amazon Security Lake
Connecting Amazon Security Lake logs to your Panther Console
Last updated
Was this helpful?
Connecting Amazon Security Lake logs to your Panther Console
Last updated
Was this helpful?
Panther supports ingesting Amazon Security Lake logs for use in detections and search. Security data centralized in Amazon Security Lake is normalized according to the Open Cybersecurity Schema Framework (OCSF), and Panther supports ingesting all OSCF event classes found here.
To set up this integration, you will configure Panther to be a subscriber of your Security Lake logs.
In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.
Click Create New.
Search for "Amazon Security Lake," then click its tile.
Click Start Setup.
On the Configure page, copy the Panther AWS Account ID and Panther External ID values, and store them in a secure location. You will use them in the next step.
Keep this browser tab open. You will return to it in Step 3, below.
In a new browser tab, log in to the AWS Console and navigate to Amazon Security Lake > Subscribers.
Click Create subscriber.
Enter following values for the following fields:
Subscriber name: A human-friendly name, e.g., Panther.
Account ID: The Panther AWS Account ID you copied in the previous step.
External ID: The Panther External ID you copied in the previous step.
Data Access: Select S3.
S3 Notification type: Select SQS Queue.
Log and event sources: Select all applicable sources, and ensure the Version for each is 1.0.
Click Create.
Click the name of the subscriber you just created.
Copy the AWS role ARN and Subscription endpoint values, and store them in a secure location. You will use them in the next step.
Return to your Panther Console browser tab.
On the Configure page, enter values for the following fields:
Name: A human-friendly name for your source, e.g., Amazon Security Lake.
AWS Role ARN: The role ARN you generated in the previous step.
Subscription endpoint: The SQS queue ARN you generated in the previous step.
Click Setup.
You will be directed to a success screen:
You can optionally enable one or more Detection Packs.
The Trigger an alert when no events are processed setting defaults to YES. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period of time. The timeframe is configurable, with a default of 24 hours.
Panther supports ingesting Amazon Security Lake logs with each of the OCSF schemas listed on this OCSF page.
