# Amazon Security Lake

## Overview

Panther supports ingesting [Amazon Security Lake](https://aws.amazon.com/security-lake/) logs for use in detections and search. Security data centralized in Amazon Security Lake is normalized according to the [Open Cybersecurity Schema Framework (OCSF)](https://ocsf.io/), and Panther supports ingesting [all OSCF event classes found here](https://schema.ocsf.io/).

To set up this integration, you will configure Panther to be a [subscriber](https://docs.aws.amazon.com/security-lake/latest/userguide/subscriber-management.html) of your Security Lake logs.

## How to onboard Amazon Security Lake logs to Panther

### Step 1: Begin creating an Amazon Security Lake source in Panther

1. In the left-hand navigation bar of your Panther Console, click **Configure** > **Log Sources**.
2. Click **Create New**.
3. Search for "Amazon Security Lake," then click its tile.
4. Click **Start Setup**.
5. On the **Configure** page, copy the **Panther AWS Account ID** and **Panther External ID** values, and store them in a secure location. You will use them in the next step.
   * Keep this browser tab open. You will return to it in Step 3, below.

### Step 2: Create a new Subscriber in Amazon Security Lake

1. In a new browser tab, log in to the AWS Console and navigate to **Amazon Security Lake** > **Subscribers**.
2. Click **Create subscriber**.
3. Enter following values for the following fields:
   * **Subscriber name**: A human-friendly name, e.g., `Panther`.
   * **Account ID**: The **Panther AWS Account ID** you copied in the previous step.
   * **External ID**: The **Panther External ID** you copied in the previous step.
   * **Data Access**: Select **S3**.
   * **S3 Notification type**: Select **SQS Queue.**
   * **Log and event sources**: Select all applicable sources, and ensure the `Version` for each is `1.0`.\\

     <figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-16dcd53f1529ba57c5fe7c58ab470a76635b9fa8%2Flog%3Aevent%20sources.png?alt=media" alt="A &#x22;Log and event sources&#x22; section is shown, containing a handful of rows with AWS services. A &#x22;Version&#x22; column shows 1.0 for all rows."><figcaption></figcaption></figure>
4. Click **Create**.
5. Click the name of the subscriber you just created.
6. Copy the **AWS role ARN** and **Subscription endpoint** values, and store them in a secure location. You will use them in the next step.

### Step 3: Complete Amazon Security Lake source creation in Panther

1. Return to your Panther Console browser tab.
2. On the **Configure** page, enter values for the following fields:
   * **Name**: A human-friendly name for your source, e.g., `Amazon Security Lake`.
   * **AWS Role ARN:** The role ARN you generated in the previous step.
   * **Subscription endpoint**: The SQS queue ARN you generated in the previous step.
3. Click **Setup.**
   * You will be directed to a success screen:\\

     <figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-e55cedf82c6a6adc66ec5c14ebdcb164c3b1dcca%2FScreenshot%202023-08-03%20at%204.33.30%20PM.png?alt=media" alt="The success screen reads, &#x22;Everything looks good! Panther will now automatically pull &#x26; process logs from your account&#x22;" width="281"><figcaption></figcaption></figure>

     * You can optionally enable one or more [Detection Packs](https://docs.panther.com/detections/panther-managed/packs).
     * The **Trigger an alert when no events are processed** setting defaults to **YES**. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period of time. The timeframe is configurable, with a default of 24 hours.\\

       <figure><img src="https://4011785613-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LgdiSWdyJcXPahGi9Rs-2910905616%2Fuploads%2Fgit-blob-c48119abd559990173004bde99ff4907fdd2ded2%2FScreenshot%202023-08-03%20at%204.26.54%20PM.png?alt=media" alt="The &#x22;Trigger an alert when no events are processed&#x22; toggle is set to YES. The &#x22;How long should Panther wait before it sends you an alert that no events have been processed&#x22; setting is set to 1 Day" width="320"><figcaption></figcaption></figure>

## Supported Amazon Security Lake log types

Panther supports ingesting Amazon Security Lake logs with each of the OCSF schemas listed on [this OCSF page](https://schema.ocsf.io/).