# Log event one after enrichment
{
"actor_email": "janedoeemailone@mail.com",
"action": "LOGIN",
"p_enrichment": {
"<lookup_table_name>": {
"actor_email": {
"full_name": "Jane Doe",
"p_match": "janedoeemailone@mail.com",
"role": "ADMIN"
}
}
}
}
# Log event two after enrichment
{
"actor_email": "janedoeemailtwo@mail.com",
"action": "EXPORT_FILE",
"p_enrichment": {
"<lookup_table_name>": {
"actor_email": {
"full_name": "Jane Doe",
"p_match": "janedoeemailtwo@mail.com",
"role": "ADMIN"
}
}
}
}
While this step is technically optional (i.e., you can bypass this page without designating log types/Selectors), you must make these designations in order for any logs to be enriched, as auto-mapping is not supported.
%20(13).png?alt=media)
4. Click **Continue**.
5. On the **Associated Log Types (Optional)** page, optionally designate log types/Selectors:
* Click **Add Log Type**.
* Click the **Log Type** dropdown, then select a log type.
* Choose one or more **Selectors**, the foreign key fields from the log type you want enriched with your custom enrichment.
* You also can reference attributes in nested objects using [JSON path syntax](https://goessner.net/articles/JsonPath/). For example, if you wanted to reference a field in a map, you could enter `$.field.subfield`.
* Click **Add Log Type** to add another if needed.\
\
In the example screen shot above, we selected **AWS.CloudTrail** logs and typed in `accountID` and `recipientAccountID` to represent keys in the CloudTrail logs.
6. Click **Continue**.
7. On the **Table Schema** page, configure the Table Schema:\
\&#xNAN;*Note: If you have not already created a new schema, please see* [*our documentation on creating schemas*](https://docs.runpanther.io/data-onboarding/custom-log-types/example-csv)*. You can also use your custom enrichment data to infer a schema. Once you have created a schema, you will be able to choose it from the dropdown on the Table Schema page while configuring an Enrichment.*\
\&#xNAN;*Note: CSV schemas require column headers to work with custom enrichments*.
* Select a **Schema Name** from the dropdown.
* Select a **Primary Key Name** from the dropdown. This should be a unique column on the table, such as `accountID`.\
8. Click **Continue**.
9. On the **Choose Import Method** page, on the **Import via File Upload** tile, click **Set Up**.
10. On the **Upload File** page, drag and drop a file or click **Select file** to choose the file of your Enrichment data to import. The file must be in `.csv` or `.json` format.
11. Click **Finish Setup**. A source setup success page will populate.
12. Optionally, next to to ***S*****et an alarm in case this custom enrichment doesn't receive any data?**, toggle the setting to **YES** to enable an alarm.
* Fill in the **Number** and **Period** fields to indicate how often Panther should send you this notification.
* The alert destinations for this alarm are displayed at the bottom of the page. To configure and customize where your notification is sent, see documentation on [Panther Destinations](https://docs.panther.com/alerts/destinations).
{% hint style="info" %}
Notifications generated for an custom enrichment upload failing are accessible in the **System Errors** tab within the **Alerts & Errors** page in the Panther Console.
{% endhint %}
**Create an IAM role using AWS Console UI**
1. On the "Set Up an IAM role" page, during the process of creating a custom enrichment with an S3 source, locate the tile labeled "Using the AWS Console UI". On the right side of the tile, click **Select**.
2. Click **Launch Console UI**.\
* You will be redirected to the AWS console in a new browser tab, with the template URL pre-filled.
* The CloudFormation stack will create an AWS IAM role with the minimum required permissions to read objects from your S3 bucket.
* Click the "Outputs" tab of the CloudFormation stack in AWS, and note the Role ARN.
3. Navigate back to your Panther account.
4. On the "Use AWS UI to set up your role" page, enter the Role ARN.
5. Click **Finish Setup**.
**Create an IAM role using CloudFormation Template File**
1. On the "Set Up an IAM role" page, during the process of creating a custom enrichment with an S3 source, locate the tile labeled "CloudFormation Template File". On the right side of the tile, click **Select**.
2. Click **CloudFormation template**, which downloads the template to apply it through your own pipeline.
3. Upload the template file in AWS:
1. Open your AWS console and navigate to the CloudFormation product.
2. Click **Create stack**.
3. Click **Upload a template file** and select the CloudFormation template you downloaded.
4. On the "CloudFormation Template" page in Panther, enter the Role ARN.
5. Click **Finish Setup**.
**Create an IAM role manually**
1. On the "Set Up an IAM role" page, during the process of creating a custom enrichment with an S3 source, click the link that says **I want to set everything up on my own**.
2. Create the required IAM role. You may create the required IAM role manually or through your own automation. The role must be named using the format `PantherLUTsRole-${Suffix}`(e.g., `PantherLUTsRole-MyLookupTable`).
* The IAM role policy must include the statements defined below:
```
"Version": "2012-10-17",
"Statement": [
{
"Action": "s3:GetBucketLocation",
"Resource": "arn:aws:s3:::| AWS | |
|---|---|
google.subject | assertion.arn.extract('arn:aws:sts::{account_id}:')+":"+assertion.arn.extract('assumed-role/{role_and_session}').extract('/{session}') |
attribute.account | assertion.account |
| Permission required | Role | Condition |
|---|---|---|
| Permissions required | Role | Scope |
| roles/storage.objectViewer | bucket-name |