S3 Sources

Overview

Use these API operations to interact with S3 Sources in Panther.

Required permissions

• For GET operations, your API token must have the View Log Sources permission.

• For POST, PUT, and DELETE operations, your API token must have the Manage Log Sources permission.

create s3 source

post

Authorizations

X-API-KeystringRequired

Body

awsAccountIdstringRequired

The 12-digit AWS account ID where the S3 bucket resides

integrationLabelstringRequired

The integration label (name)

kmsKeystringOptional

KMS key ARN for server-side encryption. Omit if the bucket is not KMS-encrypted.

logProcessingRolestringRequired

The IAM role ARN that Panther assumes to read from the S3 bucket

logStreamTypestring · enumRequired

The log stream type. Supported: Auto, JSON, JsonArray, Lines, XML, CloudWatchLogs

Possible values:

managedBucketNotificationsbooleanRequired

Whether Panther should configure the S3 bucket notifications automatically

s3BucketstringRequired

The S3 bucket name

Responses

201

Created response.

application/json

awsAccountIdstringOptional

The AWS account ID where the S3 bucket resides

integrationIdstringOptional

The unique ID of the S3 log source

integrationLabelstringOptional

The integration label (name)

kmsKeystringOptional

KMS key ARN for server-side encryption. Omit if the bucket is not KMS-encrypted.

logProcessingRolestringOptional

The IAM role ARN that Panther assumes to read from the S3 bucket

logStreamTypestring · enumOptional

The log stream type. Supported: Auto, JSON, JsonArray, Lines, XML, CloudWatchLogs

Possible values:

managedBucketNotificationsbooleanOptional

Whether Panther should configure the S3 bucket notifications automatically

s3BucketstringOptional

The S3 bucket name

400

bad_request: Bad Request response.

application/json

409

exists: Conflict response.

application/json

500

service: Internal Server Error response.

application/json

post/log-sources/s3

POST /log-sources/s3 HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 363

{
  "awsAccountId": "text",
  "integrationLabel": "text",
  "kmsKey": "text",
  "logProcessingRole": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "retainEnvelopeFields": true,
    "xmlRootElement": "text"
  },
  "managedBucketNotifications": true,
  "s3Bucket": "text",
  "s3PrefixLogTypes": [
    {
      "excludedPrefixes": [
        "text"
      ],
      "logTypes": [
        "text"
      ],
      "prefix": "text"
    }
  ]
}

{
  "awsAccountId": "text",
  "integrationId": "text",
  "integrationLabel": "text",
  "kmsKey": "text",
  "logProcessingRole": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "retainEnvelopeFields": true,
    "xmlRootElement": "text"
  },
  "managedBucketNotifications": true,
  "s3Bucket": "text",
  "s3PrefixLogTypes": [
    {
      "excludedPrefixes": [
        "text"
      ],
      "logTypes": [
        "text"
      ],
      "prefix": "text"
    }
  ]
}

get s3 source

get

Authorizations

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the S3 source to fetch

Responses

200

OK response.

application/json

awsAccountIdstringOptional

The AWS account ID where the S3 bucket resides

integrationIdstringOptional

The unique ID of the S3 log source

integrationLabelstringOptional

The integration label (name)

kmsKeystringOptional

KMS key ARN for server-side encryption. Omit if the bucket is not KMS-encrypted.

logProcessingRolestringOptional

The IAM role ARN that Panther assumes to read from the S3 bucket

logStreamTypestring · enumOptional

The log stream type. Supported: Auto, JSON, JsonArray, Lines, XML, CloudWatchLogs

Possible values:

managedBucketNotificationsbooleanOptional

Whether Panther should configure the S3 bucket notifications automatically

s3BucketstringOptional

The S3 bucket name

400

bad_request: Bad Request response.

application/json

404

not_found: Not Found response.

application/json

500

service: Internal Server Error response.

application/json

get/log-sources/s3/{id}

GET /log-sources/s3/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

{
  "awsAccountId": "text",
  "integrationId": "text",
  "integrationLabel": "text",
  "kmsKey": "text",
  "logProcessingRole": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "retainEnvelopeFields": true,
    "xmlRootElement": "text"
  },
  "managedBucketNotifications": true,
  "s3Bucket": "text",
  "s3PrefixLogTypes": [
    {
      "excludedPrefixes": [
        "text"
      ],
      "logTypes": [
        "text"
      ],
      "prefix": "text"
    }
  ]
}

put s3 source

put

Authorizations

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the S3 source to update

Body

integrationLabelstringRequired

The integration label (name)

kmsKeystringOptional

KMS key ARN for server-side encryption. Omit if the bucket is not KMS-encrypted.

logProcessingRolestringRequired

The IAM role ARN that Panther assumes to read from the S3 bucket

logStreamTypestring · enumRequired

The log stream type. Supported: Auto, JSON, JsonArray, Lines, XML, CloudWatchLogs

Possible values:

managedBucketNotificationsbooleanRequired

Whether Panther should configure the S3 bucket notifications automatically

Responses

200

OK response.

application/json

awsAccountIdstringOptional

The AWS account ID where the S3 bucket resides

integrationIdstringOptional

The unique ID of the S3 log source

integrationLabelstringOptional

The integration label (name)

kmsKeystringOptional

KMS key ARN for server-side encryption. Omit if the bucket is not KMS-encrypted.

logProcessingRolestringOptional

The IAM role ARN that Panther assumes to read from the S3 bucket

logStreamTypestring · enumOptional

The log stream type. Supported: Auto, JSON, JsonArray, Lines, XML, CloudWatchLogs

Possible values:

managedBucketNotificationsbooleanOptional

Whether Panther should configure the S3 bucket notifications automatically

s3BucketstringOptional

The S3 bucket name

400

bad_request: Bad Request response.

application/json

404

not_found: Not Found response.

application/json

409

exists: Conflict response.

application/json

500

service: Internal Server Error response.

application/json

put/log-sources/s3/{id}

PUT /log-sources/s3/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 323

{
  "integrationLabel": "text",
  "kmsKey": "text",
  "logProcessingRole": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "retainEnvelopeFields": true,
    "xmlRootElement": "text"
  },
  "managedBucketNotifications": true,
  "s3PrefixLogTypes": [
    {
      "excludedPrefixes": [
        "text"
      ],
      "logTypes": [
        "text"
      ],
      "prefix": "text"
    }
  ]
}

{
  "awsAccountId": "text",
  "integrationId": "text",
  "integrationLabel": "text",
  "kmsKey": "text",
  "logProcessingRole": "text",
  "logStreamType": "Auto",
  "logStreamTypeOptions": {
    "jsonArrayEnvelopeField": "text",
    "retainEnvelopeFields": true,
    "xmlRootElement": "text"
  },
  "managedBucketNotifications": true,
  "s3Bucket": "text",
  "s3PrefixLogTypes": [
    {
      "excludedPrefixes": [
        "text"
      ],
      "logTypes": [
        "text"
      ],
      "prefix": "text"
    }
  ]
}

delete s3 source

delete

Authorizations

X-API-KeystringRequired

Path parameters

idstringRequired

ID of the S3 source to delete

Responses

204

No Content response.

No content

400

bad_request: Bad Request response.

application/json

500

service: Internal Server Error response.

application/json

delete/log-sources/s3/{id}

DELETE /log-sources/s3/{id} HTTP/1.1
Host: your-api-host
X-API-Key: YOUR_API_KEY
Accept: */*

No content