Hi,
I have a requirement to get the AWS Guardduty working with Splunk. However I'm slightly confused on which method to pursue.
OR
Hope someone can highlight the pros & cons of each approach.
Thanks,
AKN
I've put together a document that might be able to help guide you on your decision between Push vs, Pull options, specific to AWS data sources . To quickly answer the question, it's going to depend on scale, cost, maintenance and latency of the data. If you're collecting from one account and it's relatively small amounts of data, then going the pull path would make sense. However, if you have multiple accounts collection large amounts of data, it might make sense to go down the path of Kinesis Firehose.
If you decide to go down the push path, I would recommend you look at the Project Trumpet blog for collecting that data (and help setting up the AWS components as well.)
(Edit Added the AWS GDI Doc/Whitepaper link.)
I've put together a document that might be able to help guide you on your decision between Push vs, Pull options, specific to AWS data sources . To quickly answer the question, it's going to depend on scale, cost, maintenance and latency of the data. If you're collecting from one account and it's relatively small amounts of data, then going the pull path would make sense. However, if you have multiple accounts collection large amounts of data, it might make sense to go down the path of Kinesis Firehose.
If you decide to go down the push path, I would recommend you look at the Project Trumpet blog for collecting that data (and help setting up the AWS components as well.)
(Edit Added the AWS GDI Doc/Whitepaper link.)
@amiracle Thanks for the suggestions.