All Apps and Add-ons

How do we integrate Amazon SES with Splunk without linking Cloudwatch or Kinesis Firehose?

vivekjayasimha
Engager

I want to integrate AWS SES with Splunk without Cloudwatch or Kinesis Firehose. Is there a way to do that. I want all the SES events/logs to get generated into Splunk DLP.

How can I do that?

Labels (1)

ttovarzoll
Path Finder

I successfully forward my SES notifications to Splunk via the following process:

  • create SNS topic, e.g. "ses-notifications-topic"
  • create SQS queue, e.g. "ses-notifications-queue"
  • from the SQS queue's right-click menu, 'Configure queue" and change Default Visibility Timeout = 5 min (Splunk recommended value)
  • again from the right-click, 'Add subscription' (then select the SNS topic)
  • in the IAM policy for my Splunk service-account, I specifically add sqs:List*/Get*/DeleteMessage permissions and with that particular SQS queue as the Resource
  • in the Splunk Add-on for AWS, create new Input of type 'Custom / SQS', then point it at the SQS queue and set sourcetype=aws:ses
  • finally, back in the SES console, update the Notifications to send to the new SNS topic

The problem I have, actually, is with parsing the events correctly. The message details are not being extracted even though they're in JSON. Probably some simple setting I'm missing. (I also found a "Splunk SES App" from a third-party but it doesn't seem to work.)

P.S. I have the optional SES notification setting, "Include original headers" but I don't think that's the issue.

0 Karma

mydog8it
Builder

The only methods AWS lists for publishing the data is "Amazon CloudWatch or Amazon Kinesis Data Firehose, or by Amazon SNS notification".
You can't get around AWS rules for publishing the data. Maybe I don't understand your question?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...