All Apps and Add-ons

TA for AWS: Difference between CloudTrail input and SQS-based-S3 input for CloudTrail

benjaminruland
Explorer

Hi community,

I am trying to get my head around the best way to import CloudTrail data from AWS to Splunk.

What I don't understand right now is the difference between these two ways to get CloudTrail data into Splunk when using the Add-On for AWS.

Both inputs use the same mechanism: CloudTrail data is dumped to an S3 bucket, notifications are sent to SNS and forwarded to SQS, Splunk reads from SQS and fetches the data from S3.

Can somebody give me a hint, how these two ways differ and which way would be recommended?

Thanks!

Labels (1)

sonalipatil
Engager

Hello, 

We are also trying to find out the same. Were you able to figure out the difference or get any response from Splunk.

0 Karma

benjaminruland
Explorer

While I have not found out how the "Cloud Trail input" variant differs from the SQS-based-S3, I tested the SQS-based-S3 variant and it works really well. This variant is also the recommended one as indicated in the Add-On's UI.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...