How to integrate AWS CloudTrail with Splunk Enterprise to index CloudTrail data?

[shahar_tal]

Hi,

We have Splunk Enterprise installed in our organization, we are also using AWS CloudTrail. Is there a a way to connect the two such that our Splunk Enterprise gets the cloudtrail data?

Thanks!
Shahar

[dshpritz · Accepted solution]

Hey Shahar,

You can use the Splunk Add-on for Amazon Web Services to get the data from AWS, and then the Splunk App for AWS to provide some dashboards around those events. The Splunk Add-on for AWS docs are a great place to start.