Does Splunk supports new AWS Inspector v2?

[saidtz]

Is there possibility to ingest logs from AWS Inspector v2 into Splunk?

[Sushobit]

@saidtz @razdansu  confronted my internal development team and learned that inspector v2 is not supported in the existing version of  AWS TA v6.0.0. They are working on it to add support for the same, so it will be added in an upcoming release. (Tentative date not known, most probably at the end of July) 
Hope this helps!

[VatsalJagani]

@saidtz , @razdansu - Have you tried the latest version of this Add-on?

https://splunkbase.splunk.com/app/5764/ (AWS Inspector)

I hope this helps!!!

[razdansu]

@VatsalJagani @saidtz  I m using AWS Add-on : 6.0.0 and splunk version Splunk Cloud : 8.2.2112.1

(https://docs.splunk.com/Documentation/AddOns/released/AWS/Inspector) following up on this document

Is it possible to collect logs with the following
permissions?
("inspector:*" may not be necessary)
And if so, is sourcetype supported?
"Action": [
"inspector2
Describe*",
"inspector2
List*"
],

Its about version 2 of inspector inspector v2 of aws as 

I have set up to collect AWS Inspector logs.
Something seems to be wrong because it is not collected.
Is this add-on compatible with "Inspector v2"?

[VatsalJagani]

@razdansu - The Add-on is built by Splunk, so you can ask that question to Splunk support.

I tried to find a proper document for it on Splunk, but couldn't find it. So Splunk support is the best place to go for this.

[razdansu]

@saidtz  Is there a possibility to ingest logs from AWS Inspector v2 into Splunk? 

What are your findings on this? kindly help

[saidtz]

hey @razdansu. I could not find a way to ingest inspector v2 data with their add on. Instead, I generate new AWS Inspector report every day and I store it inside S3 bucket. Then, I just read that json file in splunk and that works fine. Glad if I helped

[razdansu]

@saidtz which add 0n and its version are u using my friend

[saidtz]

@razdansuI am using aws add on. Then simply read the file inside s3 bucket.