matanolabs / matano

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
https://matano.dev
Apache License 2.0
1.44k stars 97 forks source link

Add HTTP based log ingestion support #119

Open rams3sh opened 1 year ago

rams3sh commented 1 year ago

Problem Statement

Many of our internal integrations of devops are hosted outside AWS and all have webhook dispatch as common output mechanism . And the outputs from these dispatched alerts are required to be integrated with an external security data lake.

Proposal

If there can be an HTTP endpoint (something like an external facing AWS API gateway endpoint) to which an external integration can hit , many of these internal ingestion use cases can be solved.

Current solution being used to solve this

As of now I am planning to write a hacky integration of API gateway to matano's sqs to solve this.

To be considered

Reference Implementations