matanolabs / matano

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
https://matano.dev
Apache License 2.0
1.46k stars 100 forks source link

Managed log source for AWS Config #51

Open timoguin opened 1 year ago

timoguin commented 1 year ago

Add support for managing logs (data?) and events from AWS Config. This includes configuration snapshots, configuration history, and configuration streams.

Considerations

AWS Config sends notifications to SNS for a number of events, the most useful of which is the ConfigurationItemChangeNotification and the ComplianceChangeNotification. These would be highly useful to ingest.

AWS Config also delivers configuration snapshots and configuration history data to S3.

Another useful event is the OversizedConfigurationItemChangeNotification, which delivers configuration change data to S3 in the event that it is too large for an SNS message (so they require additional processing).

Tasks

References