Question

Your organization runs production workloads in AWS. The SOC wants to ingest AWS CloudTrail management events into Microsoft Sentinel for detection and hunting. You must configure the connection so that logs are pulled reliably at scale without maintaining custom collection infrastructure, and following Microsoft's currently recommended approach. What should you configure?

Accepted Answer

Configure the Amazon Web Services S3 data connector, sending CloudTrail logs to an S3 bucket with an SQS queue and granting Sentinel access through an IAM role using OpenID Connect

Answer

Deploy the Azure Monitor Agent on an EC2 instance and forward CloudTrail logs via Syslog to Sentinel

Answer

Use the legacy AWS CloudTrail connector with an IAM user access key and secret stored in the connector configuration

Answer

Create a custom Logic App playbook that polls the AWS CloudTrail API every five minutes and writes results to a custom table