Home/Templates/Get cloud logs into your SIEM
Get cloud logs into your SIEM
A delivery pipe from cloud logging to the place your detections actually run.
Terraform
Why bother
Logs sitting in a cloud console are not next to your endpoint and identity data, so nothing correlates and the detection never fires. This wires up the delivery so events land where analysts already look.
How you know it worked
Do one thing you can recognise. Search for it in the SIEM and find it.
Not written yet
No code exists for this one. It is listed so the gap shows on the coverage table. When it is written, each platform will use:
| Platform | Service |
|---|---|
| AWS | Kinesis Firehose to a Splunk HTTP event collector |
| Azure | Event Hub to Splunk or a Sentinel workspace |
| Google Cloud | Pub/Sub to your collector |
| Oracle Cloud | Service Connector Hub to a stream |