|Supported Versions||Type||Authentication Type|
|SaaS||API||User API Key|
CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. Use this integration to track Shadow Changes from your AWS account in BigPanda.
The CloudTrail integration process starts by configuring an S3 bucket holding CloudTrail events with an SQS event notification to a BigPanda-owned queue for all new objects. Once BigPanda's SQS queue receives a message it will retrieve the new CloudTrail file from S3 using an IAM Role provided by the customer. Once it retrieves the file it will parse it for CloudTrail events, filter the events which represent actual changes, and finally normalize and make the changes available in BigPanda for correlation with alerts.
- Notifies BigPanda of CloudTrail events, capturing Shadow Changes in your AWS account.
- Intelligently correlates changes in AWS with high-level incidents in BigPanda to expedite the Root Cause Analysis (RCA) process and reduce Mean Time To Repair (MTTR).
- Automatically identifies which CloudTrail events correspond to actual changes in your environment
BigPanda converts and organizes the change data from CloudTrail into tags.
The Event fields below populate the Changes tags.
|Generates the |
|Hyperlink for the |
|This event property is an object. The keys are translated into Change tags with a prefix of |
|This event property can be an array of Objects. The Change tag will always be |
Administrators can install the integration by following the on-screen instructions in BigPanda.
- Obtain permission to create IAM roles and modify S3 event notifications in your AWS account.
- Ensure one or more CloudTrail trails are configured and saving events to S3.
- Create and save a BigPanda API Key.
- Create a Changes CloudTrail integration and save the app key.
Deleting an integration requires changes to both the integrated system and BigPanda. You must uninstall the integration on the integrated system and then delete the integration from BigPanda.
When replacing an existing integration with a new tool or system, we recommend configuring the new integration first to ensure no data is lost.
On the integrated system, disable any settings that send data to BigPanda.
Manually resolve any open alerts sent from the integration to remove the associated incidents from your incident feed. These incidents will not automatically resolve without an
ok status from the original sending integration.
- In BigPanda, navigate to the Integrations tab and select the desired integration from the list.
- In the integration details on the right, click Delete Integration. A support message opens, pre-populated with a request to delete the selected integration.
- Press Enter to send the request.
- The BigPanda support team will remove the integration from the UI.
This procedure does not remove any data from BigPanda or the integrated system. As needed, remove data from each system before deleting the integration.
Updated about 1 month ago