詳細検索
↑↓移動
↵選択
ESC閉じる

How to integrate AWS logs with Microsoft Sentinel – Leverage Azure Functions

Avatar
by 西田04/26/2025
2 min read
Tags ログ連携 Microsoft Sentinel azure soc セキュリティ
How to integrate AWS logs with Microsoft Sentinel – Leverage Azure Functions
Translated from 日本語 • View original
西田
西田

Hello! This is Nishida, the business leader of Colorkrew Security. For those who want to integrate logs such as AWS CloudTrail and VPC Flow Logs into Microsoft Sentinel to enhance security monitoring, this article will explain in an easy-to-understand way how to use Azure Functions to integrate AWS logs (via S3) with Microsoft Sentinel!

1. Benefits of integrating AWS logs with Sentinel

Benefits of Integration

  • Centralized monitoring of multi-cloud environments → Visualize Azure and AWS logs together!
  • Leverage threat detection rules → Detect threats with Microsoft Sentinel analytics!
  • Automate incident response → Act quickly with Logic Apps!
  • Long-term log storage and analysis → Query analysis with Log Analytics!

2. How does the collaboration work?

To send AWS logs to Sentinel:

  1. AWS Services → Store CloudTrail, VPC Flow Logs, and More in S3
  2. Azure Functions → Get logs from AWS S3/SQS and send them to Sentinel
  3. Analyze and visualize logs in Microsoft Sentinel → Log Analytics workspace

This configuration ensures that AWS and Azure security logs are managed on the same foundation.

3. Setup Instructions

(1) Preparing for AWS

Procedure

  1. Configure AWS CloudTrail / VPC Flow Logs and more to be stored in S3
  2. Set up SQS to notify you when a new S3 object is added
  3. Create a dedicated IAM user and get an access key
    • Grant permissions such as 's3:GetObject', 'sqs:ReceiveMessage', etc.

(2) Deploying Azure Functions

Prepare Azure Functions to send data to Microsoft Sentinel.

Procedure

  1. Create an Azure Function in the Azure portal (choose Python or C#)
  2. Associate with Log Analytics Workspace
  3. Deploy with official templates
az deployment group create --resource-group <ResourceGroupName> \
  --template-uri https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/AmazonWebServicesS3/azuredeploy.json

(3) Setting Environment Variables

Set the following environment variables for Azure Functions:

Key Examples
AWS_ACCESS_KEY_ID <取得したアクセスキー>
AWS_SECRET_ACCESS_KEY <取得したシークレットキー>
AWS_REGION 'us-east-1' and more
SQS_URL <SQSのURL>
S3_BUCKET_NAME <S3バケット名>
LOG_ANALYTICS_WORKSPACE_ID <ワークスペースID>
LOG_ANALYTICS_SHARED_KEY <共有キー>

(4) Reviewing Logs with Sentinel

How to Check

  1. Run queries with Log Analytics

 

   AWSCloudTrail
   | sort by TimeGenerated desc
  1. Check Azure Functions logs

 

   az functionapp log tail --name <FunctionAppName>
  1. If it's **successfully ingested, the custom table will also reflect the data! **

**4. Conclusion – Here's the point! **

To integrate AWS logs with Microsoft Sentinel,

  • Manage AWS logs with S3 + SQS
  • Ingest data in Azure Functions and send it to Sentinel
  • Threat visualization and analysis with KQL

This way, cross-cloud security operations can be smartly realized!

**If you want to build a SOC for the multi-cloud era, please try this method! ****If you want to know more, please feel free to contact Colorkrew Security's SOC service! **

</共有キー></ワークスペースID></S3バケット名></SQSのURL></取得したシークレットキー></取得したアクセスキー>

See more

Related Articles