Integrate with Amazon CloudTrail

What does the integration offer?

The recorded information from Amazon CloudTrail includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service.

Compass is an alert and notification management solution that is highly complementary to Amazon CloudTrail. With this integration, Compass alerts are created for Amazon CloudTrail notifications.

How does the integration work?

Use the Amazon CloudTrail Integration to forward Amazon CloudTrail notifications to Compass. Compass determines the right people to notify based on on-call schedules, notifies via email, text messages (SMS), phone calls, and iOS and Android push notifications, and escalates alerts until they are acknowledged or closed.

When Amazon CloudTrail receives a new log, an alert is created in Compass automatically through the integration.

Set up the integration

Amazon CloudTrail is an API-based integration. Setting it up involves the following steps:

Add an Amazon CloudTrail integration in Compass
Configure the integration in Amazon CloudTrail

Add an Amazon CloudTrail integration

In this release, only incoming integrations are fully supported in the Standard plan, at a team level. To use outgoing integrations or the outgoing part of bidirectional integrations, upgrade to a higher subscription plan. There may be restrictions on how you can create and apply integration rules as well.

You can add this integration only from your team’s operations page. Adding an integration from your team’s operations page makes your team the owner of the integration. This means Compass only assigns the alerts received through this integration to your team.

To add an Amazon CloudTrail integration in Compass, complete the following steps:

Go to your team’s operations page.
On the left navigation panel, select Integrations and then Add integration.
Run a search and select “Amazon CloudTrail”.
On the next screen, enter a name for the integration.
Optional: Select a team in Assignee team if you want a specific team to receive alerts from the integration.
Select Continue.
The integration is saved at this point.
Expand the Steps to configure the integration section and copy the integration URL generated for your account.
You will use this URL while configuring the integration in Amazon CloudTrail later.
Select Turn on integration.
The rules you create for the integration will work only if you turn on the integration.

Configure the integration in Amazon CloudTrail

To configure the integration in Amazon CloudTrail, complete the following steps:

Create an SNS topic. Find out how to get started with Amazon SNS.
Add an HTTPS subscription to your topic with the integration URL previously copied from Compass as the endpoint. Find out how to add an HTTPS subscription. If the configuration is successful, a confirmation alert is created in Compass.
Configure Amazon SNS notifications for AWS CloudTrail. Read more about AWS CloudTrial.
On the Configuration page, select the SNS topic you created for the Integration.
Select Save.
From Amazon CloudTrail Console, navigate to Trails. Add a new trail or use an existing one.
In the S3 tab, select Advanced > SNS topic and then select Save.

Sample payload from Amazon CloudTrail integration

(in JSON format)

{
  "Type": "Notification",
  "MessageId": "d7b0abd-f459-5627-b6e7-5a4cc1f84dcd",
  "TopicArn": "arn:aws:sns:us-west-2:3456xxxxxx:og",
  "Message": "{\"s3Bucket\":\"jsmtest\",\"s3ObjectKey\":[\"AWSLogs/345678xxxxxx/CloudTrail/us-east-1/2017/01/12/345678xxxxx_CloudTrail_us-east-1_20170112T0740Z_Q8aey31rGgtoAp9d.json.gz\"]}",
  "Timestamp": "2017-01-12T07:42:25.469Z",
  "SignatureVersion": "1",
  "Signature": "OAXw/gb6ciZSbwZ3o1Moh7U5/1m4uBGnqQmbwL8AGuuOa2Yo9sSaHjUf0Qf4BMtlRQ5pc4ghkW0LWKyHTIikKa4MFjlrgMLf7AaYJgh/5bDhorgdiXSk04PD/me2M9Sv85xZufEj9V0ys1PnwP6X877YFKz6iDNQ9Lyi1woaRmtCPmEtbpwjWYQJRlTpEv+exuqVjm7bgfTV+1DjB5kfFdK4X8Py9lpFMyaIiT24yffTAMLssp8wcGb8ygGxX9kD0JRfIlnAtM3Mn9NI7jmCXiE4iNpISMMlNSDPrUuzUSBzXrt3ArMraLdQ==",
  "SigningCertURL": "https://sns.us-west-2.amazonaws.com/SimpleNotificationService-b95095bebf6a046b3aafc7f4149a.pem",
  "UnsubscribeURL": "https://sns.us-west-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-west-2:345678xxxxx:og:949xxxxx-fed7-4456-b172-3a5xxxxxx41"
}

Compass parses the payload as follows: