AWS
Send Halo Security events directly to AWS services for automated response and integration.
This integration allows you to send events from Halo Security to AWS S3 buckets or SQS queues, enabling automated workflows and custom processing within your AWS infrastructure.
Connect Halo Security and AWS
If you haven't already connected Halo Security and AWS for discovery, follow the instructions below:
AWSAdd Policy Statements
To allow Halo Security to write event data to AWS, you'll need to add the following statements to your AWS Policy:
{
"Version": "2012-10-17",
"Statement": [
{
// Existing permissions
...
},
{
// For S3
"Sid": "HaloSecurityS3Write",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:PutObjectAcl"
],
"Resource": "[Your S3 ARN, eg. arn:aws:s3:::xxx-halo-events/*]"
},
{
// For SQS
"Sid": "HaloSecuritySQS",
"Effect": "Allow",
"Action": "sqs:SendMessage",
"Resource": "[Your SQS ARN, eg. arn:aws:sqs:us-east-1:xxx:xxx-halo-events]"
}
]
}
Create Profiles
Profiles determine how events are sent to AWS services. You can create multiple profiles to send different types of events to different AWS destinations.
To create a profile:
Navigate to your AWS integrations Profiles tab
Click the "+" icon to add a new profile
Configure the profile settings:
Name: The name for your AWS profile
Type: Select the AWS service type
S3: Store events in an S3 bucket
SQS: Send events to an SQS queue
For SQS profiles:
Queue URL: The complete URL of your SQS queue (e.g.,
https://sqs.us-east-1.amazonaws.com/123456789012/my-queue
)Region: The AWS region where your queue is located (e.g.,
us-east-1
)
For S3 profiles:
Bucket: The name of your S3 bucket (e.g.,
my-security-events
)Path: The path where files will be stored (e.g.,
security-events/incoming/
)Region: The AWS region where your bucket is located (e.g.,
us-east-1
)
Click Save Changes
Create Event Rules
To send events to AWS, create Event Rules and add your AWS profile as an action. Visit Events → Event Rules to set up rules that determine which Halo Security events are sent to your AWS S3 bucket or SQS queue.
Learn more about configuring Event Rules at:
Event RulesUse Cases
Trigger AWS Lambda functions in response to critical security events
Route events into DynamoDB for processing and reporting
Integrate security findings with existing AWS-based security information and event management (SIEM) systems
Create automated remediation workflows using AWS Step Functions
Feed security data into AWS Security Hub
Generate custom reports and dashboards using AWS QuickSight
Last updated
Was this helpful?