A cloud-native SIEM solution that provides intelligent security analytics and threat detection across systems
Issues with connecting Microsoft Sentinel to AWS manually, AWS SENTINEL not ingesting logs
I am referencing this page for instructions: https://learn.microsoft.com/en-us/azure/sentinel/connect-aws?tabs=s3#manual-setup
However, the Microsoft Sentinel is still not ingesting logs from AWS. I have looked at the troubleshooting page as well to double check the configuration, and everything looks good.
On my end, there's two things I noticed. We're using 19785706532 for our accountId in the trust policy. This was gathered from Google, as the file CF file did not have the accountId
AWS: !Sub "arn:${AWS::Partition}:iam::${SentinelAWSAccount}:root
The second problem is step 2, which indicates OIDC and for AWS we already use an identity provider PING.
I notice the role being assumed in CloudTrail. So my questions are do we need to set up OIDC if we already have an identity provider in AWS we use for SSO?
Is there anyway to find or confirm what is the SentinelAwsAccountId? As I do not see this in the repo.
Moved from: Community Center | Not monitored