The challenge
Security teams needed to centralise AWS activity logs in Microsoft Sentinel while reliably handling log delivery and ingestion between cloud services.
My contribution
- Participated in the design of a solution for forwarding AWS CloudTrail logs to Microsoft Sentinel.
- Designed around Amazon SQS as a queueing component to decouple log notifications and downstream ingestion.
- Considered operations and monitoring requirements of AWS-to-Sentinel security telemetry.
High-level data flow
01AWS CloudTrail logs are written to the designated S3 logging location.
02S3 event notifications feed a dedicated Amazon SQS queue.
03The Microsoft Sentinel ingestion integration consumes queued event notifications and retrieves log objects.
Outcome & impact
The design provides a queue-backed ingestion path for security telemetry. Exact availability outcomes and throughput figures have not been published.
Public case study: implementation details have been generalised to avoid disclosing private employer systems, source code, account identifiers or infrastructure configuration.