Why should this ingestion source be integrated into BuffaLogs?
AWS CloudTrail records every API call and console login in an AWS account, including important security events like user sign-ins, role assumptions, and access key usage. Adding support for CloudTrail would let BuffaLogs detect login anomalies directly in cloud environments — things like impossible travel, logins from new countries or unusual IPs, anonymous access, or suspicious root/user activity.
Benefits:
- Makes BuffaLogs useful for AWS-based organizations and cloud security teams
- Fills a major gap since current sources are mostly on-prem (SSH, Apache) or specific identity providers
- Improves overall data coverage and anomaly detection in modern hybrid/cloud setups
- Aligns with Honeynet's focus on practical, open-source threat detection tools
What we will do (high-level plan)
We will add AWS CloudTrail as a new ingestion source by:
- Creating a dedicated ingestion class for CloudTrail that follows the project's existing pattern (implementing the three abstract methods from base_ingestion.py)
- Adding configuration settings for the new source (bucket name, region, filters, etc.) into the ingestion config file
- Updating the SupportedIngestionSources Enum and the IngestionFactory so the new source can be selected and used
- Building the logic to fetch CloudTrail logs from S3, parse the relevant login-related events, normalize them into the format BuffaLogs expects, and feed them into the anomaly detection pipeline
- Writing tests specifically for this source to make sure parsing and ingestion work correctly
- Adding a short documentation page explaining how to set it up and use it, including example config and any screenshots of ingested data / detected anomalies
This will be done in a clean, modular way so it doesn't break anything existing and follows the same structure as other ingestion sources (like the Elasticsearch one used as reference).
@Lorygold if this seems good to you, I can start working on it right away?
Why should this ingestion source be integrated into BuffaLogs?
AWS CloudTrail records every API call and console login in an AWS account, including important security events like user sign-ins, role assumptions, and access key usage. Adding support for CloudTrail would let BuffaLogs detect login anomalies directly in cloud environments — things like impossible travel, logins from new countries or unusual IPs, anonymous access, or suspicious root/user activity.
Benefits:
What we will do (high-level plan)
We will add AWS CloudTrail as a new ingestion source by:
This will be done in a clean, modular way so it doesn't break anything existing and follows the same structure as other ingestion sources (like the Elasticsearch one used as reference).
@Lorygold if this seems good to you, I can start working on it right away?