--- title: Amazon Security Lake integration source: https://docs.newrelic.com/docs/infrastructure/amazon-integrations/aws-integrations-list/aws-security-lake-monitoring-integration --- [New Relic infrastructure integrations](https://docs.newrelic.com/docs/infrastructure/introduction-infra-monitoring) include an integration for AWS Security Lake, allowing you to send your security log data to New Relic. Collect and send telemetry data to New Relic from [Security Lake](https://aws.amazon.com/security-lake/) using our integration. You can use this integration to monitor your services, query incoming data, and build dashboards to observe everything at a glance. ## Activate integration [#activate] To enable this integration, set up an S3 log forwarder. We suggest using our serverless forwarder application for ease and convenience, but you can also set your own. > #### 💡 TIP > > You have two options for Security Lake monitoring setup. You can consolidate multiple regions to avoid repeating steps, or you can set it up on a per-region basis. > For more details, see [managing multiple regions](https://docs.aws.amazon.com/security-lake/latest/userguide/manage-regions.html). ## Prerequisites [#prerequisites] Before enabling this integration, first make sure these steps are completed for Security Lake: 1. Complete the steps mentioned in the Amazon Security Lake [Getting started guide](https://docs.aws.amazon.com/security-lake/latest/userguide/getting-started.html). 2. Complete the prerequisites to setting up a subscriber with data access by following the steps in the [Security Lake subscriber guide](https://docs.aws.amazon.com/security-lake/latest/userguide/subscriber-data-access.html#prereqs-creating-subscriber). ## Configuration steps [#steps] Here's an overview of the steps you'll be doing: 1. [Create a Security Lake subscriber](#create-subscriber). 2. [Install our dedicated Amazon Security Lake log forwarder](#install-log-forwarder). 3. [Find and use your log data](#logs). ## Create a Security Lake subscriber [#create-subscriber] 1. Navigate to the Security Lake feature in your [AWS Console](console.aws.amazon.com/securitylake). 2. Select **Subscribers**, and select **Create Subscriber**. 3. Give the subscriber a name and select a region. 4. Select which log and event sources you want sent to New Relic. 5. Fill out the remaining details as described below: | Field | Value | | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `Data access method` | S3 | | `Account ID` | Insert the AWS `account ID` where you plan on installing the New Relic-provided serverless application. | | `External ID` | Insert your New Relic `AccountID`. For more info, see [externalID](https://docs.aws.amazon.com/security-lake/latest/userguide/subscriber-data-access.html#subscriber-external-id) | | `Notification details` | SQS queue | 6. Select **Create**. 7. From the **Subscriber details** page, copy your **AWS role ID** and **Subscription endpoint** ARN's. You will need them for the next step. ## Install our Amazon Security Lake log forwarder [#install-log-forwarder] To install the log forwarder: 1. Open the [AWS Serverless Application Repository](https://serverlessrepo.aws.amazon.com/applications) in your browser. ![AWS Lambda - Select region](https://docs.newrelic.com/images/serverless_screenshot-crop_AWS-Lambda-select-region.webp "AWS Lambda - Select region") 2. Search for `newrelic` and check **Show apps that create custom IAM roles or resource policies** to find the `newrelic-securitylake-s3-processor-LogForwarder`. 3. Click the `newrelic-securitylake-s3-processor-LogForwarder` details, and click **Deploy**. 4. Copy/paste the `AWS role ID` ARN from the previous step into the `SecurityLakeSubscriberRoleArn` field. 5. Copy/paste the `Subscription endpoint` ARN from the previous step into the `SecurityLakeSubscriberRoleArn` field. 6. Input the `ExternalID` that you added in the previous step. 7. Input your license key into the `NRLicenseKey` field. 8. Acknowledge and select **Deploy**. For more details on this, see [our Amazon Security Lake log forwarder docs](https://docs.newrelic.com/docs/logs/forward-logs/aws-lambda-sending-security-logs-s3). ## Find and use Log data [#logs] To find your logs on New Relic, go to **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Logs** and set **Attributes** to `product.name`, and then choose the log source you want. The following log sources are currently supported: - [ROUTE 53](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/logging-monitoring.html) - [VPC FLOW](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html) - [CLOUDTRAIL](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-getting-started.html) - [SECURITY HUB](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html) > #### 💡 TIP > > Amazon Security Lake uses the [OCSF Schema](https://schema.ocsf.io/) for its logs. Here are attributes you can find in Security Lake logs: **VPC Flow Logs** Query `Amazon VPC` logs to view data for the following attributes: | Name | Description | Data type | | ------------------------------- | --------------------------------------------------------- | --------- | | `activity_id` | activity ID | integer | | `activity_name` | activity name | string | | `aws.invoked_function_arn` | ARN of the invoked log forward function | string | | `aws.s3_bucket_name` | name of the S3 bucket where the log was forwarded from | string | | `aws.s3_key` | key record of the security event from the flow log | string | | `category_name` | name of the category of the log | string | | `category_uid` | unique ID of the category | integer | | `class_name` | name of the log class | string | | `class_uid` | unique ID of the class | integer | | `cloud.account_uid` | AWS account where the flow log originated | string | | `cloud.provider` | shows the name of the cloud provider - in this case `AWS` | string | | `cloud.region` | AWS region where the flow log originated | string | | `cloud.zone` | AWS zone where the flow log originated | string | | `connection_info.boundary` | boundary of the flow log | string | | `connection_info.boundary_id` | ID of the boundary | integer | | `connection_info.direction` | shows if the connection was inbound or outbound | string | | `connection_info.direction_id` | ID of the direction | integer | | `connection_info.protocol_num` | protocol number of the flow | integer | | `connection_info.protocol_ver` | protocol version | string | | `connection_info.tcp_flags` | TCP flags | integer | | `dst_endpoint.instance_uid` | instance ID of the destination | string | | `dst_endpoint.interface_uid` | interface ID of the destination | string | | `dst_endpoint.intermediate_ips` | intermediate IP addresses of the destination | string | | `dst_endpoint.ip` | IP address of the destination | string | | `dst_endpoint.port` | port of the destination | integer | | `dst_endpoint.subnet_uid` | subnet ID of the destination | string | | `dst_endpoint.svc_name` | service name of the destination | string | | `dst_endpoint.vpc_uid` | VPC ID of the destination | string | | `end_time` | end time of the flow | integer | | `logtype` | defines the logtype | string | | `metadata.product.feature.name` | name of the feature where the log originated | string | | `metadata.product.name` | name of the product where the log originated | string | | `metadata.product.vendor_name` | name of the vendor for the log; in this case `AWS` | string | | `metadata.product.version` | name of the product version | string | | `metadata.profiles` | names of the profiles | string | | `metadata.version` | metadata version | string | | `newrelic.source` | source of the log in New Relic | string | | `plugin.type` | type of plugin used | string | | `plugin.version` | version of plugin used | string | | `severity` | severity level of the log finding | string | | `severity_id` | ID of the severity level | integer | | `src_endpoint.instance_uid` | instance ID of the source | string | | `src_endpoint.interface_uid` | interface ID of the source | string | | `src_endpoint.intermediate_ips` | intermediate IP addresses of the source | string | | `src_endpoint.ip` | IP address of the source | string | | `src_endpoint.port` | port of the source | integer | | `src_endpoint.subnet_uid` | subnet ID of the source | string | | `src_endpoint.svc_name` | service name of the source | string | | `src_endpoint.vpc_uid` | VPC ID of the source | string | | `start_time` | start time | integer | | `time` | start time | integer | | `timestamp` | time of the log reaching New Relic | integer | | `traffic.bytes` | amount of bytes being sent or received | integer | | `traffic.packets` | amount of packets being sent or received | integer | | `type_name` | event type name | string | | `type_uid` | ID of the event type | integer | | `unmapped` | unparsed data not mapped to a field | string | **CloudTrail** Query `CloudTrail` logs to view data for the following attributes: | Name | Description | Data type | | ------------------------------- | --------------------------------------------------------- | --------- | | `activity_id` | activity ID | integer | | `activity_name` | activity name | string | | `api.operation` | operation of the API activity | string | | `api.request.uid` | unique ID of the API request | string | | `api.response.error` | error response of the API request | string | | `api.response.message` | message of the API response | string | | `api.service.name` | name of the service where the request originated | string | | `api.version` | API version | string | | `aws.invoked_function_arn` | ARN of the invoked log forward function | string | | `aws.s3_bucket_name` | name of the S3 bucket where the log was forwarded from | string | | `aws.s3_key` | key record of the security event from the flow log | string | | `category_name` | name of the category of the log | string | | `category_uid` | unique ID of the category | integer | | `class_name` | name of the log class | string | | `class_uid` | unique ID of the class | integer | | `cloud.provider` | shows the name of the cloud provider - in this case `AWS` | string | | `cloud.region` | AWS region where the flow log originated | string | | `http_request.user_agent` | user agent of the HTTP request | string | | `identity.idp.name` | IDP name of the requester | string | | `identity.invoked_by` | name of the feature invoking the request | string | | `identity.session.created_time` | session creation time | integer | | `identity.session.issuer` | ARN of the issuer | string | | `identity.session.mfa` | MFA enabled | boolean | | `identity.user.account_uid` | AWS account of the user | string | | `identity.user.credential_uid` | credential ID of the user | string | | `identity.user.name` | name of the user | string | | `identity.user.type` | type of user | string | | `identity.user.uid` | ID of the user | string | | `identity.user.uuid` | ARN of the user | string | | `logtype` | defines the logtype | string | | `metadata.product.feature.name` | name of the feature where the log originated | string | | `metadata.product.name` | name of the product where the log originated | string | | `metadata.product.vendor_name` | name of the vendor for the log; in this case `AWS` | string | | `metadata.product.version` | name of the product version | string | | `metadata.profiles` | names of the profiles | string | | `metadata.version` | metadata version | string | | `newrelic.source` | source of the log in New Relic | string | | `plugin.type` | type of plugin used | string | | `plugin.version` | version of plugin used | string | | `ref_event_uid` | unique ID for reference event | string | | `resources` | resources | string | | `severity` | severity level of the log finding | string | | `severity_id` | ID of the severity level | integer | | `src_endpoint.domain` | domain of the source | string | | `src_endpoint.ip` | IP address of the source | string | | `src_endpoint.uid` | unique ID of the source | string | | `time` | start time | integer | | `timestamp` | time of the log reaching New Relic | integer | | `type_name` | event type name | string | | `type_uid` | ID of the event type | integer | | `unmapped` | unparsed data not mapped to a field | string | **Security Hub Logs** Query `Security Hub` logs to view data for the following attributes: | Name | Description | Data type | | ------------------------------- | --------------------------------------------------------- | --------- | | `activity_id` | activity ID | integer | | `activity_name` | activity name | string | | `answers` | answers | string | | `aws.invoked_function_arn` | ARN of the invoked log forward function | string | | `aws.s3_bucket_name` | name of the S3 bucket where the log was forwarded from | string | | `aws.s3_key` | key record of the security event from the flow log | string | | `category_name` | name of the category of the log | string | | `category_uid` | unique ID of the category | integer | | `class_name` | name of the log class | string | | `class_uid` | unique ID of the class | integer | | `cloud.account_uid` | ID of the AWS account | string | | `cloud.provider` | shows the name of the cloud provider - in this case `AWS` | string | | `cloud.region` | AWS region where the flow log originated | string | | `connection_info.direction` | direction of the connection | string | | `connection_info.direction_id` | ID for the direction of the connection | integer | | `connection_info.protocol_name` | protocol of the connection | string | | `dst_endpoint.instance_uid` | destination instance ID | string | | `dst_endpoint.interface_uid` | destination interface ID | string | | `logtype` | defines the logtype | string | | `metadata.product.feature.name` | name of the feature where the log originated | string | | `metadata.product.name` | name of the product where the log originated | string | | `metadata.product.vendor_name` | name of the vendor for the log; in this case `AWS` | string | | `metadata.product.version` | name of the product version | string | | `metadata.profiles` | names of the profiles | string | | `metadata.version` | metadata version | string | | `newrelic.source` | source of the log in New Relic | string | | `plugin.type` | type of plugin used | string | | `plugin.version` | version of plugin used | string | | `query.class` | query class | string | | `query.hostname` | query hostname | string | | `query.type` | query type | string | | `rcode` | response code | string | | `rcode` | response code ID | integer | | `severity` | severity level of the log finding | string | | `severity_id` | ID of the severity level | integer | | `src_endpoint.instance_uid` | instance ID of the source | string | | `src_endpoint.ip` | IP address of the source | string | | `src_endpoint.port` | port of the source | integer | | `src_endpoint.vpc_uid` | VPC ID of the source | string | | `time` | start time | integer | | `timestamp` | time of the log reaching New Relic | integer | | `type_name` | event type name | string | | `type_uid` | ID of the event type | integer | | `unmapped` | unparsed data not mapped to a field | string | **Route 53 Resolver Query Logs** Query `Route 53` logs to view data for the following attributes: | Name | Description | Data type | | --------------------------------- | -------------------------------------------------------------- | --------- | | `activity_id` | activity ID | integer | | `activity_name` | activity name | string | | `aws.invoked_function_arn` | ARN of the invoked log forward function | string | | `aws.s3_bucket_name` | name of the S3 bucket where the log was forwarded from | string | | `aws.s3_key` | key record of the security event from the flow log | string | | `category_name` | name of the category of the log | string | | `category_uid` | unique ID of the category | integer | | `class_name` | name of the log class | string | | `class_uid` | unique ID of the class | integer | | `cloud.account_uid` | ID of the AWS account | string | | `cloud.provider` | shows the name of the cloud provider - in this case `AWS` | string | | `cloud.region` | AWS region where the flow log originated | string | | `compliance.requirements` | compliance requirements | string | | `compliance.status` | compliance status | string | | `compliance.status_detail` | details about the compliance status | string | | `confidence` | confidence | string | | `finding.created_time` | creation time of the finding | integer | | `finding.desc` | description of the finding | string | | `finding.first_seen_time` | time when the finding was first seen | integer | | `finding.last_seen_time` | time when the finding was last seen | integer | | `finding.first_seen_time` | time when the finding was first seen | string | | `finding.modified_time` | time when the finding was modified | integer | | `finding.related_events` | events related to the finding | string | | `finding.remediation.desc` | information about the remediation for the finding | string | | `finding.remediation.kb_articles` | knowledge base articles about the remediation for the findings | string | | `finding.src_url` | URL for the source of the finding | string | | `finding.title` | title of the finding | string | | `finding.types` | list of types relative to the finding | string | | `finding.uid` | ARN of the finding | string | | `logtype` | defines the logtype | string | | `malware` | malware | string | | `metadata.product.feature.name` | name of the feature where the log originated | string | | `metadata.product.name` | name of the product where the log originated | string | | `metadata.product.vendor_name` | name of the vendor for the log; in this case `AWS` | string | | `metadata.product.version` | name of the product version | string | | `metadata.profiles` | names of the profiles | string | | `metadata.version` | metadata version | string | | `newrelic.source` | source of the log in New Relic | string | | `plugin.type` | type of plugin used | string | | `plugin.version` | version of plugin used | string | | `process.created_time` | process creation time | string | | `process.file.name` | process file name | string | | `process.file.path` | process file path | string | | `process.file.type_id` | process file type ID | integer | | `process.name` | process name | string | | `process.parent_process.pid` | process ID of the parent process | string | | `process.pid` | process ID | string | | `process.terminated_time` | process termination time | string | | `resources` | resources | string | | `severity` | severity level of the log finding | string | | `severity_id` | ID of the severity level | integer | | `state` | state of the finding | string | | `state_id` | state ID of the finding | string | | `time` | start time | integer | | `timestamp` | time of the log reaching New Relic | integer | | `type_name` | event type name | string | | `type_uid` | ID of the event type | integer | | `unmapped` | unparsed data not mapped to a field | string | | `vulnerabilities` | vulnerabilities | string | ## How to use your data To know more about how to use your data, see [understand integration data](https://docs.newrelic.com/docs/infrastructure/infrastructure-integrations/get-started/understand-use-data-infrastructure-integrations/). ## Alerts You can set up alerts to notify you of breaking changes. For example, an alert can be set up to notify relevant parties of critical or fatal errors. Learn more about [creating alerts](https://docs.newrelic.com/docs/alerts-applied-intelligence/new-relic-alerts/learn-alerts/introduction-alerts/). ## Other AWS integrations Read more about New Relic AWS integrations: - [Route 53 monitoring](https://docs.newrelic.com/docs/infrastructure/amazon-integrations/aws-integrations-list/aws-route-53-monitoring-integration/) - [VPC Flow Logs monitoring](https://docs.newrelic.com/docs/network-performance-monitoring/setup-performance-monitoring/cloud-flow-logs/aws-vpc-flow-log-monitoring/) - [CloudTrail monitoring](https://docs.newrelic.com/docs/infrastructure/amazon-integrations/aws-integrations-list/aws-cloudtrail-monitoring-integration/) - [Ingest logs from S3](https://docs.newrelic.com/docs/logs/forward-logs/aws-lambda-sending-logs-s3/)