Note: After selecting the Notification Type you will be presented other fields to populate. At a minimum, you must specify a Protocol and Endpoint. The other fields can be populated as described above.
Note: If you left it as seen here, every scan result (clean, infected, unscannable, error and infectedAllowed) would be sent to your email. Generally, you may want to limit down to infected and unscannable to limit the number of emails received. This is up to your requirements, so do as you see fit. As described above, you can filter the results by result, bucket or account and proper combinations of those.
Manual Setup - Email
1. Login to the AWS console and navigate to the region where the console is deployed\ \&#xNAN;*If you are unsure of which region the console is deployed in, you can view the* [*Console Settings*](https://help.cloudstoragesec.com/console-overview/configuration/console-settings) *page to find it.*
2. Navigate to the Simple Notification Service (SNS) service\
\&#xNAN;*You can search for the service or find it under Application Integration*
*You'll land at the SNS Dashboard. You may have different numbers of existing Topics and Subscriptions*
3. Click on Topics as indicated above and then click on the Notifications Topic\
\&#xNAN;*The Topic will be named `CloudStorageSecNotifications-Manual Setup - SQS
**This is how you subscribe an SQS queue to an SNS topic from a linked account (SQS-LinkedAccount) -> (SNS-Primary)** The way to manage the SQS-SNS, is by subscribing to the SQS from SNS, but not the other way around for some unknown reason, is the only way it works with AWS. 1. Add:\ "sqs:GetQueueAttributes", "sqs:SetQueueAttributes" permissions to the **CloudStorageSecConsolePolicy** in the Primary account 2. Create an SQS queue in the Linked account with the following **SQS Access policy**:{
"Version": "2008-10-17",
"Id": "__default_policy_ID",
"Statement": [
{
"Sid": "__owner_statement",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<PRIMARY_ACCOUNT_ID>:root"
},
"Action": "SQS:*",
"Resource": "arn:aws:sqs:<region>:<LINKED_ACCOUNT_ID>:<SQS-Queue-Name>"
},
{
"Sid": "topic-subscription-arn:aws:sns:us-east-1:< PRIMARY_ACCOUNT_ID>:<CloudStorageSecNotificationsTopic-app-id>",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "SQS:SendMessage",
"Resource": "arn:aws:sqs:<region>: <LINKED_ACCOUNT_ID>:<SQS-Queue-Name>",
"Condition": {
"ArnLike": {
"aws:SourceArn": "arn:aws:sns:<region>:< PRIMARY_ACCOUNT_ID>:<CloudStorageSecNotificationsTopic-app-id>"
}
}
}
]
}
Setup the Event Bus
Create Rule
Create Rule: Step 1 Details
Step2. Build Event Pattern
Step 3. Select target(s)
Step 4. Configure tags
CloudWatch logs
CloudWatch Log Event Example
Scan Result - Clean
```json { "Type" : "Notification", "MessageId" : "bd433133-294e-52d9-9503-689132de2d6e", "TopicArn" : "arn:aws:sns:eu-west-1:Scan Result - Infected
```json { "Type" : "Notification", "MessageId" : "45927ed5-6884-542e-96c6-27777317db99", "TopicArn" : "arn:aws:sns:eu-west-1:Scan Result - Infected with Mixed Result
```json { "Type" : "Notification", "MessageId" : "52e1b014-a19d-5d32-8717-e9b6ba0d2df0", "TopicArn" : "arn:aws:sns:eu-west-1:New Bucket Found
```json { "Type" : "Notification", "MessageId" : "32373388-32b3-5303-a28e-6b3394954bc4", "TopicArn" : "arn:aws:sns:us-east-1:Public Bucket Found
```json { "Type" : "Notification", "MessageId" : "861b8ed9-116c-5eef-b906-d662b742f907", "TopicArn" : "arn:aws:sns:us-east-1:Bucket Protection Turned Off
```json { "Type" : "Notification", "MessageId" : "2c547302-6e33-563d-b986-2aa07c26762a", "TopicArn" : "arn:aws:sns:eu-west-1:Product Upgrade Available
```json { "Type" : "Notification", "MessageId" : "7b11beaf-0ca6-5c7c-b7d1-e73fbad71b86", "TopicArn" : "arn:aws:sns:eu-west-1:| Key Name | Description |
|---|---|
| NotificationType | You can get all classification results but just setting this attribute to
|
| ClassificationResult | Secondary attribute to allow filtering by the scan result itself
|
| Buckets | Secondary attribute to provide filtering by bucket name. Useful if you want different subscriptions/notifications for different buckets to have different outcomes or go to different teams. You can provide more than 1 bucket name if desired in a comma separate list. Possible values: your_bucket_name(s) |
| Accounts | For multi-account environments this allows you to filter at the account level. Similar to bucket, you could have different processes or teams responsible at the account level and so need separate subscriptions to notify those particular teams. Can be used with ClassificationResults, BucketsDiscovered, BucketProtection, BucketCrawling, BucketPublicAccess |
Note: After selecting the Notification Type you will be presented other fields to populate. At a minimum, you must specify a Protocol and Endpoint. The other fields can be populated as described above.
Note: If you left it as seen here, every scan result (clean, infected, unscannable, error and infectedAllowed) would be sent to your email. Generally, you may want to limit down to infected and unscannable to limit the number of emails received. This is up to your requirements, so do as you see fit. As described above, you can filter the results by result, bucket or account and proper combinations of those.
Manual Setup - Email
1. Login to the AWS console and navigate to the region where the console is deployed\ \&#xNAN;*If you are unsure of which region the console is deployed in, you can view the* [*Console Settings*](https://help.cloudstoragesec.com/console-overview/configuration/console-settings) *page to find it.*
You'll land at the SNS Dashboard. You may have different numbers of existing Topics and Subscriptions
You will land on the details page for the Topic
Note: You will have to confirm your subscription as AWS indicates. Go to the email address you specified and click the link within it after you finish creating the subscription.
```json { "notificationType" : ["classificationResult"], "classificationResult" : ["Matching", "Error", "Unclassifiable", "NonMatching"], "bucket" : ["your_bucket_name(s)"] } ``` * ```
Sample Messages - JSON
```json { "date": "2022-05-20", "guid": "60ea309d-b0f5-4b14-a0a2-76ff49bd210f", "dateTime": "2022-05-20T16:08:50.716198Z", "accountId": "351727022968", "region": "us-east-1", "container": "class-trigger-bucket-3", "objectPath": "Employee List.xlsx", "innerFilePath": null, "textMatchingSet": [ { "cclName": "SocialsecuritynumbersUSA", "score": 1, "triggered": true, "matchesCount": 1 } ], "error": null, "resultType": 1 } ```
Configure Email Report
Email Report