AWS Inspector

Open in ChatGPTOpen in Claude

AWS Inspector continually scans AWS workloads for software vulnerabilities and unintended network exposure, combining agent-based and agentless assessments across network, host, and application security. Routing its findings to Coralogix through Amazon EventBridge puts vulnerability data next to the rest of your AWS telemetry.

What you need

• An EventBridge API destination and connection pointing at Coralogix. Create them by following the EventBridge integration.
• Permission to create EventBridge rules and IAM execution roles in the account Inspector runs in.

Create the EventBridge rule

1.

Define the rule

In EventBridge, create a rule. Enter a Name, select the Event bus the findings arrive on, and set Rule type to Rule with an event pattern. Select Next.

Shows the rule detail step, where the event bus and rule type are chosen.

2.

Match Inspector findings

Under Event pattern, set Event source to AWS services, AWS service to Inspector2, and Event type to Inspector2 Finding. EventBridge builds the matching pattern for you.

Shows the generated pattern that matches on aws.inspector2 and the Inspector2 Finding detail type.

3.

Point the rule at Coralogix

For the target, set Target types to EventBridge API destination and select the destination you created. Create a new Execution role, or select Use existing role and pick one. Select Next.

4.

Finish

Add Tags if you want them, select Next, then Create rule.

Related resources

Amazon EventBridge integrationSend-Your-Data API key