Integration: Amazon EventBridge (previously CloudWatch Events)

You need to set up an Amazon SNS topic for this integration!

Important changes in your AWS account are published as events to Amazon EventBridge (previously CloudWatch Event). Events are generated when a Backup Job fails, an EC2 Spot Instance is interrupted, or much more.

The following example connects Root User login events with marbot.

Monitoring root user logins

Your AWS account’s root user should never be used. Instead, you create IAM users. If the root user logs in, this should be suspicious. With marbot, you can receive an alert when the root user logs in.

Creating a Rule to capture events

CloudTrail only sends events to EventBridge if a trail is created!

1. Add marbot to Slack or Microsoft Teams.
2. Invite marbot to a channel.
3. Send @marbot Create an SNS topic to the channel.
4. Follow the wizard in the channel.
5. Visit the Amazon EventBridge Console.
6. Click on the Create rule button.
7. Set a Name.
8. In the Define pattern section:
   1. Select Event pattern.
   2. Then, select Pre-defined pattern by service.
   3. Set the Service provider to AWS.
   4. Set the Service Name to AWS Console Sign-in
   5. Set the Event Type to Sign-in Events
   6. Select Specific user(s) by ARN and insert arn:aws:iam::ACCOUNT_ID:root below (replace ACCOUNT_ID with your AWS account ID ).
      
9. In the Select targets section:
   1. Select SNS topic in the head
   2. Select the Topic marbot-standalone-topic created earlier.
      
10. Save by clicking the Create button.

Sample Alert

When you log in to the AWS Management Console with the root user, you should receive an alert in Slack:

Event types with Quick Links

marbot enriches the following AWS-supported event types with Quick Links for fast access to resources in the AWS UI.