Objective 

Prerequisites 

• An adequate number of Application licenses needs to be available. EventLog Analyzer consumes one application license for each import and each unique log format identified during log file import. Importing the same file twice with different formats will consume two licenses.
• The file to be imported has to be plain text and not encrypted. EventLog Analyzer archived files with .zip, .gz and .7z formats are supported for import.
• An AWS cloud account needs to be added in EventLog Analyzer.
  If you do not want to audit your cloud account, but you want to import the logs from S3, you can add the cloud account in the Import tab with the minimum permission user to read the files from S3 bucket. To create an IAM user with minimum permission for the log import on the S3 Bucket, refer to this link.

Steps to follow 

Step 2: Click the link displayed to configure the AWS account.

Tips 

1. Log import consumes one Application license for each import performed. If you are importing for analysis, you can select the Store Logs for Short-term option, which will store the imported log data in EventLog Analyzer for two days. If the option is left unchecked, the logs will be stored as per data retention configuration.
2. Log format will be set as Automatically Identify by default. The application will identify the Log format automatically, and based on that, the parsing will be achieved. You can create a Custom log format if the log format is not available in the list or if it is a custom application. 
3. Log import for EVT/EVTX is available only for Windows instances and for direct import only.
4. The Scheduled import option is available in both Remote and S3 bucket imports.