Skip to main content
Clarion connects to AWS to ingest CloudTrail events, CloudWatch alarms, and GuardDuty findings, and to run agent tools (CloudTrail lookup, Route 53, CloudWatch queries) against your account. There are a few different ways to get your AWS telemetry into Clarion. Pick the path that matches how your AWS logging is already set up - you can combine more than one.

​
Choose a setup path

AWS via EventBridge and SNS - The complete setup. Forward CloudTrail management events and GuardDuty findings to Clarion in real time through EventBridge and SNS, wire up CloudWatch alarms, and create the IAM role for agent tools. CloudTrail via existing S3 bucket - Already logging CloudTrail to S3 (or using a tool like Red Canary)? Have Clarion read each new log file from the bucket via an S3 event notification. Ideal for organization-wide, centralized logging.

​
How AWS data reaches Clarion

Every path delivers events to Clarion through an SNS topic that publishes to a Clarion webhook URL over HTTPS. They differ in how events get into that topic:
Note: Clarion only accepts SNS messages from topic ARNs you have saved on the matching monitor. Whichever path you choose, copy the exact SNS topic ARN into Clarion before confirming the subscription.
Warning: CloudTrail via S3 sends Clarion a pointer to a log file, not the CloudTrail event body. Clarion must be able to assume an AWS role that can read that S3 object. See CloudTrail via existing S3 bucket for the required IAM setup.

​
Agent tools

Running Clarion’s AWS agent tools (CloudTrail lookup, Route 53, CloudWatch queries, Athena) requires an IAM role that Clarion can assume. That role is covered in the AWS via EventBridge guide and in the CloudTrail via S3 guide - set it up once per connected account.