Skip to content

Commit

Permalink
Merge pull request #2038 from SEKOIA-IO/fix/OCSFPullingEvents
Browse files Browse the repository at this point in the history
OCSF: change the procedure to pull the events
  • Loading branch information
squioc authored Oct 2, 2024
2 parents 05bade4 + b90670d commit 9304855
Showing 1 changed file with 5 additions and 4 deletions.
9 changes: 5 additions & 4 deletions docs/integration/categories/generic/ocsf.md
Original file line number Diff line number Diff line change
Expand Up @@ -42,14 +42,15 @@ To create a subscriber:

### Pull events

Go to the [playbook page](https://app.sekoia.io/operations/playbooks) and create a new playbook with the [Fetch new S3 records on S3 connector](/integration/action_library/cloud_providers/aws#fetch-new-ocsf-records-on-S3).
Go to the [intake page](https://app.sekoia.io/intakes/new) and create a new intake with the OCSF format.

Set up the module configuration with the [AWS Access Key](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html), the secret key, and the region name. Set up the trigger configuration with the name of the SQS queue and the intake key from the previously created intake.
Type the name of the intake, select the entity and click `Next`.
Select or create an account with the [AWS Access Key](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html), the secret key, and the region name. Set up the configuration with the name of the SQS queue (Keep the last part from the arn of the `subscription endpoint`).

!!!important
In the "Trigger Configuration" settings of your OCSF playbook, we recommend using the following configuration by default: chunk_size = `10000` and frequency = `10`.
In the configuration settings of your OCSF intake, we recommend using the following configuration by default: chunk_size = `10000` and frequency = `10`.

Start the playbook and enjoy your events.
[Start the intake](https://docs.sekoia.io/xdr/features/collect/intakes/#startstop-a-pull-intake) and enjoy your events.

{!_shared_content/operations_center/integrations/generated/a9c959ac-78ec-47a4-924e-8156a77cebf5_sample.md!}

Expand Down

0 comments on commit 9304855

Please sign in to comment.