Skip to main content

AWS EventBridge (On-Premise Only)

Alert events generated by an on-premise AlphaSOC Analytics Engine instance can be sent to Amazon's EventBridge. For details on what Event Bridge is, see

Creating an Event Bus

Before augmenting your AE configuration, create an event bus by navigating to Amazon EventBridge Event buses and under Custom event bus click Create event bus. Give the bus a name and click Create.


Add EventBridge Output to AE

Modifying your AE configuration can be done using the UI bundled with the on-premise AE installation. Please see the On-Premise Installation Guide for details.

Append an eventbridge section to the outputs used by AE as below.

NOTE: Please replace <AWS_ID> and <AWS_REGION> with valid entries based on your AWS ID and the region in which you created the event bus above.

eventbusarn: arn:aws:events:<AWS_REGION>:<AWS_ID>:event-bus/ae-event-bus
region: <AWS_REGION>

IMPORTANT: Please be sure to restart AE using the UI for the changes to take effect.

Example Event Bus Usage

Once AE has been restarted with the above configuration, any alert events generated by AE will be delivered to the designated event bus which can serve as a producer for custom applications or other AWS services. One such service is AWS CloudWatch. This section will show how to use CloudWatch to verify the above configuration.

Navigate to CloudWatch > Log groups and click Create log group. Give the group a name starting with /aws/events/ and click Create.


Next, navigate to Amazon EventBridge > Rules, select the appropriate event bus and click Create rule.


Give the rule a name, make sure the correct event bus is selected and click Next.


Next, under Event source select All events and click Next.


Select AWS service as the target type and under Select a target choose CloudWatch log group. For the Log group, select the log group created above. and click Next.


Skip the Configure tags - optional section. Review the configuration and click Create rule.

Finally, navigate back to CloudWatch > Log groups and click on your newly created log group. Any new alert events generated by your on-premise AE instance should arrive under Log streams.