Updating a data subscriber in Security Lake - Amazon Security Lake

Updating a data subscriber in Security Lake

You can update a subscriber by changing the sources from which the subscriber consumes. You can also assign or edit the tags for a subscriber. A tag is a label that you can define and assign to certain types of AWS resources, including subscribers. To learn more, see Tagging Security Lake resources.

Choose one of the access methods, and follow these steps to define new sources for an existing subscription.

Console

  1. Open the Security Lake console at https://console.aws.amazon.com/securitylake/.

  2. In the navigation pane, choose Subscribers.

  3. Select the subscriber.

  4. Choose Edit, and then do any of the following:

    • To update the sources for the subscriber, enter the new settings in the Log and event sources section.

    • To assign or edit tags for the subscriber, change the tags as necessary in the Tags section.

  5. When you finish, choose Save.

API

To update data access sources for a subscriber programmatically, use the UpdateSubscriber operation of the Security Lake API. If you're using the AWS Command Line Interface (AWS CLI), run the update-subscriber command. In your request, use the sources parameters to specify each source that you want the subscriber to access.

$ aws securitylake update-subscriber --subscriber-id subscriber ID

For a list of subscribers associated with a specific AWS account or organization, use the ListSubscribers operation. If you're using the AWS Command Line Interface (AWS CLI), run the list-subscribers command.

$ aws securitylake list-subscribers

To review the current settings for a particular subscriber, use the GetSubscriber operation. run the get-subscriber command. Security Lake then returns the subscriber's name and description, external ID, and additional information. If you're using the AWS Command Line Interface (AWS CLI), run the get-subscriber command.

To update the notification method for a subscriber, use the UpdateSubscriberNotification operation. If you're using the AWS Command Line Interface (AWS CLI), run the update-subscriber-notification command. For example, you can specify a new HTTPS endpoint for the subscriber or switch from an HTTPS endpoint to an Amazon SQS queue.