Integrate with AWS Security Lake using Contrast Assess

Integrate Contrast Assess with AWS Security Lake to automatically push findings and other relevant security data.

Before you begin

Before you start, you must have:

In AWS, go to AWS Security Lake.
Select Custom Source.
Click Create New Source.
Enter a Data source name of your choice.
Set the OCSF Event class to Security Finding.
Input the AWS account ID and External ID.
These IDs can be found under the AWS Security Lake section on the Integrations page in Contrast. From the user menu in Contrast select Organization settings > Integrations.
Once a custom source is created, retrieve the generated AWS Role ARN and the S3 ARN. These will be needed for connecting to AWS.
Continue with connecting to AWS Security Lake.

In Contrast, go to the user menu and select Organization settings > Integrations.
Find and select the AWS Security Lake integration section.
Select Manage Credentials.
Enter the generated AWS Role ARN and the S3 ARN from before.
Choose the AWS Region from the list or enter it manually.
Select Save.
Continue by setting up applications in Contrast Assess.

Once your credentials are set up, proceed to configure the applications:

In the AWS Security Lake integration section in Contrast, select Configure Applications.
Select whether to activate the AWS Security Lake integration for all Assess applications or select specific application names from a list.
Select Save.

In case synchronization between Contrast Assess and AWS Security Lake fails, a retry mechanism ensures data reliability:

If an event fails to sync, it will be stored and retried every night at midnight GMT.
The retry count will increase by one with a maximum of three retries for up to 72 hours. After the third unsuccessful retry, the event will be discarded.
If a vulnerability creation event fails and is stored, any subsequent update or delete action relating to that failed event will be stored and replayed in chronological order to maintain the correct state.

In this section: