create_custom_log_source ¶

def create_custom_log_source(
    self,
    source_name: "capo_securitylake.types.custom_log_source_name.CustomLogSourceName",
    configuration: "capo_securitylake.types.custom_log_source_configuration.CustomLogSourceConfiguration",
    *,
    config_overrides: Optional[SecurityLakeClientConfig] = None,
    source_version: Optional[
        "capo_securitylake.types.custom_log_source_version.CustomLogSourceVersion"
    ] = None,
    event_classes: Optional[
        "capo_securitylake.types.ocsf_event_class_list.OcsfEventClassList"
    ] = None,
) -> "capo_securitylake.types.create_custom_log_source_response.CreateCustomLogSourceResponse":
    """<p>Adds a third-party custom source in Amazon Security Lake, from the Amazon Web Services Region where you want to create a custom source. Security Lake can collect logs and events from third-party custom sources. After creating the appropriate IAM role to invoke Glue crawler, use this API to add a custom source name in Security Lake. This operation creates a partition in the Amazon S3 bucket for Security Lake as the target location for log files from the custom source. In addition, this operation also creates an associated Glue table and an Glue crawler.</p>

    Args:
        source_name: <p>Specify the name for a third-party custom source. This must be a Regionally unique value. The <code>sourceName</code> you enter here, is used in the <code>LogProviderRole</code> name which follows the convention <code>AmazonSecurityLake-Provider-{name of the custom source}-{region}</code>. You must use a <code>CustomLogSource</code> name that is shorter than or equal to 20 characters. This ensures that the <code>LogProviderRole</code> name is below the 64 character limit.</p>
        source_version: <p>Specify the source version for the third-party custom source, to limit log collection to a specific version of custom data source.</p>
        event_classes: <p>The Open Cybersecurity Schema Framework (OCSF) event classes which describes the type of data that the custom source will send to Security Lake. For the list of supported event classes, see the <a href="https://docs.aws.amazon.com/security-lake/latest/userguide/adding-custom-sources.html#ocsf-eventclass">Amazon Security Lake User Guide</a>.</p>
        configuration: <p>The configuration used for the third-party custom source.</p>

    Raises:
        capo_securitylake.errors.access_denied_exception.AccessDeniedException: <p>You do not have sufficient access to perform this action. Access denied errors appear when Amazon Security Lake explicitly or implicitly denies an authorization request. An explicit denial occurs when a policy contains a Deny statement for the specific Amazon Web Services action. An implicit denial occurs when there is no applicable Deny statement and also no applicable Allow statement.</p>
        capo_securitylake.errors.bad_request_exception.BadRequestException: <p>The request is malformed or contains an error such as an invalid parameter value or a missing required parameter.</p>
        capo_securitylake.errors.conflict_exception.ConflictException: <p>Occurs when a conflict with a previous successful write is detected. This generally occurs when the previous write did not have time to propagate to the host serving the current request. A retry (with appropriate backoff logic) is the recommended response to this exception.</p>
        capo_securitylake.errors.internal_server_exception.InternalServerException: <p>Internal service exceptions are sometimes caused by transient issues. Before you start troubleshooting, perform the operation again.</p>
        capo_securitylake.errors.resource_not_found_exception.ResourceNotFoundException: <p>The resource could not be found.</p>
        capo_securitylake.errors.throttling_exception.ThrottlingException: <p>The limit on the number of requests per second was exceeded.</p>
        capo_securitylake.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_securitylake.types.create_custom_log_source_request.CreateCustomLogSourceRequest]",
    ) -> OperationResponse[
        "capo_securitylake.types.create_custom_log_source_response.CreateCustomLogSourceResponse"
    ]:
        import capo_securitylake._operations.security_lake.create_custom_log_source

        output, http_response = (
            capo_securitylake._operations.security_lake.create_custom_log_source.create_custom_log_source(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("CreateCustomLogSource")
    )
    input_: capo_securitylake.types.create_custom_log_source_request.CreateCustomLogSourceRequest = {
        "source_name": source_name,
        "configuration": configuration,
    }
    if source_version is not None:
        input_["source_version"] = source_version
    if event_classes is not None:
        input_["event_classes"] = event_classes

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output