Prisma Cloud: EventBus Errors appearing under Audit Logs Status
2991
Created On 09/26/24 11:52 AM - Last Modified 10/30/24 18:54 PM
Symptom
EventBus Errors appearing under Audit Logs Status although there might have been no changes to either Prisma Cloud or AWS environments.
If you have configured your AWS account or organization to ingest audit logs through EventBridge, you might see a warning message stating:
Rule <prisma-cloud-your-tenant-id-audit-logs-rule> does not exist on EventBus default in <region>
Settings > Cloud Providers > Edit Cloud Acct
Environment
- Prisma Cloud
- AWS
- Audit logs
Cause
This warning is due to performance enhancements in the EventBridge rule configuration, which do not affect system functionality.
Resolution
- To resolve the warning, download the CloudFormation Template (CFT) from Misconfigurations > Near Real-Time Visibility > Edit, and update your CFT stack in AWS.
- Updating the CFT will result in an increase in the number of EventBridge rules enabling Prisma Cloud to ingest only the relevant audit logs.
Additional Information
For additional information regarding Audit Logs please refer here .