Views:

Invoke the Log Scanner function deployed in your AWS account to send historical logs from Amazon S3 to TrendAI Vision One™.

Note
Note
This feature is not yet available in all regions.
After you add an Amazon S3 connector, TrendAI Vision One™ collects only new log files added to the bucket. Historical logs (log files uploaded before adding the connector) are not collected automatically. Before you begin, ensure that you have already added an Amazon S3 connector and confirm you have permission to view and invoke Lambda functions in the AWS account you onboarded.

Procedure

  1. Sign in to your AWS account and go to the Lambda console.
  2. Locate the tmv1-clm-s3g-<Region>-LogScanner function in the region where you deployed the CloudFormation template.
  3. Create a private test event for the function.
    Note
    Note
    For instructions on creating test events, see the AWS documentation.
  4. In the event JSON, specify the bucket and time range of the historical logs to collect.
    Note
    Note
    The following is an example of an event JSON. To limit the scan to a specific location, specify an Amazon S3 prefix for folder, such as logs/2026/06/. 
    {
                        "bucketName": "your-s3-bucket-name",
                        "startTimestamp": 1780444800,
                        "endTimestamp": 1781049600
                        }
    The maximum time range per invocation is 180 days. To collect historical logs spanning a longer period, invoke the function multiple times with consecutive time ranges.
  5. Run the test event to invoke the function.
    Tip
    Tip
    To collect historical logs on a schedule or as part of an automated workflow, invoke the function synchronously using the AWS CLI. For more information, see the AWS documentation.
  6. Confirm the execution result reports the number of files found before continuing.
  7. In TrendAI Vision One™, go to Agentic SIEM & XDR → Data Source and Log Management → Third-party log repositories → Collectors and verify the data received by Amazon S3.
    Tip
    Tip
    • Depending on the number and size of the files, log collection might take several minutes.
    • If no files were found, confirm that bucketName matches the configured bucket, and that both timestamps are Unix timestamps in seconds rather than milliseconds. If the invocation fails, confirm that the time range does not exceed 180 days and that startTimestamp is earlier than endTimestamp.