---
title: "AWS SQS collector"
canonical: "https://docs.devo.com/space/latest/94655615/AWS%20SQS%20collector"
format: markdown
---
> Macro (toc)

## Purpose

[AWS SQS](https://aws.amazon.com/sqs/) can be used to send any kind of data to Devo.  If the data is already located in AWS, then SQS should be used to send it to Devo.  The **AWS SQS collector** provides superior reliability, speed, security, and flexibility.

The AWS SQS collector is commonly used to secure services like [WAF](https://aws.amazon.com/waf/), [VPC](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html), [Control Tower](https://aws.amazon.com/controltower/), and [CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html).

## Send data to Devo

There are **three requirements **to send data to Devo with SQS.

- [Authorize SQS data access.](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1098121229)
- [Enable the collector with the service matching the data format.](https://devodocs.atlassian.net/wiki/spaces/latest/pages/653623299)
- Place data in the S3 bucket.

## Data sources

| **Data source** | **Security Purpose** | **Collector service name** | **Devo table** |
| --- | --- | --- | --- |
| Any | The collector can be customized to process any data.<br>Use a custom service only if there is no prebuilt service. | `custom_service` | All |
| [AWS CONFIGURATION LOGS](https://docs.aws.amazon.com/config/latest/APIReference/API_ConfigurationItem.html) | Cloud Resource Audit | `aws_sqs_config` | `cloud.aws.configlogs.events` |
| [AWS ELB](https://aws.amazon.com/elasticloadbalancing/) | Load Balancer | `aws_sqs_elb` | `web.aws.elb.access` |
| [AWS ALB](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html) | Load Balancer | `aws_sqs_alb` | `web.aws.alb.access` |
| [CISCO UMBRELLA](https://umbrella.cisco.com/) | DNS | `aws_sqs_cisco_umbrella` | `sig.cisco.umbrella.dns` |
| [CLOUDFLARE LOGPUSH](https://developers.cloudflare.com/logs/about/) | Content Distribution | `aws_sqs_cloudflare_logpush` | `cloud.cloudflare.logpush.http` |
| [CLOUDFLARE AUDIT](https://developers.cloudflare.com/logs/reference/log-fields/account/audit_logs/) | Content Distribution | `aws_sqs_cloudflare_audit` | `cloud.aws.cloudflare.audit` |
| [CLOUDTRAIL](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) | AWS Audit | `aws_sqs_cloudtrail` | `cloud.aws.cloudtrail.*` |
| CLOUDTRAIL VIA KINESIS FIREHOSE | AWS Audit | `aws_sqs_cloudtrail_kinesis` | `cloud.aws.cloudtrail.*` |
| [CLOUDWATCH](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_architecture.html) | Instance Metrics | `aws_sqs_cloudwatch` | `cloud.aws.cloudwatch.logs` |
| CLOUDWATCH [VPC](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html) | Private Cloud Metrics | `aws_sqs_cloudwatch_vpc` | `cloud.aws.vpc.flow` |
| [CONTROL TOWER](https://aws.amazon.com/controltower/) | In most cases, use the CloudTrail service instead.<br>VPC Flow Logs, Cloudtrail, Cloudfront, and/or AWS config logs | `aws_sqs_control_tower` |  |
| *deprecated* |  | `aws_sqs_fdr` | `edr.crowdstrike.cannon` |
| [CROWDSTRIKE FALCON DATA REPLICATOR](https://www.crowdstrike.com/en-us/resources/data-sheets/falcon-data-replicator/) | Antivirus | `aws_sqs_fdr_large` | `edr.crowdstrike.cannon` |
| [GUARD DUTY](https://aws.amazon.com/guardduty/) | Threat Detection | `aws_sqs_guard_duty` | `cloud.aws.guardduty.findings` |
| GUARD DUTY VIA KINESIS FIREHOUSE |  | `aws_sqs_guard_duty_kinesis` | `cloud.aws.guardduty.findings` |
| [IMPERVA FLEXPROTECT](https://www.imperva.com/products/flexprotect-plans/) | Content Delivery | `aws_sqs_incapsula` | `cef0.imperva.incapsula` |
| [LACEWORK](https://www.lacework.com/) | Container and Cloud | `aws_sqs_lacework` | `monitor.lacework.[agent].*` |
| [PALO ALTO](https://www.paloaltonetworks.com/) | Firewall | `aws_sqs_palo_alto` | `firewall.paloalto.[file-log_type]` |
| [ROUTE 53](https://aws.amazon.com/route53/) | Domain Name Service | `aws_sqs_route53` | `dns.aws.route53` |
| OPERATING SYSTEM | Windows and Unix events | `aws_sqs_os` | `box.unix_cloudwatch`<br>`box.win_cloudwatch` |
| [SENTINEL ONE FUNNEL](https://www.sentinelone.com/platform/singularity-cloud-funnel/) | Endpoint Detections | `aws_sqs_s1_funnel` | `edr.sentinelone.dv` |
| [S3 ACCESS](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html) | S3 Bucket Audit | `aws_sqs_s3_access` | `web.aws.s3.access` |
| [VPC LOGS](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html) | Private Cloud Metrics   
(published without CloudWatch) | `aws_sqs_vpc` | `cloud.aws.vpc.flow` |
| [WAF LOGS](https://aws.amazon.com/waf/) | Firewall | `aws_sqs_waf` | `cloud.aws.waf.logs` |

## Devo collector features

| **Feature** | **Details** |
| --- | --- |
| Allow parallel downloading (`multipod`) | `allowed` |
| Running environments | `Cloud Collector App` |
| Writes to | `table` |