Source types for the Splunk Add-on for Amazon Kinesis Firehose

The Splunk Add-on for Amazon Kinesis Firehose provides knowledge management for the following Amazon Kinesis Firehose source types:

Data source	Source type	CIM compliance	Description
CloudTrail events	aws:cloudtrail	Change Analysis, Authentication, Change	AWS API call history form the AWS CloudTrail service, delivered as CloudWatch events. For CloudTrail events embedded within CloudWatch events, override the source name optional field aws_firehose_cloudtrail in the HTTP Event Collector (HEC) token for index-time field extractions. Change data model includes the Network dataset for some fields.
CloudWatch events	aws:firehose:cloudwatchevents	None	Data from CloudWatch. You can extract CloudTrail events embedded within CloudWatch events with this sourcetype as well.
GuardDuty events	aws:cloudwatch:guardduty	Alerts, Intrusion Detection	GuardDuty events from CloudWatch. For GuardDuty events embedded within CloudWatch events, override the source name optional field with aws_cloudwatchevents_guardduty in the HEC token for index-time field extractions.
Amazon Identity and Access Management (IAM) Access Analyzer events	aws:accessanalyzer:finding	None	Using Eventbridge event bus to ingest the events, set the source to aws_eventbridgeevents_iam_aa when configuring the HEC token.
Amazon Kinesis Firehose JSON data	aws:firehose:json	None	Any JSON formatted Firehose data.
Amazon Kinesis Firehose text data	aws:firehose:text	None	Firehose raw text format.
AWS Security Hub	aws:securityhub:finding	Alerts	Collect events from AWS Security Hub. For AWS Security Hub events embedded within AWS CloudWatch events, override the source name optional field with aws_cloudwatchevents_securityhub in the HEC token for index-time field extractions.
VPC Flow Logs	aws:cloudwatchlogs:vpcflow	Network Traffic	VPC Flow Logs from CloudWatch. VPC Flow Logs must be preprocessed by an AWS Lambda function to extract the nested JSON events correctly into a newline-delimited set of events before sending the data to the Splunk platform. When ingesting CloudWatch logs, set the Lambda buffering size to 1 MB. See data transformation flow in the Amazon Kinesis Firehose documentation for more information.