> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truu.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# S3 Event Logging Adapter Setup Guide

> This guide provides a detailed walkthrough on how to configure the TruU S3 Event Logging Adapter. This adapter allows TruU to export events from the TruU Admin Console to an AWS S3 bucket. Administrators can then import these events into their event monitoring systems, such as Splunk, for centralized monitoring, alerting, and reporting.

## Creating a TruU S3 Event Logging Adapter

**Step 1:** Log into the TruU Admin Console and navigate to the "Integrations" tab.

<img src="https://mintcdn.com/truu-2/E6hYbyLPrBHWbQ3m/images/docs/ce8d09131b8308fd206fcf8c526ffa7bc550bb108a33e401e98f0a5dfdfc1307-image.png?fit=max&auto=format&n=E6hYbyLPrBHWbQ3m&q=85&s=d121d936b36f826b57ce212a27f32491" alt="" width="132" height="536" data-path="images/docs/ce8d09131b8308fd206fcf8c526ffa7bc550bb108a33e401e98f0a5dfdfc1307-image.png" />

**Step 2:** Navigate to the **Adapters** tab and click **(+)** to create a new TruU adapter.

<img src="https://mintcdn.com/truu-2/jMF4bYA9yOA_2TKv/images/docs/2c1aa0a-image.png?fit=max&auto=format&n=jMF4bYA9yOA_2TKv&q=85&s=7044039ef1bf7402575231b5aa0c000c" alt="" width="1692" height="528" data-path="images/docs/2c1aa0a-image.png" />

**Step 3:** Select the **Event Logging** adapter and choose the **Event Logging** adapter type from the dropdown menu.

<img src="https://mintcdn.com/truu-2/qCK1oWL4jNpZKJ8A/images/docs/a19a8eb-image.png?fit=max&auto=format&n=qCK1oWL4jNpZKJ8A&q=85&s=5cf11594ca828d790188b45079f67ddf" alt="" width="618" height="496" data-path="images/docs/a19a8eb-image.png" />

**Step 4:** For AWS S3, select S3 Event Logging from the Select Adapter Type Drop down. Enter *a name for the adapter, the bucket name, access key identifier, and access secret from your AWS administrator console*. Select the event types to export to your infrastructure and click **Create** to add a new event logging adapter instance.

<img src="https://mintcdn.com/truu-2/E6hYbyLPrBHWbQ3m/images/docs/ca901a5c3fa919c5100be6d81a83b363b50380148af36f4f1d6404715a077d3d-image.png?fit=max&auto=format&n=E6hYbyLPrBHWbQ3m&q=85&s=bb57837e8bffff3518a9737b8399d677" alt="" width="448" height="636" data-path="images/docs/ca901a5c3fa919c5100be6d81a83b363b50380148af36f4f1d6404715a077d3d-image.png" />

Please note:

* The AWS service account configured for the adapter must have write permissions to the AWS S3 bucket.
* The AWS S3 access key and secret are encrypted and stored in Amazon’s Hardware Security Module (HSM).
* TruU exports events every 15 minutes. If an error occurs during an export, a notification message is displayed in the TruU management console. An error message will also be displayed if there is no event data for TruU to export.
* When the adapter is initially deployed, TruU will export events from the previous 7 days from which the adapter was first deployed.

## Managing TruU S3 Event Logging Adapters

**Step 1:** To edit an existing TruU S3 Event Logging Adapter in your TruU Admin Console, click on the adapter instance. You're then able to edit the adapter name, edit S3 bucket name, update S2 access key, update S3 access secret, and/or toggle the adapter from **Active** to **Inactive**.

The adapter **Version**, when the adapter was **Last Heard From**, and the **Date Registered** are also available for each adapter from the **Integration** > **Adapter** menu. Use these parameters to monitor the operation of your adapters.

## Event Logging Structure

The expanded view of the data in the Events table now consists of the following elements:

1. Basic information about the event (e.g. Type, Domain ID, when the even was published, etc.).
2. **Actor:** this is a new data object that represents the user (and expands to provide additional information about the user).
3. **Device:** this is a new data object that represents the hardware used by the actor (and expands to provide additional information about the device.)
4. **Client:** this is a new data object that represents the client (TruU Agent, App or browser) used by the actor (and expands to provide additional information about the client).
5. **Targets:** this is a new data object that represents the targets (e.g., the resource the user was trying to access) used by the actor (and expands to provide additional information about the target).
6. **Message:** this is the message included for the event.

<img src="https://mintcdn.com/truu-2/jJ0QGEHfTe0CfrEY/images/docs/a8cfe83b-31f5-4a65-a045-f9a5073b0415/a1961d48-2877-4737-9cb0-cf9ca28e6fd6/77dc3a60-cc64-4400-9870-84f0dae34566/images/a5f26f48-4b6f-48a6-b5d6-d0d00ea1ae89.png?fit=max&auto=format&n=jJ0QGEHfTe0CfrEY&q=85&s=bb845f4fddc076c052922c94e64c4da6" alt="" width="2634" height="850" data-path="images/docs/a8cfe83b-31f5-4a65-a045-f9a5073b0415/a1961d48-2877-4737-9cb0-cf9ca28e6fd6/77dc3a60-cc64-4400-9870-84f0dae34566/images/a5f26f48-4b6f-48a6-b5d6-d0d00ea1ae89.png" />

In addition, when extracting the Event data (either by sending a report from the Events page, or through one of the Event Logging Adapters), the format of the data now includes the expanded data that is available in the Events table.

NOTE: To ensure backwards compatibility if customers have built automated processing of the data, we have not changed the data structure for existing Event Logging adapters. However, customers can change that by editing the existing Adapters and choosing the “Version 2 (new structured event format)”. New adapters added in the future will only support the Version 2 format.

<img src="https://mintcdn.com/truu-2/jJ0QGEHfTe0CfrEY/images/docs/a8cfe83b-31f5-4a65-a045-f9a5073b0415/a1961d48-2877-4737-9cb0-cf9ca28e6fd6/77dc3a60-cc64-4400-9870-84f0dae34566/images/b539b7a2-455b-499b-9392-c1ffc1ab16ad.png?fit=max&auto=format&n=jJ0QGEHfTe0CfrEY&q=85&s=f9da78e0d9d0186311fe69cbf619aa66" alt="" width="922" height="1080" data-path="images/docs/a8cfe83b-31f5-4a65-a045-f9a5073b0415/a1961d48-2877-4737-9cb0-cf9ca28e6fd6/77dc3a60-cc64-4400-9870-84f0dae34566/images/b539b7a2-455b-499b-9392-c1ffc1ab16ad.png" />

***

[PACS Adapter](/docs/self-managed-pacs-adapter)

[Webhook Event Logging Adapter Setup Guide](/docs/copy-of-s3-event-logging-adapter-setup-guide)
