Amazon S3
SIEM & Observability
Amazon S3 is AWS's object storage service. Dash writes filtered security events to a bucket you own as gzip-compressed NDJSON files, partitioned by tenant, event type and UTC hour. Dash assumes a cross-account IAM role and writes only under the prefix you set.
What you get
Gzip-compressed NDJSON batches in your own bucket
Objects partitioned by tenant, event type and UTC hour
Writes only under the prefix you configure
Access through a cross-account IAM role
Filter by event type, audit category and status
Raw Dash event JSON, one event per line
