Add HTTP based log ingestion support

[rams3sh]

Problem Statement

Many of our internal integrations of devops are hosted outside AWS and all have webhook dispatch as common output mechanism . And the outputs from these dispatched alerts are required to be integrated with an external security data lake.

Proposal

If there can be an HTTP endpoint (something like an external facing AWS API gateway endpoint) to which an external integration can hit , many of these internal ingestion use cases can be solved.

Current solution being used to solve this

As of now I am planning to write a hacky integration of API gateway to matano's sqs to solve this.

To be considered

• State maintenance for tokens to be used by log pusher clients for authentication.

Reference Implementations

• Splunk HEC
• Loki