--- title: "Push Data to a Red Canary-Managed Amazon S3 Bucket" slug: "integrate-your-aws-s3-data-source-with-the-security-data-lake" updated: 2026-10-07T17:15:14Z published: 2026-10-07T17:15:14Z canonical: "docs.redcanary.com/integrate-your-aws-s3-data-source-with-the-security-data-lake" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt > Use this file to discover all available pages before exploring further. # Push Data to a Zscaler MDR-Managed Amazon S3 Bucket Any external data source that can be configured to forward logs to an Amazon S3 bucket using access keys can forward data to the Zscaler Security Data Lake. All data forwarded in this way is [storable and exportable](/doc/docs/search-and-export-data-from-the-security-data-lake) from the Security Data Lake, and if it is newline-delimited JSON, it can be queried via the [Search](/doc/docs/searching-your-data) page and [used as context](/doc/docs/view-investigations#related-data-by-query-tab) in threat investigations. ## How does it work? This ingest method works by creating a Zscaler MDR-managed Amazon S3 bucket/folder that you can use to receive logs from your external data source. You will be provided a fully qualified URL containing the bucket name, folder name (i.e.: prefix), and region to which you will point your external data source. Authentication is handled via Amazon’s long-term access keys. If your data source only supports role assumption for authentication, consider using the [Data Source via S3 (Self-Managed)](/doc/docs/pull-data-from-your-self-managed-amazon-s3-bucket) ingest method instead. By integrating your security logs with the Zscaler Security Data Lake, you can meet data retention requirements, export logs when needed for investigation or reporting, and ensure greater visibility into your security infrastructure for your team and Zscaler MDR. To integrate an external data source with Zscaler MDR through a Zscaler MDR-managed Amazon S3 bucket, follow the procedure below from beginning to end. ## Prerequisites Before you start the Amazon S3 integration, please make sure the following requirements are met: 1. You have an active Zscaler Security Data Lake license. 2. You have validated that your external data source supports log forwarding to Amazon S3 using access keys. 3. You have validated that your external data source emit logs in a supported format. 1. Ensure that your data source is configured to emit logs as either gzip, zstd, or uncompressed files. 2. When possible, we recommend configuring your external data source to emit logs as newline-delimited JSON to maximize your visibility into the data, but any line-delimited text format can be ingested. 4. You have appropriate admin permissions to make configuration changes to your external data source. ## 1 | Zscaler MDR | Add a new data lake integration 1. In the Zscaler MDR portal, navigate to **Integrations**, click the split button to the right of **Add Integration**, and click **Add Data Lake Integration**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(317).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A15Z&se=2026-11-04T16%3A12%3A15Z&sr=c&sp=r&sig=BRUyImIxicKA7NvrdOxF1PgXwklFk6jt2EscIHSBGmE%3D) 2. Next to **Add Integration**, enter a name for your integration. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(439).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A15Z&se=2026-11-04T16%3A12%3A15Z&sr=c&sp=r&sig=BRUyImIxicKA7NvrdOxF1PgXwklFk6jt2EscIHSBGmE%3D) 3. Choose how Zscaler MDR will receive this data: 1. Under **Ingest Format / Method**, select **Data Source via S3 (Managed by Zscaler MDR)**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(440).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A15Z&se=2026-11-04T16%3A12%3A15Z&sr=c&sp=r&sig=BRUyImIxicKA7NvrdOxF1PgXwklFk6jt2EscIHSBGmE%3D) 2. Click the **Next** button. 4. Configure Zscaler MDR to retrieve data from this integration: 1. Click the **Provision** button. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(408).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A15Z&se=2026-11-04T16%3A12%3A15Z&sr=c&sp=r&sig=BRUyImIxicKA7NvrdOxF1PgXwklFk6jt2EscIHSBGmE%3D) 2. This will save and activate your integration. If successful, you should get a “User provisioned successfully” notification. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(414).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A15Z&se=2026-11-04T16%3A12%3A15Z&sr=c&sp=r&sig=BRUyImIxicKA7NvrdOxF1PgXwklFk6jt2EscIHSBGmE%3D) 3. Under **Set up log forwarding in your external log source**, there will be an **S3 Folder URL**, **AWS Access ID**, and **AWS Secret Key** that you can use to send data to Zscaler MDR. Copy and save these values. You will use them in a later step. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(415).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A15Z&se=2026-11-04T16%3A12%3A15Z&sr=c&sp=r&sig=BRUyImIxicKA7NvrdOxF1PgXwklFk6jt2EscIHSBGmE%3D) > [!NOTE] > The AWS Access ID and AWS Secret Key can take time to generate. If they say “(pending…)”, wait 10 minutes and reload the page. 4. Click the **Next** button. 5. Customize how data from this integration is handled: 1. Specify your desired data retention period in days. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(410).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A15Z&se=2026-11-04T16%3A12%3A15Z&sr=c&sp=r&sig=BRUyImIxicKA7NvrdOxF1PgXwklFk6jt2EscIHSBGmE%3D) 6. Click **Save** in the bottom right corner. ## 2 | External Data Source | Configure log forwarding 1. From your external data source, set up log forwarding using the **S3 Folder URL**, **AWS Access ID**, and **AWS Secret Key** values noted in the previous section. 2. Ensure that the data source is configured to emit logs as either gzip, zstd, or uncompressed files. 3. If possible, ensure that the data source is configured to emit logs as newline-delimited JSON. Other line-delimited formats are supported for data retention only. > [!NOTE] > Examples of line-delimited file formats: newline separated JSON, CSV, TSV, CEF, CLF, etc.