Quick Setup Overview

This guide walks you through connecting Scanner to your AWS environment and ingesting your first logs. The entire process typically takes 30-45 minutes.

Overview

Scanner has two moving parts, and each can run in your AWS account or in Scanner's:

• Compute (indexing, detections, search) runs in Scanner's AWS account with Managed Scanner, or in your own AWS account with BYOC Scanner. BYOC deployments are provisioned with the Scanner team; see BYOC / Self-Hosted.
• Storage (the collect buffer and index buckets) lives in S3 buckets you own by default, or in a Scanner-owned AWS account.

Logs already in your own S3 buckets are indexed in place either way. This guide walks the most common path: Managed Scanner compute with storage in your own AWS account.

If Scanner hosts your storage, the Scanner team completes Step 1 for you during onboarding.

What you'll accomplish:

1. Set up AWS infrastructure and link your account to Scanner
2. Configure Scanner to index your logs
3. Connect your first data source
4. Validate data is flowing and searchable

Before You Begin

Required Permissions: Not needed if Scanner hosts your storage. Otherwise, the person performing setup needs AWS permissions to create:

• S3 buckets
• IAM roles
• EventBridge rules

This is typically someone from DevOps, Infrastructure, or SRE.

Information Needed:

• Your AWS Account ID where logs are stored
• Name of at least one S3 bucket containing logs (e.g., CloudTrail logs)

Scanner Access:

• Accept your email invitation to Scanner
• Log in using Google Auth, username/password, or SSO (Okta, etc.)