Cloud Activity Log ingestion failure detected

[Kate_M]

Description	Some customers have cloud accounts which aren't used on a regular basis. When such accounts are integrated with Lacework, you may periodically receive alerts of 'Cloud Activity log ingestion failure detected.'
Scope	AWS CloudTrail integrations
Solution	This alert is triggered after three hours of inactivity is detected. If, upon receiving such an alert, you determine these are benign warnings and expected behaviour, there are two options available to accommodate for this.  The first option is to disable the policy LW_PLATFORM_106 altogether if you do not find it to be helpful. The second option is to increase the tolerance. This can be accomplished by cloning policy LW_PLATFORM_106 and increasing the frequency from 3 hours. This does increase the chance that if there is a legitimate ingestion failure, then you may not get a timely alert, but will significantly reduce any false alarms.  The documentation below should help guide you on how to clone a policy. https://docs.lacework.net/console/clone-policies#create-a-policy-by-cloning Note:  Please be sure and disable the original policy, and only leave the new cloned policy enabled. If both are enabled, you will receive alerts for both policies.