How does it work?

1. In AWS, create or select the Amazon EventBridge event bus that should receive SFTP To Go audit log events. You can use the default event bus or create a dedicated custom event bus for SFTP To Go security activity.
2. Decide where EventBridge should route the events after they arrive. Depending on your security monitoring setup, matching events can be sent to AWS services such as CloudWatch, Lambda, Kinesis Data Firehose, S3, SQS, or another supported EventBridge target used by your SIEM or observability pipeline.
3. In SFTP To Go, add Amazon EventBridge as a streaming audit log destination by following the SFTP To Go documentation for Amazon EventBridge destinations. The SFTP To Go guide covers the required destination settings, generated resource policy, event bus permissions, delivery health, and validation behavior.
4. After the destination is saved in SFTP To Go, return to Amazon EventBridge and create a rule that matches SFTP To Go audit log events. The key event values are source set to sftptogo and detail-type set to Audit Log.
5. Narrow the rule if you only want to route specific security events. For example, create a separate rule for failed logins, access-denied events, downloads, uploads, deletes, or other audit event types that need a dedicated alerting or investigation workflow.
6. Select the EventBridge target for the rule. For security monitoring workflows, common targets include CloudWatch Logs for inspection, Lambda for enrichment, Kinesis Data Firehose for delivery to storage or analytics, SQS for buffering, or another supported target used by your security pipeline.
7. If the target expects a different payload structure, use EventBridge input transformation or a Lambda function to reshape the SFTP To Go audit event before delivery.
8. Generate a test event by performing an auditable action in SFTP To Go, such as a login, failed login, upload, download, delete, or access-denied attempt.
9. Confirm that the event appears on the EventBridge bus and reaches the configured target. Use the EventBridge rule monitoring tools, target logs, or downstream SIEM pipeline to confirm successful delivery.
10. Monitor the destination in SFTP To Go and the rule target in AWS. If EventBridge delivery fails because the event bus policy or receiving configuration is incorrect, fix the AWS-side configuration and confirm that new events flow successfully.
11. As your security monitoring setup changes, update the EventBridge rules, targets, input transformations, or downstream SIEM pipeline without changing the underlying SFTP To Go file transfer environment.

You can find further insight here, here, and here.