Deploy your CNAPP solution in minutes with our guided setup process
Contact Qrie for a personalized demo and consultation
Sign a simple order form to get started
We deploy your per-region QOP stacks and provide SQS Queue ARNs
Your team deploys CloudFormation stacks to forward events
We confirm events are flowing and your UI shows live data
Your dedicated Qrie instance is live and monitoring
Contact Qrie for a personalized demo and consultation
Reach out to the Qrie team to schedule a demo and discuss your cloud security monitoring needs. We’ll walk through your AWS environment and explain how Qrie can provide comprehensive visibility into your cloud infrastructure.
Sign a simple order form to get started
Once you’re ready to proceed, we’ll provide a straightforward order form that outlines the service terms, pricing, and deployment timeline.
We deploy your per-region QOP stacks and provide SQS Queue ARNs
The Qrie team deploys your dedicated Qrie-on-Premises (QOP) infrastructure in your specified AWS regions. This includes all the backend processing, storage, and UI components needed for your security monitoring.
https://us-east-1.acme.qrie.io (customized with your domain).Deploy CloudFormation stacks to forward events from your AWS account to Qrie
Download the bootstrap template for connecting your AWS account:
# Download the CloudFormation template
curl -fsSL -o qrie-customer-bootstrap.yaml \
https://qrie.io/onboarding/customer_bootstrap.yamlAlternative: Download directly from browser
The EventBridge rules won’t trigger without CloudTrail sending events to EventBridge. Enable this if not already configured:
# Option 1: Basic setup (captures ALL services, filtered by EventBridge rules)
aws cloudtrail put-event-selectors \
--trail-name <your-existing-trail-name> \
--event-selectors '[{
"ReadWriteType": "WriteOnly",
"IncludeManagementEvents": true,
"DataResources": []
}]' \
--region us-east-1
# Option 2: Advanced filtering (only EC2, S3, IAM at CloudTrail level)
aws cloudtrail put-event-selectors \
--trail-name <your-existing-trail-name> \
--advanced-event-selectors '[{
"Name": "Log EC2, S3, IAM write events only",
"FieldSelectors": [
{"Field": "category", "Equals": ["Management"]},
{"Field": "readOnly", "Equals": ["false"]},
{"Field": "eventSource", "Equals": ["ec2.amazonaws.com", "s3.amazonaws.com", "iam.amazonaws.com"]}
]
}]' \
--region us-east-1
# Option 3: Create new trail with EventBridge integration
aws cloudtrail create-trail \
--name qrie-eventbridge-trail \
--s3-bucket-name <your-cloudtrail-bucket> \
--include-global-service-events \
--is-multi-region-trail \
--enable-log-file-validation \
--region us-east-1
aws cloudtrail start-logging \
--name qrie-eventbridge-trail \
--region us-east-1us-east-1 (Required): Must be deployed to capture IAM events (global service)
Other regions: Deploy in regions where you have EC2, S3, and other regional resources
Start with us-east-1:
# Set your QOP SQS ARN and Account ID for us-east-1 (replace with actual values from Qrie team)
AWS_REGION="us-east-1"
QOP_QUEUE_ARN="arn:aws:sqs:$AWS_REGION:<QOP_ACCOUNT_ID>:<your-qrie-queue-us-east-1>"
QOP_ACCOUNT_ID="<QOP_ACCOUNT_ID>"
# Deploy to us-east-1 first (REQUIRED for global services like IAM)
aws cloudformation deploy \
--region $AWS_REGION \
--stack-name QrieForwardToQOP \
--template-file qrie-customer-bootstrap.yaml \
--parameter-overrides QopQueueArn="$QOP_QUEUE_ARN" QopAccountId="$QOP_ACCOUNT_ID" \
--capabilities CAPABILITY_NAMED_IAMRepeat for each region where you have resources to monitor:
# Example: Deploy to us-west-2
AWS_REGION="us-west-2"
QOP_QUEUE_ARN="arn:aws:sqs:$AWS_REGION:<QOP_ACCOUNT_ID>:<your-qrie-queue-us-west-2>"
QOP_ACCOUNT_ID="<QOP_ACCOUNT_ID>"
aws cloudformation deploy \
--region $AWS_REGION \
--stack-name QrieForwardToQOP \
--template-file qrie-customer-bootstrap.yaml \
--parameter-overrides QopQueueArn="$QOP_QUEUE_ARN" QopAccountId="$QOP_ACCOUNT_ID" \
--capabilities CAPABILITY_NAMED_IAMConfirm your setup is working correctly with end-to-end testing
Verify all CloudFormation stacks show CREATE_COMPLETE status in each deployed region.
Qrie team confirms test events are received and processed successfully.
Send test events to verify the complete pipeline is working:
# Test IAM events (only works in us-east-1 due to global service)
aws iam create-user --user-name qrie-test-user
aws iam delete-user --user-name qrie-test-user
# Test S3 write events
aws s3 mb s3://qrie-test-bucket-$(date +%s)
aws s3 rb s3://qrie-test-bucket-$(date +%s)
# Test EC2 write events (use appropriate region)
aws ec2 create-security-group --group-name qrie-test-sg --description "Qrie test security group"
aws ec2 delete-security-group --group-name qrie-test-sgNote: IAM events only appear in us-east-1 CloudTrail. The Qrie team will confirm receipt of events from all deployed regions and verify they’re being processed by your QOP Lambda functions.
Web UI (Coming Soon): The Qrie web interface will display security findings and resource inventory. During initial setup, this UI is still being prepared for your deployment.
QOP Account Access: You have access to your dedicated QOP account where you can:
Advanced Testing: Create a non-compliant resource (e.g., an S3 bucket with public read access) to generate a positive security finding that should appear in your QOP DynamoDB tables.
Security Note:
Your QOP SQS queue only accepts events from the specific EventBridge rules created by this stack (prefix: qrie-forward-*). The queue is not publicly accessible.
Once verification is complete, your dedicated Qrie instance is live and monitoring your AWS environment. You’ll receive access to your web UI and can start exploring security findings and resource inventory.
QrieEventsToSqs-<account>-<region> IAM roleTrusted by EventBridge with SQS send permissions
QrieReadOnly-<account> cross-account IAM roleSecurityAudit permissions for resource discovery and policy evaluation
qrie-forward-ec2-<region> EventBridge ruleMonitors EC2 API write operations
qrie-forward-s3-<region> EventBridge ruleMonitors S3 API write operations
qrie-forward-iam-<region> EventBridge ruleMonitors IAM API write operations
Secure event ingress with resource policies
Resource inventory and security findings storage
Event processing, inventory, and policy scanning
CloudFront + S3 + Cognito for dashboard access
If you encounter IAM policy parsing errors or other issues when redeploying:
# Delete the existing stack
aws cloudformation delete-stack \
--stack-name QrieForwardToQOP \
--region us-east-1
# Wait for deletion to complete
aws cloudformation wait stack-delete-complete \
--stack-name QrieForwardToQOP \
--region us-east-1
# Deploy fresh stack
aws cloudformation deploy \
--region us-east-1 \
--stack-name QrieForwardToQOP \
--template-file qrie-customer-bootstrap.yaml \
--parameter-overrides QopQueueArn="<your-qop-queue-arn>" QopAccountId="<qop-account-id>" \
--capabilities CAPABILITY_NAMED_IAMNote: Deleting and recreating the stack may cause a brief gap in event forwarding during the transition.
Yes. The queue uses resource policies that only allow EventBridge service access from rules with the qrie-forward-* prefix in your account/region. It’s not publicly accessible.
Absolutely. Update the bootstrap stack to include additional EventBridge rules for services like RDS, EKS, etc. The QOP SQS policy already supports the rule prefix pattern.
Use AWS StackSets to deploy across multiple accounts/regions simultaneously, or run the CloudShell commands in a loop. Each QOP region operates independently.
Simply disable the EventBridge rules in your account and we’ll revoke the viewer role. Your data remains in your dedicated QOP instance until you’re ready to fully decommission.