AWS Config

On the AWS Config page, , go to Settings.

Here, choose the Resource types to record (specify the AWS resource types you want AWS Config to record):

• All resources

• Specific types

Note

For more information about these options, see Selecting Which Resources AWS Config Records.

Select an existing S3 Bucket or create a new one.

Now, to configure the rules:

Go to Services > Management Tools > CloudWatch:

Select Rules on the left menu and click on the Create rule button:

Select which service do you want to get logs from using the Service name slider, then, click on the Add target button and add the previously created Firehose delivery stream there. Also, create a new role to access the delivery stream:

Give the rule some name and click on the Create rule button:

Once the rule is created, data will start to be sent to the previously created S3 bucket. Remember to first enable the service you want to monitor, otherwise you won't get any data.

Open the Wazuh configuration file (/var/ossec/etc/ossec.conf) and add the following block:

<wodle name="aws-s3">
  <disabled>no</disabled>
  <interval>10m</interval>
  <run_on_start>yes</run_on_start>
  <skip_on_error>yes</skip_on_error>
  <bucket type="config">
    <name>wazuh-aws-wodle</name>
    <path>config</path>
    <aws_profile>default</aws_profile>
  </bucket>
</wodle>

Note

Check the AWS S3 module reference manual to learn more about each setting.

Restart Wazuh in order to apply the changes:

• If you're configuring a Wazuh manager:

  1. For Systemd:

  # systemctl restart wazuh-manager
  

  2. For SysV Init:

  # service wazuh-manager restart
  

• If you're configuring a Wazuh agent:

  1. For Systemd:

  # systemctl restart wazuh-agent
  

  2. For SysV Init:

  # service wazuh-agent restart