Amazon CloudWatch Logs

Amazon CloudWatch Logs is a service that allows users to centralize the logs from all their systems, applications, and AWS services in a single place. To understand how CloudWatch Logs works, it is important to learn about the following concepts:

Log events: CloudWatch saves the logs generated by the monitored application or resource as log events. A log event is a record with two properties: the timestamp when the event occurred and the raw log message.
Log streams: Log events are stored in log streams. A log stream represents a sequence of events coming from the application instance or resource being monitored. All log events in a log stream share the same source.
Log groups: Log streams are grouped using log groups. A log group defines a group of log streams that share retention, monitoring, and access control settings.

AWS configuration

The following sections cover how to configure Amazon CloudWatch Logs to integrate with Wazuh.

Amazon CloudWatch configuration

The Wazuh module for AWS reads log events from existing CloudWatch Logs log groups through the AWS API. Before you configure Wazuh, get the name and Region of each log group you want to monitor. The module sends each log event to the Wazuh manager as it is. Wazuh decodes each log event with the integration that matches its format, so some events are indexed outside the AWS integration. For example, sshd syslog lines are decoded as system activity and can raise authentication findings. Wazuh doesn't index log events that no decoder classifies. To index your custom logs and raise findings for them, follow Create a security analytics detection workflow to create decoders and rules.

Policy configuration

Follow the creating an AWS policy guide to create a policy using the Amazon Web Services console.

The policies below follow the principle of least privilege, so they give the AWS IAM user only the minimum permissions it needs.

To allow an AWS user to use the Wazuh module for AWS with read-only permissions, it must have a policy like the following attached:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "logs:DescribeLogStreams",
            "Resource": "arn:aws:logs:<REGION>:<ACCOUNT_ID>:log-group:<LOG_GROUP_NAME>:*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "logs:GetLogEvents",
            "Resource": "arn:aws:logs:<REGION>:<ACCOUNT_ID>:log-group:<LOG_GROUP_NAME>:log-stream:*"
        }
    ]
}

To delete the log files after Wazuh collects them, use the following policy instead:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "logs:DescribeLogStreams",
            "Resource": "arn:aws:logs:<REGION>:<ACCOUNT_ID>:log-group:<LOG_GROUP_NAME>:*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "logs:GetLogEvents",
                "logs:DeleteLogStream"
            ],
            "Resource": "arn:aws:logs:<REGION>:<ACCOUNT_ID>:log-group:<LOG_GROUP_NAME>:log-stream:*"
        }
    ]
}

Note

<REGION>, <ACCOUNT_ID>, and <LOG_GROUP_NAME> are placeholders. Replace them with the appropriate values.

For CloudWatch Logs, Wazuh deletes the log streams it has read instead of log files. It does so only if you set remove_log_streams to yes in the service configuration. This option is off by default and isn't in the sample configuration, so you need the second policy only if you turn it on.

After creating a policy, you can attach it directly to a user or to a group the user belongs to. In attaching a policy to an IAM user group, you see how to attach a policy to a group. More information on using other methods is available in the AWS documentation.

Configure Wazuh to process Amazon CloudWatch logs

Make sure that the AWS integrations are enabled on the Wazuh dashboard, as described in Enable AWS integration on the Wazuh dashboard.
Add the following Wazuh module for AWS configuration block in the /var/ossec/etc/ossec.conf file of the Wazuh agent to collect logs from CloudWatch Logs. Replace the log group name and Region in the example with your own values. If the file already has a <wodle name="aws-s3"> block, add only the <service> section to it:
```
<wodle name="aws-s3">
  <disabled>no</disabled>
  <interval>5m</interval>
  <run_on_start>yes</run_on_start>
  <service type="cloudwatchlogs">
    <aws_profile>default</aws_profile>
    <aws_log_groups><LOG_GROUP_NAME></aws_log_groups>
    <regions>us-east-1</regions>
  </service>
</wodle>
```
You must specify at least one AWS log group to read logs from. You can add multiple regions by separating them with commas. If no region is specified, the Wazuh module for AWS looks for the log group in every available region.

Note

This example uses the aws_profile authentication parameter. Check the Configure AWS credentials section to learn more about the different authentication options and how to use them.
Save the changes and restart the Wazuh agent service to apply the changes:
```
# systemctl restart wazuh-agent
```

CloudWatch Logs use case

Check the Amazon ECR image scanning section for an example. In that example, a Lambda function writes each Amazon ECR basic scan finding as a log event to the /aws/ecr/image-scan-findings/<REPOSITORY_NAME> log group. Wazuh reads these log events and raises the AWS ECR critical or high image vulnerability and AWS ECR image vulnerability findings.