Amazon NLB

Network Load Balancers (Amazon NLB) are one of the load balancer types that Elastic Load Balancing offers. A Network Load Balancer functions at the fourth layer of the Open Systems Interconnection (OSI) model. It can handle millions of requests per second. After the load balancer receives a connection request, it selects a target from the target group for the default rule. It attempts to open a TCP connection to the selected target on the port specified in the listener configuration.

AWS configuration

The following sections cover how to configure the Amazon NLB service to integrate with Wazuh.

Amazon NLB configuration

Go to S3 buckets, copy the name of an existing S3 bucket or create a new one. The bucket needs a bucket policy that allows Elastic Load Balancing to write the access logs. The AWS documentation in the note below gives the policy to use.
On your AWS console, search for ec2 in the search bar or go to Services > Compute > EC2.
Go to Load Balancing > Load Balancers on the left menu. Create a new load balancer or select one or more load balancers and select Edit load balancer attributes on the Actions menu.
In the Monitoring tab, enable Access logs and define the S3 bucket and the path where the logs are stored. Network Load Balancers write access logs only for TLS listeners, so the load balancer needs a TLS listener to produce logs. The Wazuh configuration below uses NLB as the path. If you enter a different path, set the <path> value to match it.

Note

To enable access logs and add the bucket policy that Elastic Load Balancing needs, see Access logs for your Network Load Balancer.

Policy configuration

Follow the creating an AWS policy guide to create a policy using the Amazon Web Services console.

The policies below follow the principle of least privilege, so they give the AWS IAM user only the minimum permissions it needs.

To allow an AWS user to use the Wazuh module for AWS with read-only permissions, it must have a policy like the following attached:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>/*",
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>"
            ]
        }
    ]
}

To delete the log files after Wazuh collects them, use the following policy instead:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>/*",
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>"
            ]
        }
    ]
}

Note

<WAZUH_AWS_BUCKET> is a placeholder. Replace it with the actual name of the bucket from which you want to retrieve logs.

Wazuh deletes the log files from the bucket only if you set remove_from_bucket to yes in the bucket configuration. This option is off by default and isn't in the sample configuration, so you need the second policy only if you turn it on.

After creating a policy, you can attach it directly to a user or to a group to which the user belongs. In attaching a policy to an IAM user group, you see how to attach a policy to a group. More information on how to use other methods is available in the AWS documentation.

Configure Wazuh to process Amazon NLB logs

Make sure that the AWS integrations are enabled on the Wazuh dashboard, as described in Enable AWS integration on the Wazuh dashboard.
Add the following Wazuh module for AWS configuration to the /var/ossec/etc/ossec.conf file on the Wazuh agent. Replace <WAZUH_AWS_BUCKET> with the name of the S3 bucket that stores the NLB access logs. If the file already has a <wodle name="aws-s3"> block, add only the <bucket> section to it:
```
<wodle name="aws-s3">
  <disabled>no</disabled>
  <interval>10m</interval>
  <run_on_start>yes</run_on_start>
  <skip_on_error>yes</skip_on_error>
  <bucket type="nlb">
    <name><WAZUH_AWS_BUCKET></name>
    <path>NLB</path>
    <aws_profile>default</aws_profile>
  </bucket>
</wodle>
```
Note

This example uses the aws_profile authentication parameter. Check the Configure AWS credentials section to learn more about the different authentication options and how to use them.
Save the changes and restart the Wazuh agent service to apply the changes:
```
# systemctl restart wazuh-agent
```

NLB use case

Monitoring TLS connections

Network Load Balancer access logs record the TLS connections to the load balancer, and they appear as events on the Wazuh dashboard. To see them, go to Explore > Discover, select the wazuh-events-v5* index pattern, and filter by observer.type: tls. These events don't raise findings.

Expand an event to see its details:

Load balancer (observer.name)
Client address and port (source.address and source.port)
Target address and port (destination.ip and destination.port)
TLS version and cipher (tls.version and tls.cipher)
Key exchange group (tls.curve)
Domain name the client connected to (destination.domain)
Bytes sent and received (source.bytes and destination.bytes)