Supported services

Most services get their data directly from log files stored in an S3 bucket. The exceptions are Inspector, CloudWatch Logs, Amazon ECR Image scanning, Security Lake, Custom Logs Buckets, and Security Hub CSPM. You configure the services that read log files from a bucket inside <bucket type="<TYPE>"> </bucket> tags. The Inspector and CloudWatch Logs services use <service type="inspector"> </service> and <service type="cloudwatchlogs"> </service> tags, respectively. Amazon ECR image scanning also uses <service type="cloudwatchlogs"> </service> tags, because it reads the scan findings from CloudWatch Logs. Amazon Security Lake, Custom Logs Buckets, and AWS Security Hub CSPM use <subscriber type="<TYPE>"> </subscriber> tags.

The following table contains the most relevant information about configuring each service in the /var/ossec/etc/ossec.conf file. It also shows the path where each service stores its logs in the bucket, for services that store their logs in a bucket. Before you configure any service, enable the AWS integrations as described in Enable AWS integration on the Wazuh dashboard.