The integration with AWS S3 can be configured in the Wazuh manager (which also behaves as an agent) or directly in a Wazuh agent. This choice merely depends on how you decide to access your AWS infrastructure in your environment.
The Wazuh manager includes all dependencies installed, these steps are only necessary when configuring the integration in a Wazuh agent.
The AWS module requires Python 3. It is compatible with Python 3.7 and above.
# yum update && yum install python3
# apt-get update && apt-get install python3
The required modules can be installed with Pip, the Python package manager. Most UNIX distributions have this tool available in their software repositories:
# yum update && yum install python3-pip
# apt-get update && apt-get install python3-pip
It is recommended to use a pip version greater than or equal to 19.3 to ease the installation of the required dependencies.
# pip3 install --upgrade pip
AWS pip dependencies
Boto3 is the official package supported by Amazon to manage AWS resources. It is used to download the log messages from the different AWS services supported by Wazuh. The module is compatible with boto3 from
1.17.85. Future boto3 releases should maintain compatibility although it cannot be guaranteed.
To install the dependencies, execute the following command:
# pip3 install boto3==1.17.85 botocore==1.20.85 jmespath==0.9.5 python-dateutil==2.8.1 six==1.14.0 urllib3==1.26.5 s3transfer==0.4.2 pyarrow==8.0.0 numpy==1.21.6