AWS Key Management Service (KMS) makes it easy for users to create and manage keys and control the use of encryption across a wide range of AWS services and in their applications. AWS KMS is a secure and resilient service that uses FIPS 140-2 validated hardware security modules to protect their keys. AWS KMS is integrated with AWS CloudTrail to provide users with logs of all key usage to help meet their regulatory and compliance needs.
Create a new S3 bucket. (If you want to use an already created one, skip this step).
Go to Services > Analytics > Kinesis:
If it's the first time you're using this service, you'll see the following screen. Just click on Get started:
Click on Create delivery stream button:
Put a name to your delivery stream and click on the Next button at the bottom of the page:
On the next page, leave both options as Disabled and click on Next:
Select Amazon S3 as the destination, then select the previously created S3 bucket and add a prefix where logs will be stored. AWS Firehose creates a file structure YYYY/MM/DD/HH, if a prefix is used the created file structure would be firehose/YYYY/MM/DD/HH. If a prefix is used it must be specified under the Wazuh Bucket configuration:
Users can select the compression they prefer. Wazuh supports any kind of compression but Snappy. After that, click on Create new or choose
Give a proper name to the role and click on the Allow button:
The following page is just a summary of the Firehose stream created, go to the bottom of the page and click on the Create delivery stream button:
Go to Services > Management Tools > CloudWatch:
Select Rules on the left menu and click on the Create rule button:
Select the services you want to get logs from using the Service name slider, then, click on the Add target button and add the previously created Firehose delivery stream there. Also, create a new role to access the delivery stream.
Give the rule some name and click on the Create rule button:
Once the rule is created, data will start to be sent to the previously created S3 bucket. Remember to first enable the service you want to monitor, otherwise, you won't get any data.
Open the Wazuh configuration file (
/var/ossec/etc/ossec.conf) and add the following block:
<wodle name="aws-s3"> <disabled>no</disabled> <interval>10m</interval> <run_on_start>yes</run_on_start> <skip_on_error>yes</skip_on_error> <bucket type="custom"> <name>wazuh-aws-wodle</name> <path>kms_compress_encrypted</path> <aws_profile>default</aws_profile> </bucket> </wodle>
Check the AWS S3 module reference manual to learn more about each setting.
Restart Wazuh in order to apply the changes:
If you're configuring a Wazuh manager:
# systemctl restart wazuh-manager
For SysV Init:
# service wazuh-manager restart
If you're configuring a Wazuh agent:
# systemctl restart wazuh-agent
For SysV Init:
# service wazuh-agent restart