Installing dependencies
You can configure the Wazuh module for AWS either in the Wazuh manager or in a Wazuh agent. This choice depends solely on how you access your AWS infrastructure in your environment.
You only need to install dependencies when configuring the integration with AWS in a Wazuh agent. The Wazuh manager already includes all the necessary dependencies.
We outline the dependencies needed to configure the integration on a Wazuh agent installed on a Linux endpoint.
Python
The Wazuh module for AWS is compatible with Python 3.8–3.12. While later Python versions should work as well, we can't assure they are compatible. If you do not have Python 3 already installed, run the following command on your monitored endpoint.
# yum update && yum install python3
# apt-get update && apt-get install python3
You can install the required modules with Pip, the Python package manager. Most UNIX distributions have this tool available in their software repositories. Run the following command to install pip on your endpoint if you do not have it already installed.
# yum update && yum install python3-pip
# apt-get update && apt-get install python3-pip
We recommend using Pip 19.3 or later to simplify the installation of the dependencies. Run this command to check your pip version.
# pip3 --version
An example output is as follows.
pip 22.0.2 from /usr/lib/python3/dist-packages/pip (python 3.10)
If your pip version is less than 19.3, run the following command to upgrade the version.
# pip3 install --upgrade pip
# pip3 install --upgrade pip --break-system-packages
Note
This command modifies the default externally managed Python environment. See the PEP 668 description for more information.
To prevent the modification, you can run pip3 install --upgrade pip
within a virtual environment. You must update the shebang of the /var/ossec/wodles/aws/aws-s3
Python script with the interpreter in your virtual environment. For example, #!/path/to/your/virtual/environment/bin/python3
.
AWS client library for Python
Boto3 is the official package supported by Amazon to manage AWS resources. It is used to download log messages from the different AWS services supported by Wazuh. The Wazuh module for AWS is compatible with boto3
from version 1.13.1
to 1.17.85
. Future boto3
releases should maintain compatibility although we cannot assure it.
Execute the following command to install the dependencies:
# pip3 install boto3==1.34.135 pyarrow==14.0.1 numpy==1.26.0
# pip3 install --break-system-packages boto3==1.34.135 pyarrow==14.0.1 numpy==1.26.0
Note
If you're using a virtual environment, remove the --break-system-packages
parameter from the command above.