Supported services

All the services except Inspector Classic, CloudWatch Logs, and Security Lake get their data from log files stored in an S3 bucket. These services store their data into log files which are configured inside <bucket type='TYPE'> </bucket> tags, while Inspector Classic and CloudWatch Logs services are configured inside <service type='inspector'> </service> and <service type='cloudwatchlogs'> </service> tags, respectively. The <subscriber type='TYPE'> </subscriber> tags are added to obtain logs from Amazon Security Lake buckets.

The next table contains the most relevant information about configuring each service in the /var/ossec/etc/ossec.conf file, as well as the path where the logs will be stored in the bucket if the corresponding service uses them as its storage medium: