Skip to content

Commit

Permalink
Add AWS Security Lake alert visualization in Wazuh dashboard
Browse files Browse the repository at this point in the history
  • Loading branch information
fdalmaup committed Dec 7, 2023
1 parent 3edcd62 commit 1f0c3db
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -185,7 +185,9 @@ Set the configuration inside the section ``<subscriber type="security_lake">``.
After setting the required parameters, restart the Wazuh manager to apply the changes:

.. include:: /_templates/common/restart_manager.rst
Please note that the module's time of execution varies depending on the number of notifications present in the queue. If the ``<interval>`` value is less than the required time of execution, the :ref:`Interval overtaken<interval_overtaken_message>` message will be displayed in the ``ossec.log`` file.

.. note::
The module's time of execution varies depending on the number of notifications present in the queue. This directly influences the time you have to wait to see every alert on the Wazuh dashboard. If the ``<interval>`` value is less than the required time of execution, the :ref:`Interval overtaken<interval_overtaken_message>` message will be displayed in the ``ossec.log`` file.


Parameters
Expand Down Expand Up @@ -213,3 +215,12 @@ Authentication


More information about the different authentication methods can be found in the :ref:`Configuring AWS credentials <amazon_credentials>` documentation.

Visualizing alerts in Wazuh dashboard
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Once you set the configuration and restart the manager, you can visualize the Amazon Security Lake alerts in the Wazuh dashboard. To do this, go to the ``Security events`` module and, for better visualization, apply the filter ``rule.groups: amazon_security_lake``:

.. thumbnail:: /images/aws/security-lake-1.png
:align: center
:width: 80%
Binary file added source/images/aws/security-lake-1.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit 1f0c3db

Please sign in to comment.