Wazuh is a Host-based Intrusion Detection service provided by CloudAware via Kibana platform user interface. Wazuh is available via CloudAware Launcher.
...
Customers may also choose to deploy a hybrid approach where some agents use CloudAware-managed IDS servers and some agents user customer-managed IDS servers.
IDS Status
If Intrusion Detection module is deployed, the tile 'IDS status' on an instance may display 3 values:
- Monitored
- Not monitored
- Under Attack
Once in the main tab, Cloudtrail data be searched for specific object using the search box.
Additional events can be filtered by type. For example if we wanted to only events that were either change, create or delete events, performed by a certain user, we could this as shown below.
While looking at any object in CMDB, user can click on Show Cloud CloudTrail button to view relevant Cloudtrail events.
Similarly if we are looking at an IAM user in CMDB, we can very quickly see what are the recent AWS activities of this user by clicking on CloudTrail tab in the IAM User Object.
Reports
Another powerful way in which CloudTrail events can be utilized is via Cloudaware Reports. Cloudaware come with a powerful report builder where we can zoom in specific CloudTrail events that meet our criteria. Reports can be scheduled, emailed, and converted to dashboards. Here is an example of a Daily Digest Report that summarizes all important changes throughout the day.
More information about building reports in Salesforce is available here and here.