Wazuh is a Host-based Intrusion Detection service provided by CloudAware via Kibana platform user interface. Wazuh is available via CloudAware Launcher.
This article explains how Cloudaware capabilities should be deployed to improve AWS security, mitigate risks associated with operating cloud-based computing infrastructure, address compliance and change management.
Audience
- Security Engineers
- Cloudaware Engineers
- Chief Security Officers
- Compliance Officers
- AWS Cloud Engineers
- Cloud Operations Teams
HIDS Server Deployment Options
Cloudaware HIDS Cloudaware IDS is a full platform to monitor and control systems. It mixes together all the aspects of HIDS (host-based intrusion detection), log monitoring and SIM/SIEM together in a simple, powerful solution.
Features
Compliance Requirements
Cloudaware IDS helps customers meet specific compliance requirements such as PCI, HIPAA etc. It lets customers detect and alert on unauthorized file system modifications and malicious behavior embedded in the log files of COTS products as well as custom applications. For PCI, it covers the sections of file integrity monitoring (PCI 11.5, 10.5), log inspection and monitoring (section 10) and policy enforcement/checking.
Multi Platform
Cloudaware IDS lets customers implement a comprehensive host based intrusion detection system with fine grained application/server specific policies across multiple platforms such as Linux, Solaris, AIX, HP-UX, BSD, Windows, Mac and VMWare ESX.
Real-time and Configurable Alerts
Cloudaware IDS lets customers configure incidents they want to be alerted on which lets them focus on raising the priority of critical incidents over the regular noise on any system. Integration with SMTP, SMS and Syslog allows customers to be on top of alerts by sending these on to e-mail and handheld devices such as cell phones and pagers. Active response options to block an attack immediately is also available.
Integration with Current Infrastructure
Cloudaware IDS will integrate with current investments from customers such as SIM/SEM (Security Incident Management/Security Events Management) products for centralized reporting and correlation of events.
Centralized Management
Cloudaware IDS provides a simplified centralized management server to manage policies across multiple operating systems. Additionally, it also lets customers define server specific overrides for finer-grained policies.
Agent and Agentless Monitoring
Cloudaware IDS offers the flexibility of agent-based and agentless monitoring of systems and networking components such as routers and firewalls. It lets customers who have restrictions on software being installed on systems (such as FDA approved systems or appliances) meet security and compliance needs.
HIDS Server Deployment Options
Cloudaware HIDS solution consists of three parts:
IDS Agent
IDS Server(s)
IDS Dashboard
Agents are deployed onto every host where Intrusion Detection capabilities are desired. IDS Servers are managed by CloudAware by Cloudaware if a customer is using Managed IDS option.
Optionally, customers can deploy their own IDS servers. IDS dashboard is part of the CloudAware the Cloudaware and all IDS servers report into the dashboard. There are two ways to deploy CloudAware deploy Cloudaware IDS services.
Managed IDS
Using Managed IDS deployment option, customers leverage IDS servers that are managed by CloudAwareCloudaware.
...
Advantages | Disadvantages |
|---|---|
| Not able to deploy common OSSEC customizations without |
involving Cloudaware support. |
Customer Managed IDS
Under this approach customers maintain their own set of IDS servers and are responsible for many operational aspects including backup, disaster recovery and availability. CloudAware Cloudaware recommends one IDS server per 500 agents and that IDS servers are deployed in the same region as agents.
Customers may also choose to deploy a hybrid approach where some agents use CloudAwareCloudaware-managed IDS servers and some agents user customer-managed IDS servers.
IDS Status
If Intrusion Detection module is deployed, the tile 'IDS status' on an instance may display 3 values:
- Monitored
- Not monitored
- Under Attack
...
Why Scanning Is Necessary?
- Not all modifications are captured by Cloudtrail
- Cloudtrail can be turned off by mistake or intentionally
- There is a 15-30 minute delay between a change event and a Cloudtrail record.
- Not all regions including gov regions support Cloudtrail service
...
Flow of Changes
Regardless of how change is made, via command line, amazon management console or some other 3rd party tool it ends up in Cloudaware. Using change detection mechanism, change detectors update respective objects in CMDB.
Terminated or Deleted Objects
Once objects are deleted from AWS or, for example, an instance is terminated, they are still available for viewing, reporting and filtering in CloudAware CMDB. By default, objects remain visible in CMDB for 2 weeks after they have been deleted in AWS. However, this retention period can be increased.
All objects in CMDB have a field Deleted From AWS. This field is blank when an object is present and visible in the AWS console. Once the object has been deleted from AWS, this field will be populated with a date and time value.
...
CloudTrail is a service within AWS that provides a log of all API requests. The logs contain information about nature of the request such as:
- Who made the request
- At what time
- From what IP address
- Using which Amazon Library or tool
- Request and Response Parameters
...
- Using interactive CloudTrail main Tab
- From CloudTrail Tab on any CMDB object
- Using Cloudaware Reports
Main Tab
...
Object Tab
...
Reports
Another powerful way in which CloudTrail events can be utilized is via Cloudaware Reports. Cloudaware come with a powerful report builder where we can zoom in specific CloudTrail events that meet our criteria. Reports can be scheduled, emailed, and converted to dashboards. Here is an example of a Daily Digest Report that summarizes all important changes throughout the day. 
More information about building reports in Salesforce is available here and here.Wazuh
Wazuh is a Host-based Intrusion Detection service provided by Cloudaware via Kibana platform user interface. You can access Wazuh application from Cloudaware Launcher.
You can use Raw Data UI to query & filter your data and/or create Dashboards to review the summary of alerts on an instance level, monitor status of agents and build any vizualizations that are meaningful to you:
...
IDS Status in CMDB
If Intrusion Detection module is enabled, check an instance in Cloudaware CMDB. The tile 'IDS' may display 3 values:
Monitored
Not monitored
Under Attack
...
Click the tab 'Security' to review HIDS Alerts:
...