Set up Watchers in Wazuh for alerting

Owned by Daria Lebedeva
Last updated: Apr 18, 2022
4 min read

Cloudaware can monitor the specific criteria in your logs or IDS events, create incidents in CMDB and notify you via email. Use watcher functionality to create actions based on conditions which are periodically evaluated using queries on your data in Wazuh.

 

 

Use case: you need to get alerts based on log entries from the windows event log in Wazuh, e.g. of creation of new AWS EC2 Security Groups.

 

Cloudaware Incident Webhook

 

Considering the state when a watcher is triggered to be an incident, we can refer to Cloudaware Incident Webhook integration. That means that every time the event is discovered by a watcher in Wazuh, a CloudAware incident will be created.

1. Log in to your Cloudaware account → Admin.

2. Scroll down to Other integrations → Cloudaware Incident Webhook. Click +Add.

3. Type the Name for your Integration. Click Save.

4. Check the status of your integration:

 

Create A Watcher

 

1. Log in to your Wazuh application using Cloudaware Launcher. Select Management → Watcher (under ElasticSearch) → Create → Create advanced search.

You can contact your Cloudaware dedicated account manager via tam@cloudaware.com to request a watcher based on your use case.

2. Set up a meaningful ID, Name and JSON for your watcher.

3. Click Create Watch.

Configure A Workflow Rule

 

To set up sending alerts based on CloudAware Incident that will be created when a watcher is triggered, do the following:

1. Go back to your Cloudaware account. Click Setup under your username.

2. In the Quick Find box start typing workflows to select Workflows & Approvals → Workflow Rules → New Rule

3. Select CloudAware Incident as the object for the rule to be applied to and click Next.

4. Add Rule Name (1), set Evaluation Criteria(2) and Rule Criteria(3). Add Filter Logic if necessary. Click Save & Next

In this use case we set up email alerts for creation of new AWS EC2 Security Groups. Every time a new AWS EC2 Security Group is created, the watcher is triggered creating an incident in Cloudaware. The workflow rule will take into action sending the email alert.

5. Add Workflow Action → New Email Alert

6. Add description. Add users from the list of Available Recipients and additional email addresses if necessary.

7. Insert an existing email template in Email Template.

You can create a new one: Setup → Communication Templates → Classic Email Templates → New Template -> Text → Save ('Available For Use' should be checked beforehand)

8. Go back to Edit Email Alert form and click Save

9. Review the workflow and click Done

10. Activate the workflow

Check Creation of Cloudaware Incidents in CMDB

 

Go to CMDB Navigator. Start typing incidents in the search bar and select CloudAware Incidents list view.

Email Alert Example

Â