Wazuh is a Host-based Intrusion Detection service provided by CloudAware via Kibana platform user interface. Wazuh is available via CloudAware Launcher.
This article explains how Cloudaware capabilities should be deployed to improve AWS security, mitigate risks associated with operating cloud-based computing infrastructure, address compliance and change management.
Audience
- Security Engineers
- Cloudaware Engineers
- Chief Security Officers
- Compliance Officers
- AWS Cloud Engineers
- Cloud Operations Teams
HIDS Server Deployment Options
Cloudaware HIDS solution consists of three parts:
- IDS Agent
- IDS Server(s)
- IDS Dashboard
Agents are deployed onto every host where Intrusion Detection capabilities are desired. IDS Servers are managed by CloudAware if a customer is using Managed IDS option.
Optionally, customers can deploy their own IDS servers. IDS dashboard is part of the CloudAware and all IDS servers report into the dashboard. There are two ways to deploy CloudAware IDS services.
Managed IDS
Using Managed IDS deployment option, customers leverage IDS servers that are managed by CloudAware.
| Advantages | Disadvantages |
|---|---|
| Not able to deploy common OSSEC customizations without involving CloudAware support. |
Customer Managed IDS
Under this approach customers maintain their own set of IDS servers and are responsible for many operational aspects including backup, disaster recovery and availability. CloudAware recommends one IDS server per 500 agents and that IDS servers are deployed in the same region as agents.
Customers may also choose to deploy a hybrid approach where some agents use CloudAware-managed IDS servers and some agents user customer-managed IDS servers.
IDS Status
If Intrusion Detection module is deployed, the tile 'IDS status' on an instance may display 3 values:
- Monitored
- Not monitored
- Under Attack
More information about building reports in Salesforce is available here and here.