Multi-Cloud Security Monitoring with Wazuh: AWS, Azure, and GCP Integration#

Introduction#

As organizations increasingly adopt multi-cloud strategies, securing distributed cloud environments becomes a critical challenge. Managing security across Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP) requires unified visibility and consistent monitoring capabilities.

Wazuh provides a comprehensive solution for multi-cloud security monitoring by offering:

🌐 Unified Security Dashboard: Centralized monitoring across all cloud platforms
🔍 Real-time Threat Detection: Immediate identification of security threats
📊 Compliance Management: Automated compliance reporting across clouds
⚡ Scalable Architecture: Support for enterprise-scale cloud deployments
🛡️ Native Cloud Integration: Deep integration with cloud-native security services

Multi-Cloud Security Architecture#

Unified Monitoring Framework#

flowchart TB
    subgraph "Cloud Platforms"
        subgraph "AWS Environment"
            A1[EC2 Instances]
            A2[CloudTrail Logs]
            A3[VPC Flow Logs]
            A4[GuardDuty Findings]
            A5[Config Rules]
        end
        
        subgraph "Azure Environment"
            B1[Virtual Machines]
            B2[Activity Logs]
            B3[Security Center]
            B4[Key Vault Logs]
            B5[AD Graph API]
        end
        
        subgraph "GCP Environment"
            C1[Compute Instances]
            C2[Cloud Audit Logs]
            C3[VPC Flow Logs]
            C4[Security Center]
            C5[Pub/Sub Events]
        end
    end

    subgraph "Wazuh Multi-Cloud Manager"
        W1[Cloud Integrations Module]
        W2[Unified Rule Engine]
        W3[Correlation Engine]
        W4[Compliance Module]
        W5[Alert Management]
    end

    subgraph "Security Operations"
        S1[Centralized Dashboard]
        S2[Threat Intelligence]
        S3[Incident Response]
        S4[Compliance Reports]
        S5[Security Analytics]
    end

    A1 --> W1
    A2 --> W1
    A3 --> W1
    A4 --> W1
    A5 --> W1

    B1 --> W1
    B2 --> W1
    B3 --> W1
    B4 --> W1
    B5 --> W1

    C1 --> W1
    C2 --> W1
    C3 --> W1
    C4 --> W1
    C5 --> W1

    W1 --> W2
    W2 --> W3
    W3 --> W4
    W4 --> W5

    W5 --> S1
    W5 --> S2
    W5 --> S3
    W5 --> S4
    W5 --> S5

    style W1 fill:#ff6b6b
    style W3 fill:#51cf66
    style S1 fill:#4dabf7

Key Integration Benefits#

Feature	Single Cloud	Multi-Cloud with Wazuh
Visibility	Platform-specific	Unified across all clouds
Alerting	Separate consoles	Centralized alert management
Compliance	Manual correlation	Automated cross-cloud compliance
Threat Detection	Platform-native only	Enhanced with correlation
Cost	Multiple tools	Single platform solution

AWS Integration Implementation#

Phase 1: AWS Service Configuration#

CloudTrail Integration#

CloudTrail provides audit logging for AWS API calls, which is essential for security monitoring:

1
{
2
  "cloudtrail_config": {
3
    "trail_name": "wazuh-security-trail",
4
    "s3_bucket": "wazuh-cloudtrail-logs-bucket",
5
    "include_global_service_events": true,
6
    "is_multi_region_trail": true,
7
    "enable_log_file_validation": true,
8
    "event_selectors": [
9
      {
10
        "read_write_type": "All",
11
        "include_management_events": true,
12
        "data_resources": [
13
          {
14
            "type": "AWS::S3::Object",
15
            "values": ["arn:aws:s3:::sensitive-data-bucket/*"]
16
          },
17
          {
18
            "type": "AWS::Lambda::Function",
19
            "values": ["*"]
20
          }
21
        ]
22
      }
23
    ]
24
  }
25
}

Terraform Configuration for AWS Integration#

1
# AWS CloudTrail for Wazuh Integration
2
resource "aws_cloudtrail" "wazuh_trail" {
3
  name                         = "wazuh-security-trail"
4
  s3_bucket_name              = aws_s3_bucket.wazuh_logs.bucket
5
  include_global_service_events = true
6
  is_multi_region_trail       = true
7
  enable_log_file_validation  = true
8

9
  event_selector {
10
    read_write_type                 = "All"
11
    include_management_events       = true
12

13
    data_resource {
14
      type   = "AWS::S3::Object"
15
      values = ["arn:aws:s3:::${aws_s3_bucket.sensitive_data.bucket}/*"]
16
    }
17

18
    data_resource {
19
      type   = "AWS::Lambda::Function"
20
      values = ["*"]
21
    }
22
  }
23

24
  tags = {
25
    Environment = "production"
26
    Purpose     = "security-monitoring"
27
    ManagedBy   = "wazuh"
28
  }
29
}
30

31
# S3 Bucket for CloudTrail logs
32
resource "aws_s3_bucket" "wazuh_logs" {
33
  bucket        = "wazuh-cloudtrail-logs-${random_id.bucket_suffix.hex}"
34
  force_destroy = false
35

36
  tags = {
37
    Name        = "Wazuh CloudTrail Logs"
38
    Environment = "production"
39
  }
40
}
41

42
# S3 Bucket policy for CloudTrail
43
resource "aws_s3_bucket_policy" "wazuh_logs_policy" {
44
  bucket = aws_s3_bucket.wazuh_logs.id
45

46
  policy = jsonencode({
47
    Version = "2012-10-17"
48
    Statement = [
49
      {
50
        Sid    = "AWSCloudTrailAclCheck"
51
        Effect = "Allow"
52
        Principal = {
53
          Service = "cloudtrail.amazonaws.com"
54
        }
55
        Action   = "s3:GetBucketAcl"
56
        Resource = aws_s3_bucket.wazuh_logs.arn
57
        Condition = {
58
          StringEquals = {
59
            "AWS:SourceArn" = aws_cloudtrail.wazuh_trail.arn
60
          }
61
        }
62
      },
63
      {
64
        Sid    = "AWSCloudTrailWrite"
65
        Effect = "Allow"
66
        Principal = {
67
          Service = "cloudtrail.amazonaws.com"
68
        }
69
        Action   = "s3:PutObject"
70
        Resource = "${aws_s3_bucket.wazuh_logs.arn}/*"
71
        Condition = {
72
          StringEquals = {
73
            "s3:x-amz-acl" = "bucket-owner-full-control"
74
            "AWS:SourceArn" = aws_cloudtrail.wazuh_trail.arn
75
          }
76
        }
77
      }
78
    ]
79
  })
80
}
81

82
# IAM Role for Wazuh AWS Integration
83
resource "aws_iam_role" "wazuh_integration_role" {
84
  name = "WazuhIntegrationRole"
85

86
  assume_role_policy = jsonencode({
87
    Version = "2012-10-17"
88
    Statement = [
89
      {
90
        Action = "sts:AssumeRole"
91
        Effect = "Allow"
92
        Principal = {
93
          AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
94
        }
95
        Condition = {
96
          StringEquals = {
97
            "sts:ExternalId" = var.wazuh_external_id
98
          }
99
        }
100
      }
101
    ]
102
  })
103
}
104

105
# IAM Policy for Wazuh integration
106
resource "aws_iam_policy" "wazuh_integration_policy" {
107
  name        = "WazuhIntegrationPolicy"
108
  description = "Policy for Wazuh AWS integration"
109

110
  policy = jsonencode({
111
    Version = "2012-10-17"
112
    Statement = [
113
      {
114
        Effect = "Allow"
115
        Action = [
116
          "s3:GetObject",
117
          "s3:ListBucket",
118
          "s3:GetBucketLocation"
119
        ]
120
        Resource = [
121
          aws_s3_bucket.wazuh_logs.arn,
122
          "${aws_s3_bucket.wazuh_logs.arn}/*"
123
        ]
124
      },
125
      {
126
        Effect = "Allow"
127
        Action = [
128
          "guardduty:GetDetector",
129
          "guardduty:ListDetectors",
130
          "guardduty:GetFindings",
131
          "guardduty:ListFindings"
132
        ]
133
        Resource = "*"
134
      },
135
      {
136
        Effect = "Allow"
137
        Action = [
138
          "config:GetComplianceDetailsByConfigRule",
139
          "config:GetConfigRuleEvaluationStatus",
140
          "config:DescribeConfigRules"
141
        ]
142
        Resource = "*"
143
      },
144
      {
145
        Effect = "Allow"
146
        Action = [
147
          "inspector:DescribeFindings",
148
          "inspector:ListFindings",
149
          "inspector:DescribeAssessmentRuns"
150
        ]
151
        Resource = "*"
152
      }
153
    ]
154
  })
155
}
156

157
# Attach policy to role
158
resource "aws_iam_role_policy_attachment" "wazuh_integration_attachment" {
159
  role       = aws_iam_role.wazuh_integration_role.name
160
  policy_arn = aws_iam_policy.wazuh_integration_policy.arn
161
}
162

163
# VPC Flow Logs for network monitoring
164
resource "aws_flow_log" "wazuh_vpc_flow_logs" {
165
  iam_role_arn    = aws_iam_role.flow_log.arn
166
  log_destination = aws_cloudwatch_log_group.vpc_flow_logs.arn
167
  traffic_type    = "ALL"
168
  vpc_id          = aws_vpc.main.id
169
}

Phase 2: Wazuh AWS Module Configuration#

Configure the AWS integration module in /var/ossec/etc/ossec.conf:

1
<ossec_config>
2
  <!-- AWS CloudTrail Integration -->
3
  <wodle name="aws-s3">
4
    <disabled>no</disabled>
5
    <interval>10m</interval>
6
    <run_on_start>yes</run_on_start>
7
    <skip_on_error>yes</skip_on_error>
8

9
    <!-- CloudTrail Configuration -->
10
    <bucket type="cloudtrail">
11
      <name>wazuh-cloudtrail-logs-bucket</name>
12
      <access_key>AKIA...</access_key>
13
      <secret_key>SECRET_KEY</secret_key>
14
      <aws_profile>wazuh</aws_profile>
15
      <iam_role_arn>arn:aws:iam::123456789012:role/WazuhIntegrationRole</iam_role_arn>
16
      <iam_role_duration>3600</iam_role_duration>
17
      <region>us-east-1</region>
18
      <path>AWSLogs/123456789012/CloudTrail/</path>
19
      <only_logs_after>2025-01-01</only_logs_after>
20
    </bucket>
21

22
    <!-- VPC Flow Logs Configuration -->
23
    <bucket type="vpcflowlogs">
24
      <name>wazuh-vpc-flow-logs-bucket</name>
25
      <aws_profile>wazuh</aws_profile>
26
      <iam_role_arn>arn:aws:iam::123456789012:role/WazuhIntegrationRole</iam_role_arn>
27
      <region>us-east-1</region>
28
      <path>vpc-flow-logs/</path>
29
    </bucket>
30

31
    <!-- Config Rules -->
32
    <bucket type="config">
33
      <name>wazuh-config-bucket</name>
34
      <aws_profile>wazuh</aws_profile>
35
      <iam_role_arn>arn:aws:iam::123456789012:role/WazuhIntegrationRole</iam_role_arn>
36
      <region>us-east-1</region>
37
      <path>AWSLogs/123456789012/Config/</path>
38
    </bucket>
39
  </wodle>
40

41
  <!-- AWS GuardDuty Integration -->
42
  <wodle name="aws-guardduty">
43
    <disabled>no</disabled>
44
    <interval>10m</interval>
45
    <run_on_start>yes</run_on_start>
46
    <skip_on_error>yes</skip_on_error>
47

48
    <detector>
49
      <aws_profile>wazuh</aws_profile>
50
      <iam_role_arn>arn:aws:iam::123456789012:role/WazuhIntegrationRole</iam_role_arn>
51
      <region>us-east-1</region>
52
      <detector_id>1ab23c4d5e6f7890g1h23i4j56k7l8m9</detector_id>
53
      <only_logs_after>2025-01-01</only_logs_after>
54
    </detector>
55
  </wodle>
56

57
  <!-- AWS Inspector Integration -->
58
  <wodle name="aws-inspector">
59
    <disabled>no</disabled>
60
    <interval>12h</interval>
61
    <run_on_start>yes</run_on_start>
62
    <skip_on_error>yes</skip_on_error>
63

64
    <assessment>
65
      <aws_profile>wazuh</aws_profile>
66
      <iam_role_arn>arn:aws:iam::123456789012:role/WazuhIntegrationRole</iam_role_arn>
67
      <region>us-east-1</region>
68
    </assessment>
69
  </wodle>
70
</ossec_config>

Phase 3: Advanced AWS Security Rules#

Create comprehensive AWS-specific security rules in /var/ossec/etc/rules/local_rules.xml:

1
<group name="aws,cloud,">
2

3
  <!-- AWS Root Account Usage -->
4
  <rule id="400001" level="12">
5
    <if_group>amazon</if_group>
6
    <field name="userIdentity.type">Root</field>
7
    <description>AWS Root account used: $(userIdentity.arn) from $(sourceIPAddress)</description>
8
    <group>aws_root_usage,policy_violation,</group>
9
    <options>no_full_log</options>
10
  </rule>
11

12
  <!-- Suspicious Console Logins -->
13
  <rule id="400002" level="8">
14
    <if_group>amazon</if_group>
15
    <field name="eventName">ConsoleLogin</field>
16
    <field name="responseElements.ConsoleLogin">Success</field>
17
    <field name="sourceIPAddress" type="pcre2">^(?!10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.)</field>
18
    <description>AWS Console login from external IP: $(userIdentity.userName) from $(sourceIPAddress)</description>
19
    <group>aws_console_login,authentication,</group>
20
  </rule>
21

22
  <!-- Failed Console Login Attempts -->
23
  <rule id="400003" level="6" frequency="3" timeframe="300">
24
    <if_group>amazon</if_group>
25
    <field name="eventName">ConsoleLogin</field>
26
    <field name="responseElements.ConsoleLogin">Failure</field>
27
    <same_field>sourceIPAddress</same_field>
28
    <description>AWS Multiple failed console login attempts from $(sourceIPAddress)</description>
29
    <group>aws_console_login,authentication_failed,</group>
30
  </rule>
31

32
  <!-- Privilege Escalation Detection -->
33
  <rule id="400010" level="10">
34
    <if_group>amazon</if_group>
35
    <field name="eventName">AttachUserPolicy|AttachRolePolicy|PutUserPolicy|PutRolePolicy</field>
36
    <field name="responseElements" type="pcre2">(Admin|Root|PowerUser)</field>
37
    <description>AWS Privilege escalation attempt: $(eventName) for $(responseElements.user.userName)</description>
38
    <group>aws_privilege_escalation,policy_violation,</group>
39
  </rule>
40

41
  <!-- Unauthorized IAM User Creation -->
42
  <rule id="400011" level="8">
43
    <if_group>amazon</if_group>
44
    <field name="eventName">CreateUser</field>
45
    <field name="sourceIPAddress" type="pcre2">^(?!10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.)</field>
46
    <description>AWS IAM user created from external IP: $(responseElements.user.userName) from $(sourceIPAddress)</description>
47
    <group>aws_iam_user_creation,</group>
48
  </rule>
49

50
  <!-- EC2 Security Group Changes -->
51
  <rule id="400020" level="6">
52
    <if_group>amazon</if_group>
53
    <field name="eventName">AuthorizeSecurityGroupIngress|RevokeSecurityGroupIngress</field>
54
    <description>AWS Security Group modified: $(eventName) for $(requestParameters.groupId) by $(userIdentity.userName)</description>
55
    <group>aws_security_group,network_change,</group>
56
  </rule>
57

58
  <!-- Dangerous Security Group Rules -->
59
  <rule id="400021" level="10">
60
    <if_sid>400020</if_sid>
61
    <field name="requestParameters.ipPermissions.items.ipRanges.items.cidrIp">0.0.0.0/0</field>
62
    <field name="requestParameters.ipPermissions.items.fromPort">22|3389</field>
63
    <description>AWS Dangerous security group rule: SSH/RDP open to 0.0.0.0/0 for $(requestParameters.groupId)</description>
64
    <group>aws_security_group,dangerous_rule,</group>
65
  </rule>
66

67
  <!-- S3 Bucket Policy Changes -->
68
  <rule id="400030" level="7">
69
    <if_group>amazon</if_group>
70
    <field name="eventName">PutBucketPolicy|DeleteBucketPolicy|PutBucketAcl</field>
71
    <description>AWS S3 bucket policy changed: $(eventName) for $(requestParameters.bucketName)</description>
72
    <group>aws_s3_policy,</group>
73
  </rule>
74

75
  <!-- S3 Public Access Block Disabled -->
76
  <rule id="400031" level="10">
77
    <if_group>amazon</if_group>
78
    <field name="eventName">DeletePublicAccessBlock</field>
79
    <description>AWS S3 Public Access Block disabled for bucket: $(requestParameters.bucketName)</description>
80
    <group>aws_s3_public,data_exposure,</group>
81
  </rule>
82

83
  <!-- CloudTrail Tampering -->
84
  <rule id="400040" level="12">
85
    <if_group>amazon</if_group>
86
    <field name="eventName">StopLogging|DeleteTrail|PutEventSelectors</field>
87
    <description>AWS CloudTrail tampering detected: $(eventName) by $(userIdentity.userName)</description>
88
    <group>aws_cloudtrail_tampering,log_tampering,</group>
89
  </rule>
90

91
  <!-- GuardDuty Findings -->
92
  <rule id="400050" level="8">
93
    <if_group>amazon-guardduty</if_group>
94
    <field name="severity" type="pcre2">[5-9]\.|10\.0</field>
95
    <description>AWS GuardDuty High Severity Finding: $(title) - $(type)</description>
96
    <group>aws_guardduty,threat_detection,</group>
97
  </rule>
98

99
  <!-- Critical GuardDuty Findings -->
100
  <rule id="400051" level="12">
101
    <if_group>amazon-guardduty</if_group>
102
    <field name="severity" type="pcre2">[8-9]\.|10\.0</field>
103
    <field name="type">Backdoor|CryptoCurrency|Malware|Persistence|Trojan</field>
104
    <description>AWS GuardDuty Critical Finding: $(title) - Instance: $(service.resourceRole)</description>
105
    <group>aws_guardduty,critical_threat,</group>
106
  </rule>
107

108
  <!-- VPC Flow Log Analysis -->
109
  <rule id="400060" level="5">
110
    <if_group>amazon-vpcflowlogs</if_group>
111
    <field name="action">REJECT</field>
112
    <field name="dstport">22|3389|445|135|139</field>
113
    <description>AWS VPC Flow: Blocked connection attempt to $(dstaddr):$(dstport) from $(srcaddr)</description>
114
    <group>aws_vpc_flow,blocked_connection,</group>
115
  </rule>
116

117
  <!-- DDoS Attack Detection -->
118
  <rule id="400061" level="8" frequency="100" timeframe="60">
119
    <if_group>amazon-vpcflowlogs</if_group>
120
    <field name="action">REJECT</field>
121
    <same_field>srcaddr</same_field>
122
    <description>AWS VPC Flow: Possible DDoS attack from $(srcaddr)</description>
123
    <group>aws_vpc_flow,ddos_attack,</group>
124
  </rule>
125

126
  <!-- Config Compliance Violations -->
127
  <rule id="400070" level="6">
128
    <if_group>amazon-config</if_group>
129
    <field name="configurationItem.complianceType">NON_COMPLIANT</field>
130
    <description>AWS Config Compliance Violation: $(configRuleName) - $(configurationItem.resourceType)</description>
131
    <group>aws_config,compliance_violation,</group>
132
  </rule>
133

134
  <!-- Critical Compliance Violations -->
135
  <rule id="400071" level="10">
136
    <if_sid>400070</if_sid>
137
    <field name="configRuleName">encrypted|public|security-group|iam</field>
138
    <description>AWS Config Critical Compliance Violation: $(configRuleName)</description>
139
    <group>aws_config,critical_compliance,</group>
140
  </rule>
141

142
</group>

Azure Integration Implementation#

Phase 1: Azure Service Configuration#

Log Analytics Workspace Setup#

1
#!/bin/bash
2
# Azure Log Analytics Workspace Setup for Wazuh Integration
3

4
# Variables
5
RESOURCE_GROUP="wazuh-monitoring-rg"
6
WORKSPACE_NAME="wazuh-log-analytics"
7
LOCATION="eastus"
8
STORAGE_ACCOUNT="wazuhlogsstorage"
9

10
# Create Resource Group
11
az group create --name $RESOURCE_GROUP --location $LOCATION
12

13
# Create Log Analytics Workspace
14
az monitor log-analytics workspace create \
15
  --resource-group $RESOURCE_GROUP \
16
  --workspace-name $WORKSPACE_NAME \
17
  --location $LOCATION \
18
  --sku PerGB2018 \
19
  --retention-time 90
20

21
# Get Workspace ID and Key
22
WORKSPACE_ID=$(az monitor log-analytics workspace show \
23
  --resource-group $RESOURCE_GROUP \
24
  --workspace-name $WORKSPACE_NAME \
25
  --query customerId -o tsv)
26

27
WORKSPACE_KEY=$(az monitor log-analytics workspace get-shared-keys \
28
  --resource-group $RESOURCE_GROUP \
29
  --workspace-name $WORKSPACE_NAME \
30
  --query primarySharedKey -o tsv)
31

32
# Create Storage Account for Activity Logs
33
az storage account create \
34
  --name $STORAGE_ACCOUNT \
35
  --resource-group $RESOURCE_GROUP \
36
  --location $LOCATION \
37
  --sku Standard_LRS \
38
  --kind StorageV2
39

40
# Enable Activity Log export to Log Analytics
41
az monitor diagnostic-settings create \
42
  --resource-group $RESOURCE_GROUP \
43
  --name "wazuh-activity-logs" \
44
  --resource "/subscriptions/$(az account show --query id -o tsv)" \
45
  --workspace $WORKSPACE_ID \
46
  --logs '[{"category": "Administrative", "enabled": true},
47
          {"category": "Security", "enabled": true},
48
          {"category": "Alert", "enabled": true}]'
49

50
echo "Workspace ID: $WORKSPACE_ID"
51
echo "Workspace Key: $WORKSPACE_KEY"

Phase 2: Azure AD Application Registration#

Create a service principal for Wazuh Azure integration:

1
#!/bin/bash
2
# Create Azure AD Application for Wazuh Integration
3

4
APP_NAME="WazuhAzureIntegration"
5
SUBSCRIPTION_ID=$(az account show --query id -o tsv)
6
TENANT_ID=$(az account show --query tenantId -o tsv)
7

8
# Create Azure AD Application
9
APP_ID=$(az ad app create \
10
  --display-name $APP_NAME \
11
  --query appId -o tsv)
12

13
# Create Service Principal
14
az ad sp create --id $APP_ID
15

16
# Get Application Secret
17
CLIENT_SECRET=$(az ad app credential reset \
18
  --id $APP_ID \
19
  --query password -o tsv)
20

21
# Assign Reader role to subscription
22
az role assignment create \
23
  --assignee $APP_ID \
24
  --role "Reader" \
25
  --scope "/subscriptions/$SUBSCRIPTION_ID"
26

27
# Assign Security Reader role
28
az role assignment create \
29
  --assignee $APP_ID \
30
  --role "Security Reader" \
31
  --scope "/subscriptions/$SUBSCRIPTION_ID"
32

33
# Create custom role for Log Analytics
34
az role definition create --role-definition '{
35
  "Name": "Wazuh Log Analytics Reader",
36
  "Description": "Can read Log Analytics data for Wazuh integration",
37
  "Actions": [
38
    "Microsoft.OperationalInsights/workspaces/read",
39
    "Microsoft.OperationalInsights/workspaces/query/action",
40
    "Microsoft.OperationalInsights/workspaces/query/*/read",
41
    "Microsoft.OperationalInsights/workspaces/analytics/query/action"
42
  ],
43
  "AssignableScopes": ["/subscriptions/'$SUBSCRIPTION_ID'"]
44
}'
45

46
# Assign custom role
47
az role assignment create \
48
  --assignee $APP_ID \
49
  --role "Wazuh Log Analytics Reader" \
50
  --scope "/subscriptions/$SUBSCRIPTION_ID"
51

52
echo "Application ID: $APP_ID"
53
echo "Client Secret: $CLIENT_SECRET"
54
echo "Tenant ID: $TENANT_ID"
55
echo "Subscription ID: $SUBSCRIPTION_ID"

Phase 3: Wazuh Azure Module Configuration#

Configure Azure integration in /var/ossec/etc/ossec.conf:

1
<ossec_config>
2
  <!-- Azure Log Analytics Integration -->
3
  <wodle name="azure-logs">
4
    <disabled>no</disabled>
5
    <interval>5m</interval>
6
    <run_on_start>yes</run_on_start>
7
    <skip_on_error>yes</skip_on_error>
8

9
    <!-- Log Analytics Configuration -->
10
    <log_analytics>
11
      <auth_path>/var/ossec/wodles/azure/credentials</auth_path>
12
      <tenantdomain>your-tenant.onmicrosoft.com</tenantdomain>
13
      <request>
14
        <tag>azure-activity</tag>
15
        <query>AzureActivity | where TimeGenerated > ago(5m)</query>
16
        <workspace>12345678-1234-1234-1234-123456789012</workspace>
17
        <time_offset>5m</time_offset>
18
      </request>
19
      <request>
20
        <tag>azure-signin</tag>
21
        <query>SigninLogs | where TimeGenerated > ago(5m)</query>
22
        <workspace>12345678-1234-1234-1234-123456789012</workspace>
23
        <time_offset>5m</time_offset>
24
      </request>
25
      <request>
26
        <tag>azure-audit</tag>
27
        <query>AuditLogs | where TimeGenerated > ago(5m)</query>
28
        <workspace>12345678-1234-1234-1234-123456789012</workspace>
29
        <time_offset>5m</time_offset>
30
      </request>
31
      <request>
32
        <tag>azure-security</tag>
33
        <query>SecurityAlert | where TimeGenerated > ago(5m)</query>
34
        <workspace>12345678-1234-1234-1234-123456789012</workspace>
35
        <time_offset>5m</time_offset>
36
      </request>
37
    </log_analytics>
38

39
    <!-- Storage Configuration -->
40
    <storage>
41
      <auth_path>/var/ossec/wodles/azure/credentials</auth_path>
42
      <container name="insights-logs-audit">
43
        <blobs>.json</blobs>
44
        <content_type>json_inline</content_type>
45
        <path>resourceId=/SUBSCRIPTIONS/12345678-1234-1234-1234-123456789012</path>
46
      </container>
47
    </storage>
48
  </wodle>
49
</ossec_config>

Phase 4: Azure Credentials Configuration#

Create the Azure credentials file at /var/ossec/wodles/azure/credentials:

1
[azure-logs]
2
client_id = APPLICATION_ID
3
secret = CLIENT_SECRET
4
domain = TENANT_ID
5
auth_path = /var/ossec/wodles/azure/credentials

Phase 5: Azure Security Rules#

Create Azure-specific security rules:

1
<group name="azure,cloud,">
2

3
  <!-- Successful Admin Login from External IP -->
4
  <rule id="500001" level="8">
5
    <if_group>azure</if_group>
6
    <field name="Category">SignInLogs</field>
7
    <field name="properties.status.errorCode">0</field>
8
    <field name="properties.userPrincipalName" type="pcre2">.*admin.*|.*root.*</field>
9
    <field name="properties.ipAddress" type="pcre2">^(?!10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.)</field>
10
    <description>Azure: Admin login from external IP $(properties.userPrincipalName) from $(properties.ipAddress)</description>
11
    <group>azure_admin_login,authentication,</group>
12
  </rule>
13

14
  <!-- Failed Login Attempts -->
15
  <rule id="500002" level="6" frequency="5" timeframe="300">
16
    <if_group>azure</if_group>
17
    <field name="Category">SignInLogs</field>
18
    <field name="properties.status.errorCode" type="pcre2">^(?!0$)</field>
19
    <same_field>properties.ipAddress</same_field>
20
    <description>Azure: Multiple failed login attempts from $(properties.ipAddress)</description>
21
    <group>azure_failed_login,brute_force,</group>
22
  </rule>
23

24
  <!-- Suspicious Application Consent -->
25
  <rule id="500010" level="9">
26
    <if_group>azure</if_group>
27
    <field name="Category">AuditLogs</field>
28
    <field name="properties.activityDisplayName">Consent to application</field>
29
    <field name="properties.targetResources.type">Application</field>
30
    <description>Azure: Suspicious application consent by $(properties.initiatedBy.user.userPrincipalName)</description>
31
    <group>azure_app_consent,privilege_escalation,</group>
32
  </rule>
33

34
  <!-- Role Assignment Changes -->
35
  <rule id="500011" level="7">
36
    <if_group>azure</if_group>
37
    <field name="Category">AuditLogs</field>
38
    <field name="properties.activityDisplayName">Add member to role</field>
39
    <field name="properties.targetResources.modifiedProperties.newValue" type="pcre2">(Admin|Owner|Contributor)</field>
40
    <description>Azure: Privileged role assignment - $(properties.targetResources.modifiedProperties.newValue)</description>
41
    <group>azure_role_assignment,privilege_escalation,</group>
42
  </rule>
43

44
  <!-- Resource Group Deletion -->
45
  <rule id="500020" level="10">
46
    <if_group>azure</if_group>
47
    <field name="Category">AzureActivity</field>
48
    <field name="properties.eventName.value">Microsoft.Resources/subscriptions/resourcegroups/delete</field>
49
    <field name="properties.status.value">Succeeded</field>
50
    <description>Azure: Resource group deleted - $(properties.resourceGroupName) by $(properties.caller)</description>
51
    <group>azure_resource_deletion,</group>
52
  </rule>
53

54
  <!-- Virtual Machine Deletion -->
55
  <rule id="500021" level="9">
56
    <if_group>azure</if_group>
57
    <field name="Category">AzureActivity</field>
58
    <field name="properties.eventName.value">Microsoft.Compute/virtualMachines/delete</field>
59
    <field name="properties.status.value">Succeeded</field>
60
    <description>Azure: Virtual machine deleted - $(properties.resourceId) by $(properties.caller)</description>
61
    <group>azure_vm_deletion,</group>
62
  </rule>
63

64
  <!-- Security Center Alerts -->
65
  <rule id="500030" level="8">
66
    <if_group>azure</if_group>
67
    <field name="Category">SecurityAlert</field>
68
    <field name="properties.severity">High|Medium</field>
69
    <description>Azure Security Center Alert: $(properties.alertDisplayName) - $(properties.description)</description>
70
    <group>azure_security_alert,</group>
71
  </rule>
72

73
  <!-- Critical Security Alerts -->
74
  <rule id="500031" level="12">
75
    <if_sid>500030</if_sid>
76
    <field name="properties.severity">High</field>
77
    <field name="properties.alertDisplayName" type="pcre2">(Malware|Ransomware|Suspicious|Attack)</field>
78
    <description>Azure Critical Security Alert: $(properties.alertDisplayName)</description>
79
    <group>azure_critical_alert,</group>
80
  </rule>
81

82
  <!-- Key Vault Access -->
83
  <rule id="500040" level="6">
84
    <if_group>azure</if_group>
85
    <field name="Category">AzureActivity</field>
86
    <field name="properties.resourceProvider.value">Microsoft.KeyVault</field>
87
    <field name="properties.eventName.value" type="pcre2">(get|list|delete)</field>
88
    <description>Azure: Key Vault access - $(properties.eventName.value) by $(properties.caller)</description>
89
    <group>azure_key_vault,</group>
90
  </rule>
91

92
  <!-- Suspicious Key Vault Activity -->
93
  <rule id="500041" level="9">
94
    <if_sid>500040</if_sid>
95
    <field name="properties.caller" type="pcre2">^(?!.*@yourdomain\.com$)</field>
96
    <description>Azure: Suspicious Key Vault access from external user $(properties.caller)</description>
97
    <group>azure_key_vault,suspicious_access,</group>
98
  </rule>
99

100
</group>

GCP Integration Implementation#

Phase 1: GCP Service Account and Permissions#

Create a service account for Wazuh integration:

1
#!/bin/bash
2
# GCP Service Account Setup for Wazuh Integration
3

4
PROJECT_ID="your-project-id"
5
SERVICE_ACCOUNT="wazuh-integration"
6
SERVICE_ACCOUNT_EMAIL="$SERVICE_ACCOUNT@$PROJECT_ID.iam.gserviceaccount.com"
7
KEY_FILE="/var/ossec/wodles/gcp/credentials.json"
8

9
# Create service account
10
gcloud iam service-accounts create $SERVICE_ACCOUNT \
11
    --description="Wazuh GCP Integration Service Account" \
12
    --display-name="Wazuh Integration"
13

14
# Grant necessary roles
15
gcloud projects add-iam-policy-binding $PROJECT_ID \
16
    --member="serviceAccount:$SERVICE_ACCOUNT_EMAIL" \
17
    --role="roles/logging.viewer"
18

19
gcloud projects add-iam-policy-binding $PROJECT_ID \
20
    --member="serviceAccount:$SERVICE_ACCOUNT_EMAIL" \
21
    --role="roles/monitoring.viewer"
22

23
gcloud projects add-iam-policy-binding $PROJECT_ID \
24
    --member="serviceAccount:$SERVICE_ACCOUNT_EMAIL" \
25
    --role="roles/securitycenter.findingsViewer"
26

27
gcloud projects add-iam-policy-binding $PROJECT_ID \
28
    --member="serviceAccount:$SERVICE_ACCOUNT_EMAIL" \
29
    --role="roles/compute.viewer"
30

31
gcloud projects add-iam-policy-binding $PROJECT_ID \
32
    --member="serviceAccount:$SERVICE_ACCOUNT_EMAIL" \
33
    --role="roles/cloudsql.viewer"
34

35
# Generate and download service account key
36
gcloud iam service-accounts keys create $KEY_FILE \
37
    --iam-account=$SERVICE_ACCOUNT_EMAIL
38

39
# Set proper permissions
40
chmod 600 $KEY_FILE
41
chown ossec:ossec $KEY_FILE
42

43
echo "Service account created: $SERVICE_ACCOUNT_EMAIL"
44
echo "Key file saved to: $KEY_FILE"

Phase 2: GCP Pub/Sub Configuration#

Set up Pub/Sub for log forwarding:

1
#!/bin/bash
2
# GCP Pub/Sub Setup for Wazuh Integration
3

4
PROJECT_ID="your-project-id"
5
TOPIC_NAME="wazuh-security-logs"
6
SUBSCRIPTION_NAME="wazuh-subscription"
7
SERVICE_ACCOUNT_EMAIL="wazuh-integration@$PROJECT_ID.iam.gserviceaccount.com"
8

9
# Create Pub/Sub topic
10
gcloud pubsub topics create $TOPIC_NAME
11

12
# Create subscription
13
gcloud pubsub subscriptions create $SUBSCRIPTION_NAME \
14
    --topic=$TOPIC_NAME \
15
    --ack-deadline=300
16

17
# Grant Pub/Sub permissions to service account
18
gcloud pubsub topics add-iam-policy-binding $TOPIC_NAME \
19
    --member="serviceAccount:$SERVICE_ACCOUNT_EMAIL" \
20
    --role="roles/pubsub.subscriber"
21

22
gcloud pubsub subscriptions add-iam-policy-binding $SUBSCRIPTION_NAME \
23
    --member="serviceAccount:$SERVICE_ACCOUNT_EMAIL" \
24
    --role="roles/pubsub.subscriber"
25

26
# Create log sink to Pub/Sub
27
gcloud logging sinks create wazuh-security-sink \
28
    pubsub.googleapis.com/projects/$PROJECT_ID/topics/$TOPIC_NAME \
29
    --log-filter='protoPayload.serviceName="compute.googleapis.com" OR
30
                  protoPayload.serviceName="cloudsql.googleapis.com" OR
31
                  protoPayload.serviceName="iam.googleapis.com" OR
32
                  protoPayload.serviceName="container.googleapis.com" OR
33
                  severity>=ERROR'
34

35
# Get sink service account
36
SINK_SA=$(gcloud logging sinks describe wazuh-security-sink --format="value(writerIdentity)")
37

38
# Grant Pub/Sub publisher role to sink service account
39
gcloud pubsub topics add-iam-policy-binding $TOPIC_NAME \
40
    --member="$SINK_SA" \
41
    --role="roles/pubsub.publisher"
42

43
echo "Pub/Sub topic created: $TOPIC_NAME"
44
echo "Subscription created: $SUBSCRIPTION_NAME"
45
echo "Log sink created: wazuh-security-sink"

Phase 3: Wazuh GCP Module Configuration#

Configure GCP integration in /var/ossec/etc/ossec.conf:

1
<ossec_config>
2
  <!-- Google Cloud Pub/Sub Integration -->
3
  <wodle name="gcp-pubsub">
4
    <disabled>no</disabled>
5
    <interval>5m</interval>
6
    <run_on_start>yes</run_on_start>
7
    <skip_on_error>yes</skip_on_error>
8

9
    <!-- Pub/Sub Configuration -->
10
    <pull>
11
      <project_id>your-project-id</project_id>
12
      <subscription_name>wazuh-subscription</subscription_name>
13
      <credentials_file>/var/ossec/wodles/gcp/credentials.json</credentials_file>
14
      <max_messages>100</max_messages>
15
      <logging>debug</logging>
16
    </pull>
17
  </wodle>
18

19
  <!-- Google Cloud Storage Bucket Integration -->
20
  <wodle name="gcp-bucket">
21
    <disabled>no</disabled>
22
    <interval>10m</interval>
23
    <run_on_start>yes</run_on_start>
24
    <skip_on_error>yes</skip_on_error>
25

26
    <bucket>
27
      <name>wazuh-gcp-logs-bucket</name>
28
      <credentials_file>/var/ossec/wodles/gcp/credentials.json</credentials_file>
29
      <prefix>security-logs/</prefix>
30
      <only_logs_after>2025-01-01</only_logs_after>
31
      <remove_from_bucket>no</remove_from_bucket>
32
    </bucket>
33
  </wodle>
34
</ossec_config>

Phase 4: GCP Security Rules#

Create GCP-specific security rules:

1
<group name="gcp,cloud,">
2

3
  <!-- VM Instance Creation -->
4
  <rule id="600001" level="6">
5
    <if_group>gcp</if_group>
6
    <field name="protoPayload.serviceName">compute.googleapis.com</field>
7
    <field name="protoPayload.methodName">v1.compute.instances.insert</field>
8
    <field name="severity">NOTICE</field>
9
    <description>GCP: VM instance created - $(protoPayload.resourceName) by $(protoPayload.authenticationInfo.principalEmail)</description>
10
    <group>gcp_vm_creation,</group>
11
  </rule>
12

13
  <!-- Suspicious VM Creation -->
14
  <rule id="600002" level="8">
15
    <if_sid>600001</if_sid>
16
    <field name="protoPayload.authenticationInfo.principalEmail" type="pcre2">^(?!.*@yourdomain\.com$)</field>
17
    <description>GCP: Suspicious VM creation by external user $(protoPayload.authenticationInfo.principalEmail)</description>
18
    <group>gcp_vm_creation,suspicious,</group>
19
  </rule>
20

21
  <!-- IAM Policy Changes -->
22
  <rule id="600010" level="7">
23
    <if_group>gcp</if_group>
24
    <field name="protoPayload.serviceName">iam.googleapis.com</field>
25
    <field name="protoPayload.methodName">SetIamPolicy</field>
26
    <description>GCP: IAM policy changed for $(protoPayload.resourceName) by $(protoPayload.authenticationInfo.principalEmail)</description>
27
    <group>gcp_iam_policy,</group>
28
  </rule>
29

30
  <!-- Privilege Escalation -->
31
  <rule id="600011" level="10">
32
    <if_sid>600010</if_sid>
33
    <field name="protoPayload.request.policy.bindings.role" type="pcre2">(owner|editor|admin)</field>
34
    <description>GCP: Privileged role assignment - $(protoPayload.request.policy.bindings.role)</description>
35
    <group>gcp_privilege_escalation,</group>
36
  </rule>
37

38
  <!-- Service Account Key Creation -->
39
  <rule id="600020" level="8">
40
    <if_group>gcp</if_group>
41
    <field name="protoPayload.serviceName">iam.googleapis.com</field>
42
    <field name="protoPayload.methodName">google.iam.admin.v1.IAM.CreateServiceAccountKey</field>
43
    <description>GCP: Service account key created for $(protoPayload.request.name) by $(protoPayload.authenticationInfo.principalEmail)</description>
44
    <group>gcp_service_account_key,</group>
45
  </rule>
46

47
  <!-- Firewall Rule Changes -->
48
  <rule id="600030" level="6">
49
    <if_group>gcp</if_group>
50
    <field name="protoPayload.serviceName">compute.googleapis.com</field>
51
    <field name="protoPayload.methodName">v1.compute.firewalls.insert|v1.compute.firewalls.patch</field>
52
    <description>GCP: Firewall rule modified - $(protoPayload.resourceName) by $(protoPayload.authenticationInfo.principalEmail)</description>
53
    <group>gcp_firewall,</group>
54
  </rule>
55

56
  <!-- Dangerous Firewall Rule -->
57
  <rule id="600031" level="10">
58
    <if_sid>600030</if_sid>
59
    <field name="protoPayload.request.body.sourceRanges">0.0.0.0/0</field>
60
    <field name="protoPayload.request.body.allowed.ports">22|3389</field>
61
    <description>GCP: Dangerous firewall rule created - SSH/RDP open to 0.0.0.0/0</description>
62
    <group>gcp_firewall,dangerous_rule,</group>
63
  </rule>
64

65
  <!-- Storage Bucket Access -->
66
  <rule id="600040" level="5">
67
    <if_group>gcp</if_group>
68
    <field name="protoPayload.serviceName">storage.googleapis.com</field>
69
    <field name="protoPayload.methodName">storage.objects.get|storage.objects.list</field>
70
    <description>GCP: Storage bucket accessed - $(protoPayload.resourceName) by $(protoPayload.authenticationInfo.principalEmail)</description>
71
    <group>gcp_storage_access,</group>
72
  </rule>
73

74
  <!-- Public Bucket Access -->
75
  <rule id="600041" level="8">
76
    <if_group>gcp</if_group>
77
    <field name="protoPayload.serviceName">storage.googleapis.com</field>
78
    <field name="protoPayload.methodName">storage.buckets.setIamPolicy</field>
79
    <field name="protoPayload.request.policy.bindings.members">allUsers|allAuthenticatedUsers</field>
80
    <description>GCP: Storage bucket made public - $(protoPayload.resourceName)</description>
81
    <group>gcp_storage_public,data_exposure,</group>
82
  </rule>
83

84
  <!-- Cloud SQL Instance Changes -->
85
  <rule id="600050" level="7">
86
    <if_group>gcp</if_group>
87
    <field name="protoPayload.serviceName">cloudsql.googleapis.com</field>
88
    <field name="protoPayload.methodName">cloudsql.instances.create|cloudsql.instances.patch</field>
89
    <description>GCP: Cloud SQL instance modified - $(protoPayload.resourceName) by $(protoPayload.authenticationInfo.principalEmail)</description>
90
    <group>gcp_cloudsql,</group>
91
  </rule>
92

93
  <!-- Kubernetes Cluster Operations -->
94
  <rule id="600060" level="6">
95
    <if_group>gcp</if_group>
96
    <field name="protoPayload.serviceName">container.googleapis.com</field>
97
    <field name="protoPayload.methodName">google.container.v1.ClusterManager.CreateCluster</field>
98
    <description>GCP: Kubernetes cluster created - $(protoPayload.resourceName) by $(protoPayload.authenticationInfo.principalEmail)</description>
99
    <group>gcp_kubernetes,</group>
100
  </rule>
101

102
  <!-- Security Center Findings -->
103
  <rule id="600070" level="8">
104
    <if_group>gcp</if_group>
105
    <field name="jsonPayload.finding.category">MALWARE|PERSISTENCE|PRIVILEGE_ESCALATION</field>
106
    <description>GCP Security Center Finding: $(jsonPayload.finding.category) - $(jsonPayload.finding.name)</description>
107
    <group>gcp_security_center,</group>
108
  </rule>
109

110
</group>

Multi-Cloud Correlation Rules#

Create correlation rules that work across all cloud platforms:

1
<group name="multi-cloud,correlation,">
2

3
  <!-- Cross-Cloud Admin Activity -->
4
  <rule id="700001" level="10">
5
    <if_matched_group>aws_root_usage</if_matched_group>
6
    <if_matched_group>azure_admin_login</if_matched_group>
7
    <timeframe>1800</timeframe>
8
    <description>Multi-Cloud: Administrator activity detected across AWS and Azure within 30 minutes</description>
9
    <group>multi_cloud_admin,correlation,</group>
10
  </rule>
11

12
  <!-- Suspicious Cross-Cloud Access Pattern -->
13
  <rule id="700002" level="12">
14
    <if_matched_group>aws_console_login</if_matched_group>
15
    <if_matched_group>gcp_vm_creation</if_matched_group>
16
    <same_field>sourceIPAddress</same_field>
17
    <timeframe>3600</timeframe>
18
    <description>Multi-Cloud: Same IP accessing AWS and creating GCP resources - $(sourceIPAddress)</description>
19
    <group>multi_cloud_suspicious,correlation,</group>
20
  </rule>
21

22
  <!-- Data Exfiltration Pattern -->
23
  <rule id="700010" level="12">
24
    <if_matched_group>aws_s3_public</if_matched_group>
25
    <if_matched_group>azure_key_vault</if_matched_group>
26
    <if_matched_group>gcp_storage_public</if_matched_group>
27
    <timeframe>7200</timeframe>
28
    <description>Multi-Cloud: Potential data exfiltration pattern across AWS, Azure, and GCP</description>
29
    <group>multi_cloud_exfiltration,correlation,</group>
30
  </rule>
31

32
  <!-- Infrastructure Destruction Pattern -->
33
  <rule id="700020" level="12">
34
    <if_matched_group>aws_cloudtrail_tampering</if_matched_group>
35
    <if_matched_group>azure_resource_deletion</if_matched_group>
36
    <timeframe>1800</timeframe>
37
    <description>Multi-Cloud: Infrastructure destruction detected across AWS and Azure</description>
38
    <group>multi_cloud_destruction,correlation,</group>
39
  </rule>
40

41
</group>

Unified Dashboard Configuration#

Phase 1: OpenSearch Dashboard Setup#

Create custom visualizations for multi-cloud monitoring:

1
{
2
  "multi_cloud_dashboard": {
3
    "version": "2.0",
4
    "objects": [
5
      {
6
        "id": "multi-cloud-overview",
7
        "type": "dashboard",
8
        "attributes": {
9
          "title": "Multi-Cloud Security Overview",
10
          "hits": 0,
11
          "description": "Unified security monitoring across AWS, Azure, and GCP",
12
          "panelsJSON": "[{\"version\":\"2.0\",\"gridData\":{\"x\":0,\"y\":0,\"w\":24,\"h\":8},\"panelIndex\":\"1\",\"embeddableConfig\":{},\"panelRefName\":\"panel_1\"},{\"version\":\"2.0\",\"gridData\":{\"x\":24,\"y\":0,\"w\":24,\"h\":8},\"panelIndex\":\"2\",\"embeddableConfig\":{},\"panelRefName\":\"panel_2\"}]",
13
          "optionsJSON": "{\"useMargins\":true,\"syncColors\":false,\"hidePanelTitles\":false}",
14
          "timeRestore": true,
15
          "timeTo": "now",
16
          "timeFrom": "now-24h",
17
          "refreshInterval": {
18
            "pause": false,
19
            "value": 300000
20
          }
21
        }
22
      },
23
      {
24
        "id": "cloud-events-by-platform",
25
        "type": "visualization",
26
        "attributes": {
27
          "title": "Security Events by Cloud Platform",
28
          "visState": "{\"title\":\"Security Events by Cloud Platform\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\"},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"data.integration\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}]}",
29
          "uiStateJSON": "{}",
30
          "description": "",
31
          "kibanaSavedObjectMeta": {
32
            "searchSourceJSON": "{\"index\":\"wazuh-alerts-*\",\"query\":{\"match\":{\"data.integration\":{\"query\":\"aws azure gcp\",\"type\":\"phrase\"}}}}"
33
          }
34
        }
35
      },
36
      {
37
        "id": "top-cloud-threats",
38
        "type": "visualization",
39
        "attributes": {
40
          "title": "Top Cloud Threats",
41
          "visState": "{\"title\":\"Top Cloud Threats\",\"type\":\"histogram\",\"params\":{\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":true,\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"rule.description\",\"size\":10,\"order\":\"desc\",\"orderBy\":\"1\"}}]}",
42
          "uiStateJSON": "{}",
43
          "description": "",
44
          "kibanaSavedObjectMeta": {
45
            "searchSourceJSON": "{\"index\":\"wazuh-alerts-*\",\"query\":{\"bool\":{\"must\":[{\"terms\":{\"data.integration\":[\"aws\",\"azure\",\"gcp\"]}},{\"range\":{\"rule.level\":{\"gte\":8}}}]}}}"
46
          }
47
        }
48
      }
49
    ]
50
  }
51
}

Phase 2: Custom Monitoring Script#

Create a comprehensive monitoring script that tracks multi-cloud metrics:

1
#!/usr/bin/env python3
2
"""
3
Multi-Cloud Security Monitoring Dashboard
4
Real-time monitoring across AWS, Azure, and GCP
5
"""
6

7
import asyncio
8
import json
9
import logging
10
from datetime import datetime, timedelta
11
from pathlib import Path
12
import aiohttp
13
from elasticsearch import AsyncElasticsearch
14
import boto3
15
from azure.identity import DefaultAzureCredential
16
from azure.mgmt.monitor import MonitorManagementClient
17
from google.cloud import logging as gcp_logging
18

19
class MultiCloudMonitor:
20
    def __init__(self):
21
        self.es_client = AsyncElasticsearch([
22
            {'host': 'localhost', 'port': 9200}
23
        ])
24
        self.metrics = {
25
            'aws': {'events': 0, 'threats': 0, 'compliance': 0},
26
            'azure': {'events': 0, 'threats': 0, 'compliance': 0},
27
            'gcp': {'events': 0, 'threats': 0, 'compliance': 0},
28
            'total': {'events': 0, 'threats': 0, 'compliance': 0}
29
        }
30

31
        logging.basicConfig(
32
            level=logging.INFO,
33
            format='%(asctime)s - %(levelname)s - %(message)s'
34
        )
35

36
    async def collect_aws_metrics(self):
37
        """Collect AWS security metrics from Elasticsearch"""
38
        query = {
39
            "query": {
40
                "bool": {
41
                    "must": [
42
                        {"term": {"data.integration": "aws"}},
43
                        {"range": {"@timestamp": {"gte": "now-1h"}}}
44
                    ]
45
                }
46
            },
47
            "aggs": {
48
                "threat_levels": {
49
                    "range": {
50
                        "field": "rule.level",
51
                        "ranges": [
52
                            {"from": 1, "to": 7, "key": "low"},
53
                            {"from": 8, "to": 10, "key": "medium"},
54
                            {"from": 11, "to": 15, "key": "high"}
55
                        ]
56
                    }
57
                },
58
                "service_breakdown": {
59
                    "terms": {
60
                        "field": "data.aws.source",
61
                        "size": 10
62
                    }
63
                }
64
            }
65
        }
66

67
        try:
68
            response = await self.es_client.search(
69
                index="wazuh-alerts-*",
70
                body=query
71
            )
72

73
            total_events = response['hits']['total']['value']
74
            threat_events = 0
75

76
            for bucket in response['aggregations']['threat_levels']['buckets']:
77
                if bucket['key'] in ['medium', 'high']:
78
                    threat_events += bucket['doc_count']
79

80
            self.metrics['aws']['events'] = total_events
81
            self.metrics['aws']['threats'] = threat_events
82

83
            logging.info(f"AWS Metrics - Events: {total_events}, Threats: {threat_events}")
84

85
        except Exception as e:
86
            logging.error(f"Failed to collect AWS metrics: {e}")
87

88
    async def collect_azure_metrics(self):
89
        """Collect Azure security metrics from Elasticsearch"""
90
        query = {
91
            "query": {
92
                "bool": {
93
                    "must": [
94
                        {"term": {"data.integration": "azure"}},
95
                        {"range": {"@timestamp": {"gte": "now-1h"}}}
96
                    ]
97
                }
98
            },
99
            "aggs": {
100
                "threat_levels": {
101
                    "range": {
102
                        "field": "rule.level",
103
                        "ranges": [
104
                            {"from": 1, "to": 7, "key": "low"},
105
                            {"from": 8, "to": 10, "key": "medium"},
106
                            {"from": 11, "to": 15, "key": "high"}
107
                        ]
108
                    }
109
                },
110
                "activity_types": {
111
                    "terms": {
112
                        "field": "data.azure.Category",
113
                        "size": 10
114
                    }
115
                }
116
            }
117
        }
118

119
        try:
120
            response = await self.es_client.search(
121
                index="wazuh-alerts-*",
122
                body=query
123
            )
124

125
            total_events = response['hits']['total']['value']
126
            threat_events = 0
127

128
            for bucket in response['aggregations']['threat_levels']['buckets']:
129
                if bucket['key'] in ['medium', 'high']:
130
                    threat_events += bucket['doc_count']
131

132
            self.metrics['azure']['events'] = total_events
133
            self.metrics['azure']['threats'] = threat_events
134

135
            logging.info(f"Azure Metrics - Events: {total_events}, Threats: {threat_events}")
136

137
        except Exception as e:
138
            logging.error(f"Failed to collect Azure metrics: {e}")
139

140
    async def collect_gcp_metrics(self):
141
        """Collect GCP security metrics from Elasticsearch"""
142
        query = {
143
            "query": {
144
                "bool": {
145
                    "must": [
146
                        {"term": {"data.integration": "gcp"}},
147
                        {"range": {"@timestamp": {"gte": "now-1h"}}}
148
                    ]
149
                }
150
            },
151
            "aggs": {
152
                "threat_levels": {
153
                    "range": {
154
                        "field": "rule.level",
155
                        "ranges": [
156
                            {"from": 1, "to": 7, "key": "low"},
157
                            {"from": 8, "to": 10, "key": "medium"},
158
                            {"from": 11, "to": 15, "key": "high"}
159
                        ]
160
                    }
161
                },
162
                "service_breakdown": {
163
                    "terms": {
164
                        "field": "data.gcp.serviceName",
165
                        "size": 10
166
                    }
167
                }
168
            }
169
        }
170

171
        try:
172
            response = await self.es_client.search(
173
                index="wazuh-alerts-*",
174
                body=query
175
            )
176

177
            total_events = response['hits']['total']['value']
178
            threat_events = 0
179

180
            for bucket in response['aggregations']['threat_levels']['buckets']:
181
                if bucket['key'] in ['medium', 'high']:
182
                    threat_events += bucket['doc_count']
183

184
            self.metrics['gcp']['events'] = total_events
185
            self.metrics['gcp']['threats'] = threat_events
186

187
            logging.info(f"GCP Metrics - Events: {total_events}, Threats: {threat_events}")
188

189
        except Exception as e:
190
            logging.error(f"Failed to collect GCP metrics: {e}")
191

192
    async def check_compliance_status(self):
193
        """Check compliance status across all clouds"""
194
        compliance_query = {
195
            "query": {
196
                "bool": {
197
                    "must": [
198
                        {"terms": {"data.integration": ["aws", "azure", "gcp"]}},
199
                        {"terms": {"rule.groups": ["compliance", "pci_dss", "gdpr", "hipaa"]}},
200
                        {"range": {"@timestamp": {"gte": "now-24h"}}}
201
                    ]
202
                }
203
            },
204
            "aggs": {
205
                "compliance_by_cloud": {
206
                    "terms": {
207
                        "field": "data.integration",
208
                        "size": 3
209
                    },
210
                    "aggs": {
211
                        "compliance_status": {
212
                            "terms": {
213
                                "field": "rule.groups",
214
                                "size": 10
215
                            }
216
                        }
217
                    }
218
                }
219
            }
220
        }
221

222
        try:
223
            response = await self.es_client.search(
224
                index="wazuh-alerts-*",
225
                body=compliance_query
226
            )
227

228
            for bucket in response['aggregations']['compliance_by_cloud']['buckets']:
229
                cloud = bucket['key']
230
                compliance_violations = bucket['doc_count']
231
                self.metrics[cloud]['compliance'] = compliance_violations
232

233
            logging.info("Compliance status updated for all clouds")
234

235
        except Exception as e:
236
            logging.error(f"Failed to check compliance status: {e}")
237

238
    async def generate_threat_intelligence_report(self):
239
        """Generate threat intelligence report across clouds"""
240
        threat_query = {
241
            "query": {
242
                "bool": {
243
                    "must": [
244
                        {"terms": {"data.integration": ["aws", "azure", "gcp"]}},
245
                        {"range": {"rule.level": {"gte": 8}}},
246
                        {"range": {"@timestamp": {"gte": "now-24h"}}}
247
                    ]
248
                }
249
            },
250
            "aggs": {
251
                "threat_patterns": {
252
                    "terms": {
253
                        "field": "rule.description",
254
                        "size": 20
255
                    }
256
                },
257
                "attack_sources": {
258
                    "terms": {
259
                        "field": "data.srcip",
260
                        "size": 20
261
                    }
262
                },
263
                "timeline": {
264
                    "date_histogram": {
265
                        "field": "@timestamp",
266
                        "calendar_interval": "1h"
267
                    }
268
                }
269
            }
270
        }
271

272
        try:
273
            response = await self.es_client.search(
274
                index="wazuh-alerts-*",
275
                body=threat_query
276
            )
277

278
            report = {
279
                'timestamp': datetime.now().isoformat(),
280
                'total_threats': response['hits']['total']['value'],
281
                'top_threats': [
282
                    {'pattern': bucket['key'], 'count': bucket['doc_count']}
283
                    for bucket in response['aggregations']['threat_patterns']['buckets'][:10]
284
                ],
285
                'attack_sources': [
286
                    {'ip': bucket['key'], 'count': bucket['doc_count']}
287
                    for bucket in response['aggregations']['attack_sources']['buckets'][:10]
288
                ],
289
                'timeline': [
290
                    {'time': bucket['key_as_string'], 'count': bucket['doc_count']}
291
                    for bucket in response['aggregations']['timeline']['buckets']
292
                ]
293
            }
294

295
            # Save report to file
296
            report_file = Path(f"/var/ossec/logs/multi-cloud-threat-report-{datetime.now().strftime('%Y%m%d-%H%M')}.json")
297
            with open(report_file, 'w') as f:
298
                json.dump(report, f, indent=2)
299

300
            logging.info(f"Threat intelligence report generated: {report_file}")
301
            return report
302

303
        except Exception as e:
304
            logging.error(f"Failed to generate threat intelligence report: {e}")
305
            return None
306

307
    async def calculate_security_score(self):
308
        """Calculate overall security score across clouds"""
309
        total_events = sum(cloud['events'] for cloud in self.metrics.values() if isinstance(cloud, dict))
310
        total_threats = sum(cloud['threats'] for cloud in self.metrics.values() if isinstance(cloud, dict))
311
        total_compliance = sum(cloud['compliance'] for cloud in self.metrics.values() if isinstance(cloud, dict))
312

313
        # Calculate score based on threat ratio and compliance violations
314
        if total_events > 0:
315
            threat_ratio = total_threats / total_events
316
        else:
317
            threat_ratio = 0
318

319
        # Base score of 100, subtract points for threats and compliance violations
320
        security_score = 100 - (threat_ratio * 50) - (total_compliance * 0.1)
321
        security_score = max(0, min(100, security_score))  # Clamp between 0-100
322

323
        self.metrics['total'] = {
324
            'events': total_events,
325
            'threats': total_threats,
326
            'compliance': total_compliance,
327
            'security_score': round(security_score, 2)
328
        }
329

330
        logging.info(f"Overall Security Score: {security_score:.2f}")
331
        return security_score
332

333
    async def send_alerts(self):
334
        """Send alerts for critical security events"""
335
        critical_query = {
336
            "query": {
337
                "bool": {
338
                    "must": [
339
                        {"terms": {"data.integration": ["aws", "azure", "gcp"]}},
340
                        {"range": {"rule.level": {"gte": 12}}},
341
                        {"range": {"@timestamp": {"gte": "now-5m"}}}
342
                    ]
343
                }
344
            }
345
        }
346

347
        try:
348
            response = await self.es_client.search(
349
                index="wazuh-alerts-*",
350
                body=critical_query,
351
                size=50
352
            )
353

354
            critical_alerts = response['hits']['hits']
355

356
            if critical_alerts:
357
                alert_summary = {
358
                    'timestamp': datetime.now().isoformat(),
359
                    'critical_alerts_count': len(critical_alerts),
360
                    'alerts': [
361
                        {
362
                            'cloud': alert['_source']['data']['integration'],
363
                            'rule_id': alert['_source']['rule']['id'],
364
                            'description': alert['_source']['rule']['description'],
365
                            'level': alert['_source']['rule']['level'],
366
                            'timestamp': alert['_source']['@timestamp']
367
                        }
368
                        for alert in critical_alerts
369
                    ]
370
                }
371

372
                # Save critical alerts
373
                alert_file = Path(f"/var/ossec/logs/critical-alerts-{datetime.now().strftime('%Y%m%d-%H%M')}.json")
374
                with open(alert_file, 'w') as f:
375
                    json.dump(alert_summary, f, indent=2)
376

377
                logging.warning(f"CRITICAL: {len(critical_alerts)} critical alerts detected!")
378
                return alert_summary
379

380
        except Exception as e:
381
            logging.error(f"Failed to check for critical alerts: {e}")
382

383
        return None
384

385
    async def run_monitoring_cycle(self):
386
        """Run a complete monitoring cycle"""
387
        try:
388
            # Collect metrics from all clouds
389
            await asyncio.gather(
390
                self.collect_aws_metrics(),
391
                self.collect_azure_metrics(),
392
                self.collect_gcp_metrics()
393
            )
394

395
            # Check compliance and calculate scores
396
            await self.check_compliance_status()
397
            await self.calculate_security_score()
398

399
            # Generate reports and check for critical alerts
400
            threat_report = await self.generate_threat_intelligence_report()
401
            critical_alerts = await self.send_alerts()
402

403
            # Log summary
404
            logging.info("=== Multi-Cloud Security Summary ===")
405
            for cloud, metrics in self.metrics.items():
406
                if isinstance(metrics, dict) and cloud != 'total':
407
                    logging.info(f"{cloud.upper()}: Events={metrics['events']}, Threats={metrics['threats']}, Compliance={metrics['compliance']}")
408

409
            logging.info(f"OVERALL SECURITY SCORE: {self.metrics['total']['security_score']}")
410

411
            if critical_alerts:
412
                logging.warning(f"CRITICAL ALERTS: {critical_alerts['critical_alerts_count']}")
413

414
            return {
415
                'metrics': self.metrics,
416
                'threat_report': threat_report,
417
                'critical_alerts': critical_alerts
418
            }
419

420
        except Exception as e:
421
            logging.error(f"Monitoring cycle failed: {e}")
422
            return None
423

424
    async def start_continuous_monitoring(self):
425
        """Start continuous monitoring loop"""
426
        logging.info("Starting Multi-Cloud Security Monitoring...")
427

428
        while True:
429
            try:
430
                await self.run_monitoring_cycle()
431
                await asyncio.sleep(300)  # Run every 5 minutes
432

433
            except KeyboardInterrupt:
434
                logging.info("Monitoring stopped by user")
435
                break
436
            except Exception as e:
437
                logging.error(f"Unexpected error in monitoring loop: {e}")
438
                await asyncio.sleep(60)  # Wait 1 minute before retrying
439

440
async def main():
441
    monitor = MultiCloudMonitor()
442
    await monitor.start_continuous_monitoring()
443

444
if __name__ == "__main__":
445
    asyncio.run(main())

Best Practices and Optimization#

Performance Optimization Tips#

Event Filtering: Configure appropriate log levels and filters to reduce noise
Regional Deployment: Deploy Wazuh managers in each cloud region for better performance
Batch Processing: Use batch processing for high-volume log ingestion
Resource Monitoring: Monitor Wazuh manager resources and scale appropriately

Security Hardening#

Encryption: Enable encryption for all data in transit and at rest
Access Controls: Implement least privilege access for cloud service accounts
Network Segmentation: Isolate Wazuh infrastructure in secure network segments
Regular Updates: Keep Wazuh and cloud integrations updated

Cost Optimization#

Log Retention: Implement appropriate log retention policies
Data Compression: Enable compression for log storage and transmission
Alert Tuning: Fine-tune alert rules to reduce false positives
Resource Scheduling: Use auto-scaling for cost-effective resource management

Conclusion#

Multi-cloud security monitoring with Wazuh provides organizations with unified visibility and threat detection across AWS, Azure, and GCP environments. This comprehensive approach enables:

🌐 Unified Security Operations: Single pane of glass for all cloud security events
🔍 Enhanced Threat Detection: Correlation and analysis across multiple cloud platforms
📊 Comprehensive Compliance: Automated compliance monitoring and reporting
⚡ Rapid Incident Response: Centralized alerting and response capabilities
💰 Cost Effectiveness: Single solution for multi-cloud security monitoring

Key Takeaways#

Start with Core Services: Begin monitoring critical cloud services first
Implement Gradually: Roll out integration platform by platform
Focus on High-Value Events: Prioritize security-relevant events over noise
Test Thoroughly: Validate all integrations in non-production environments
Monitor Performance: Continuously optimize for performance and cost

Resources#

Secure your multi-cloud environment with unified Wazuh monitoring! 🌐🛡️

Newsletter