Test: AWS

[albertomn86]

Amazon Web Services test

Version	Revision	Branch
3.9.0	3916	3.9

RPM (Linux)

• [x] Configure ossec.conf to use different services and check manager logs:
  • [x] CloudTrail.
  • [x] Config.
  • [x] VPC.
  • [ ] GuardDuty.
  • [x] Inspector.
  • [x] Macie (custom).
  • [x] KMS (custom).
  • [ ] TrustedAdvisor (custom).
• [x] Check wodle related alerts are being stored in alerts.json.
• [x] Configure AWS in Wazuh v3.5 and check it correctly upgrades to the latest version.
• [x] Check configurations of multiple regions.
• [x] Check pull of logs from CloudTrail.
• [x] Check pull of logs from Config (AWS doesn't store Config logs by lexicographical order).
• [x] Check pull of logs from VPC (flow log id makes that logs don't follow lexicographical order).
• [x] Check pull of logs from KMS (custom).
• [x] Check databases:
  • [x] s3_cloudtrail.db.
  • [x] aws_services.
• [x] Wazuh apps tab show the alerts:
  • [x] Kibana.
  • [x] Splunk.
• [x] Check alerts on Wazuh apps:
  • [x] Kibana.
  • [x] Splunk.

[TJOSERAFAEL]

Hi,

the GuardDuty and TrustedAdvisor services aren't available so the couldn't be tested.