Wazuh AWS security monitoring
Collecting CloudTrail, GuardDuty, VPC flow logs, Config and other AWS service logs into Wazuh with the aws-s3 module: IAM setup, bucket layout, which services to enable first and ingestion volume.
Wazuh integrations
Connecting Wazuh to cloud platforms, SaaS audit logs, other SIEMs and alerting or SOAR tools through the methods the Wazuh documentation describes.
Wazuh Microsoft Azure monitoring
Monitoring Azure with Wazuh: choosing between Log Analytics, Microsoft Graph and Azure Storage collection in the azure-logs module, and when to put agents on Azure virtual machines instead.
Wazuh Google Cloud monitoring
Bringing Google Cloud logs into Wazuh through Pub/Sub or Cloud Storage buckets, service account credentials, and combining module collection with agents on instances.
Wazuh Microsoft 365 monitoring
Monitoring Exchange, SharePoint, OneDrive and Teams activity in Wazuh through the Office 365 Management Activity API: app registration, subscriptions and the rules that alert on risky activity.
Wazuh GitHub audit log monitoring
Watching GitHub organization audit logs in Wazuh for permission changes, membership changes and repository events, and alerting on activity that suggests a compromised account.
Wazuh and Splunk integration
Running Wazuh alongside Splunk: the three documented forwarding methods, the HTTP Event Collector and index setup, the prebuilt dashboards, and using Wazuh to cut Splunk ingest during a migration.
Wazuh and Elastic Stack integration
Sending Wazuh alerts to an existing Elasticsearch and Kibana deployment through Logstash, the index template and field limit changes, and the provided Kibana dashboards.
Wazuh and Amazon Security Lake integration
Using Wazuh as an Amazon Security Lake source in OCSF format through Logstash and Lambda, or as a subscriber that analyzes Security Lake data.
Wazuh and Shuffle SOAR integration
Sending Wazuh alerts to Shuffle workflows through the integrator for enrichment, ticketing and automated response, and choosing alert level and rule filters so workflows are not flooded.
Wazuh and VirusTotal integration
Checking files changed on endpoints against VirusTotal from Wazuh file integrity monitoring: API key setup, public API rate limits, and pairing results with active response to remove malicious files.
Wazuh alerting to Slack and PagerDuty
Routing high-severity Wazuh alerts to Slack channels and PagerDuty on-call schedules with the integrator: webhook and API key setup, level and group filters, and avoiding alert fatigue.
