Skip to content

Commit

Permalink
Merge pull request #7310 from wazuh/wazuh-indexer-211-asl-integration…
Browse files Browse the repository at this point in the history
…-documentation

Add documentation for Wazuh as a custom source ASL integration
  • Loading branch information
javimed authored May 31, 2024
2 parents f7099c8 + 966cff5 commit df086a8
Show file tree
Hide file tree
Showing 9 changed files with 376 additions and 8 deletions.
19 changes: 19 additions & 0 deletions source/_static/js/redirects.js
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,21 @@ redirections.push(
'4.8': '/development/packaging/generate-rpm-package.html',
'4.9': '/development/packaging/generate-deb-rpm-package.html',
},
{
'target': ['4.8=>4.9', '4.9=>4.8'],
'4.8': '/cloud-security/amazon/services/supported-services/security-lake.html',
'4.9': '/cloud-security/amazon/services/supported-services/index.html',
},
{
'target': ['4.9=>4.8'],
'4.8': '/cloud-security/amazon/services/supported-services/security-lake.html',
'4.9': '/cloud-security/amazon/services/supported-services/amazon-security-lake/security-lake-source.html',
},
{
'target': ['4.9=>4.8'],
'4.8': '/cloud-security/amazon/services/supported-services/security-lake.html',
'4.9': '/cloud-security/amazon/services/supported-services/amazon-security-lake/security-lake-subscriber.html',
},
);

/* Pages added in 4.9 */
Expand All @@ -100,6 +115,9 @@ newUrls['4.9'] = [
'/development/coredump.html',
'/development/packaging/generate-indexer-package.html',
'development/packaging/generate-deb-rpm-package.html',
'/cloud-security/amazon/services/supported-services/amazon-security-lake/index.html',
'/cloud-security/amazon/services/supported-services/amazon-security-lake/security-lake-source.html',
'/cloud-security/amazon/services/supported-services/amazon-security-lake/security-lake-subscriber.html',
];

/* Pages no longer available in 4.9 */
Expand All @@ -108,6 +126,7 @@ removedUrls['4.9'] = [
'/deployment-options/offline-installation.html',
'/development/packaging/generate-deb-package.html',
'/development/packaging/generate-rpm-package.html',
'/cloud-security/amazon/services/supported-services/security-lake.html'
];

/* *** RELEASE 4.8 ****/
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
.. Copyright (C) 2024 Wazuh, Inc.
.. meta::
:description: Learn how to configure Amazon Security Lake.

Amazon Security Lake
======================

Amazon Security Lake is a fully-managed security data lake service that consolidates data from multiple AWS and other services, optimizing storage costs and performance at scale. The following sections explain the different types of integrations available and how to configure them with Wazuh:

.. toctree::
:maxdepth: 1

security-lake-source
security-lake-subscriber

Large diffs are not rendered by default.

Original file line number Diff line number Diff line change
Expand Up @@ -3,16 +3,13 @@
.. meta::
:description: Learn how to configure Amazon Security Lake.

.. _amazon_security_lake:
.. _aws_lake_subscriber:

Amazon Security Lake
=========================
Wazuh as a subscriber
=====================

.. versionadded:: 4.4.2


Amazon Security Lake is a fully-managed security data lake service that consolidates data from multiple AWS and other services, optimizing storage costs and performance at scale.

All logs in Amazon Security Lake use the Open Cybersecurity Schema Framework (OCSF) standard for formatting. You can use the Wazuh integration for Amazon Security Lake to ingest security events from AWS services.

These events are available as multi-event Apache Parquet objects in an S3 bucket. Each object has a corresponding SQS message, once it's ready for download.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ The next table contains the most relevant information about configuring each ser
+--------------+----------------------------------------------------------+-----------------------+----------------+------------------------------------------------------------------------------------------------------------------+
| Amazon | :ref:`Amazon ECR Image scanning <amazon_image_scanning>` | service | cloudwatchlogs | |
+--------------+----------------------------------------------------------+-----------------------+----------------+------------------------------------------------------------------------------------------------------------------+
| Amazon | :ref:`Amazon Security Lake <amazon_security_lake>` | subscriber | security_lake | |
| Amazon | :ref:`Amazon Security Lake <aws_lake_subscriber>` | subscriber | security_lake | |
+--------------+----------------------------------------------------------+-----------------------+----------------+------------------------------------------------------------------------------------------------------------------+
| Amazon | :ref:`Custom Logs Buckets <amazon_custom_logs>` | subscriber | buckets | |
+--------------+----------------------------------------------------------+-----------------------+----------------+------------------------------------------------------------------------------------------------------------------+
Expand All @@ -78,6 +78,6 @@ The next table contains the most relevant information about configuring each ser
ecr-image-scanning
cisco-umbrella
elastic-load-balancing/index
security-lake
amazon-security-lake/index
custom-buckets
security-hub
Binary file added source/images/aws/asl-custom-source-form.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added source/images/aws/asl-custom-source.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added source/images/aws/asl-lambda-trigger.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added source/images/aws/asl-overview.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit df086a8

Please sign in to comment.