Amazon Security lake integration as source

[AlexRuiz7]

Description

Amazon Security Lake is a centralized repository of security data for AWS environments, SaaS providers, on premises, cloud sources, and third-party sources stored in your AWS account.

All the entities listed previously can read or write security lake through subscription or source integrations, respectively. Wazuh already provides an integration as a subscriber, and is listed in the Amazon Security Lake partners program.

We want to create a new integration for Amazon Security Lake, this time as a source, meaning that the designed security data hosted in wazuh-indexer will end up in the security lake for other third-party services to consume and analyze.

Functional requirements

• As a user, I can integrate Wazuh with AWS Security Lake as a source.
• As a user, I can explore Wazuh events from the AWS Security Lake recommended tools (security lake queries, etc.).
• As a user, I can search the AWS marketplace for source integrations and find Wazuh.
• As a user, I have access to a guide on how to integrate Wazuh with Security Lake as a source.

Non-functional requirements

• Our integration complies with all the AWS requirements as stated in their documentation.
• Our integrations will map only essential fields from Wazuh to OCFS.

Implementation restrictions

• We want to implement this integration using Logstash.
• We can use AWS lambda to transform output to parquet, or develop a parquet codec.
• For technical details that may be of use, please refer to this other issue: Integrate Wazuh with Amazon Security Lake as a source wazuh#16362.

Plan

• Study requirements for Wazuh integration as a source.
  • Study good practices and optimization tips.
  • Create an implementation design.
• Create a proof of concept.
• Define OCSF event classes to use.
• Create OCSF decoder for selected Wazuh events.
• Implement integration.
• Test integration.
• Technical documentation and user manual.
• E2E UX test

Tasks

This task list follows from the plan:

• Amazon Security Lake integration - Architecture and requirements #113
• Amazon Security Lake integration - Logstash #135
• Amazon Security Lake integration - Parquet #136
• Amazon Security Lake integration - Data transform and delivery (DTD) #145
• Amazon Security Lake integration - Technical documentation and user manual #211
• Amazon Security Lake integration - E2E testing #238

[AlexRuiz7]

OCSF v1.1.0 was released recently
https://github.com/ocsf/ocsf-schema/releases/tag/v1.1.0

[sidharthancr]

@AlexRuiz7 I am eagerly looking for the features.

Any idea on release date?

[AlexRuiz7]

Hi @sidharthancr

This is part of the 4.9.0 release, which is planned for Q3 2024. This project is currently on internal testing. The code and the documentation are already in this repo, so feel free to test it and report any issues you find with us so we can fix that before the release. We'd appreciate that.

• https://github.com/wazuh/wazuh-indexer/tree/4.9.0/integrations/amazon-security-lake