# wazuh-cloud-logs

Companion files for the lesson [Wazuh Cloud Logs: AWS CloudTrail, Azure, GCP, M365](https://maheshtata.com/wazuh/wazuh-cloud-logs/).

Tested against the Wazuh 5.0 beta5 documentation (September 2026). Wazuh 5.0 is
still in beta, so treat every value as subject to change at GA.

| File | What it is | Where it goes |
| --- | --- | --- |
| `aws-s3.ossec.conf.fragment.xml` | `wodle name="aws-s3"` with CloudTrail, CloudWatch Logs and Security Lake examples | agent `ossec.conf`, or a group's `agent.conf` |
| `office365.ossec.conf.fragment.xml` | `office365` module with single and multi-tenant `api_auth` | agent `ossec.conf` |
| `azure-logs.ossec.conf.fragment.xml` | `wodle name="azure-logs"` with Log Analytics, Graph and Storage blocks | agent `ossec.conf` (Linux agent only) |
| `gcp-pubsub.ossec.conf.fragment.xml` | `gcp-pubsub` module with the sink prerequisites in comments | agent `ossec.conf` |

All four are **fragments**, not drop-in replacements. Merge them into the
existing configuration. Every `ALL_CAPS` placeholder must be replaced. The
Wazuh documentation wraps these placeholders in angle brackets; they are
unwrapped here so each file stays well-formed XML.

Agent configuration file locations:

| Platform | Path |
| --- | --- |
| Linux | `/var/ossec/etc/ossec.conf` |
| macOS | `/Library/Ossec/etc/ossec.conf` |
| Windows | `C:\Program Files (x86)\ossec-agent\ossec.conf` |

Group shared configuration lives at
`/var/wazuh-manager/etc/shared/<GROUP_NAME>/agent.conf` on the manager, inside
an `<agent_config>` element.

## Order of operations

1. **Enable the ruleset integration on the dashboard first.** Cloud provider
   integrations ship disabled in 5.0. Security Analytics > Overview (or
   Ruleset Management > Overview), search for the provider, Actions > Enable.
   Without this, events are collected and no finding is ever produced.
2. Create the credentials in the cloud provider with least privilege.
3. Install module prerequisites on the collector agent (Python dependencies
   for Azure and Google Cloud).
4. Merge the fragment, replace placeholders, restart the agent.
5. Confirm events in `wazuh-events-v5-cloud-services` before looking for
   findings in `wazuh-findings-v5-cloud-services`.

## Notes

- Every cloud module runs **on an agent** in 5.0. The manager no longer
  collects cloud logs. Nominate one agent as the collector and put it in its
  own group.
- Enable each module on **one agent only**. A cloud API is a single shared
  source; two collectors produce duplicate events.
- Cloud events are decoded into the single `cloud-services` category. There is
  no per-provider data stream. Filter on `wazuh.integration.name` to separate
  AWS from Azure from GCP.
- The 5.0 beta documentation does **not** publish an IAM policy for the
  `aws-s3` module; the prerequisite pages are absent from the beta tree.
  Derive permissions from the configuration you actually deploy and re-check
  at GA.
- `access_key` and `secret_key` are deprecated in the AWS reference since
  4.4.0. Use `aws_profile` or `iam_role_arn`.
- The Azure credentials file must be `root:wazuh` mode `640`.
- Only one `gcp-pubsub` section is supported per configuration file.