<!--
  Wazuh 5.0 AWS collection, agent-side.

  Merge into /var/ossec/etc/ossec.conf on the agent you nominate as the cloud
  collector, or into the group's shared agent.conf inside <agent_config>.
  Enable it on ONE agent only: a bucket is a single shared source, and two
  collectors mean two copies of every event.

  Option names, defaults and allowed values are from:
  https://documentation.wazuh.com/5.0-beta/user-manual/reference/ossec-conf/wodle-s3.html

  Replace every ALL_CAPS placeholder. The Wazuh documentation wraps these in
  angle brackets; they are unwrapped here so the fragment stays well-formed
  XML. Remove the blocks you do not use.
-->
<ossec_config>

  <wodle name="aws-s3">
    <disabled>no</disabled>
    <!-- Default 10m. CloudTrail batches its own delivery, so a shorter
         interval mostly buys empty polls. -->
    <interval>30m</interval>
    <run_on_start>yes</run_on_start>
    <!-- no = abort on a parse error instead of silently skipping the log -->
    <skip_on_error>no</skip_on_error>

    <!-- CloudTrail management events
         Available bucket types: cloudtrail, guardduty, vpcflow, config,
         custom, cisco_umbrella, waf, alb, clb, nlb, server_access. -->
    <bucket type="cloudtrail">
      <name>AWS_BUCKET_NAME</name>
      <!-- Prefer a profile or an IAM role. access_key / secret_key are
           deprecated in the reference since 4.4.0. -->
      <aws_profile>AWS_PROFILE_NAME</aws_profile>
      <!-- Set this deliberately on first run. Without it the module starts
           from the date of execution at 00:00:00 and ignores history.
           Format is YYYY-MMM-DD, for example 2026-AUG-21. -->
      <only_logs_after>2026-AUG-21</only_logs_after>
      <!-- regions and aws_account_id work only with CloudTrail buckets. -->
      <regions>REGION_1,REGION_2</regions>
      <!-- Leave remove_from_bucket at its default of no. The SIEM should not
           become the only copy of the log. -->
      <remove_from_bucket>no</remove_from_bucket>
    </bucket>

    <!-- Example of dropping noise. The field attribute is mandatory and
         names the event field the regex is applied to.
    <bucket type="cloudtrail">
      <name>AWS_BUCKET_NAME</name>
      <aws_profile>AWS_PROFILE_NAME</aws_profile>
      <discard_regex field="userIdentity.principalID">EXAMPLE6E4XEGITWATV6R</discard_regex>
    </bucket>
    -->

    <!-- CloudWatch Logs
         Service types: cloudwatchlogs, inspector.
         aws_log_groups is mandatory for cloudwatchlogs.
    <service type="cloudwatchlogs">
      <aws_profile>AWS_PROFILE_NAME</aws_profile>
      <aws_log_groups>LOG_GROUP_1,LOG_GROUP_2</aws_log_groups>
      <regions>REGION_1</regions>
      <remove_log_streams>no</remove_log_streams>
    </service>
    -->

    <!-- Amazon Security Lake
         Subscriber types: security_lake, buckets, security_hub.
         sqs_name is mandatory. iam_role_arn and external_id are mandatory
         for a Security Lake subscription.
    <subscriber type="security_lake">
      <sqs_name>SQS_QUEUE_NAME</sqs_name>
      <iam_role_arn>IAM_ROLE_ARN</iam_role_arn>
      <external_id>EXTERNAL_ID</external_id>
      <iam_role_duration>3600</iam_role_duration>
    </subscriber>
    -->

  </wodle>

</ossec_config>
