Wazuh Storage Schema

[Victor Silva]

Hi,

My team and I are trying to figure out a way to store outside of the Wazuh Manager all alerts and non-alerts events. I've attached a screenshot of what we're trying to achieve. It'll probably make it easier to understand.

So basically the indexer would send the compressed data to an AWS S3. Then, whenever that data needed to be accessed, the Wazuh-Dashboard would collect straight from the AWS S3 and display it on the original linux machine where it's installed.

Is there any way it can be done?

Thanks,
Victor Silva.

[Vitor Souza]

I have the same doubt