User and Entity Behavior Analytics feature in Wazuh

[Wauh Test]

Hi Team,

We need to enable User and Entity Behavior Analytics feature in Wazuh. Do wazuh has the capability for it?

Regards,

Ekta

[Miguel Casares]

Hello Ekta,

Yes, Wazuh does have that capability. 

Depending on the assets you are monitoring, you can leverage the Wazuh capability for monitoring and detection. For instance, if your deployment is based on AWS, it is possible to monitor its services to detect security-relevant events and they can be visualized in the Wazuh Dashboard: https://documentation.wazuh.com/current/amazon/services/index.html

It is also possible to monitor the servers directly: https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/index.html

In addition to that, you have here a good example of the flow here: https://aws.amazon.com/blogs/database/analyze-user-behavior-using-amazon-elasticsearch-service-amazon-kinesis-data-firehose-and-kibana/

I hope this helps. Let me know if you have further questions,

Miguel