UBA Feature

[PATAN MAHAMMAD KHAN]

Hi Team,

Is there User Behaviour Analytics (UBA) Feature in Wazuh.

Please Confirm ASAP.

[Stuti Gupta]

Hi Patan,
Hope you are doing well today and thank you for using wazuh 

Yes, Wazuh does have User and Entity Behavior Analytics capability. 

Depending on the assets you are monitoring, you can leverage the Wazuh capability for monitoring and detection. For instance, if your deployment is based on AWS, it is possible to monitor its services to detect security-relevant events and they can be visualized in the Wazuh Dashboard: https://documentation.wazuh.com/current/amazon/services/index.html

It is also possible to monitor the servers directly: https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/index.html

In addition to that, we have a good example of the flow here: https://aws.amazon.com/blogs/database/analyze-user-behavior-using-amazon-elasticsearch-service-amazon-kinesis-data-firehose-and-kibana/

In case you are looking for the particular UBA feature-related issue (feature): User Behavior Analytics Support #14446 (https://github.com/wazuh/wazuh/issues/14446) is open.

I hope this helps. Please feel free to contact us for more information/issues.

Regards,