Wazuh with Amazon Elasticsearch Service

[Javier Vivanco]

Hello, everyone. How are you?

It's my first time in this group.
I'm doing a wazuh installation and I think it's a great tool.
I wanted to ask you about using AWS ElasticSearch Service.
Amazon provides ElasticSearch v6.2.3.
Is it possible to use wazuh manager v3.4 with ES 6.2.3?

Should I keep something in mind with the use of this amazon service?
What is your experience using it?

Thank you very much for your time.

Javier Vivanco

[Jose Luis Ruiz]

Hi Javier

Yes it is possible, the only restriction that Wazuh has with Elastic is in the version of the plugin that is necessary to use the Visual Interface.

But because you are using the AWS ElasticSEarch Service you don’t have the option to install the Wazuh plugin, but always can send the alerts to Elasticsearch and then filter the alerts, create your own dashboards, etc.

https://documentation.wazuh.com/current/installation-guide/installing-elastic-stack/elastic_server_rpm.html#kibana

https://github.com/wazuh/wazuh-kibana-app

I hope it helps.

-- 
Jose Luis Ruiz

@jlruizmlg

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To post to this group, send email to wa...@googlegroups.com.
Visit this group at https://groups.google.com/group/wazuh.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/76f3fbd8-a734-4a49-a64a-abfd957bd4a9%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Santiago Bassett]

I believe it is also possible to run Kibana in a different instance. This means Wazuh Kibana plugin can be used too.

Santiago Bassett

@santiagobassett

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/CA%2BOtwaBzNQoS3kRbdn5MSJxGQKugZxYfOE8YGF9haTErJNcnnA%40mail.gmail.com.

[lu...@kuhlu.com]

Yes, you can setup Kibana on its own instance and connect to AWS ES. 

One other note about AWS ES: you can't install Logstash on AWS ES service, so you might also need to put Logstash on its own instance. 

To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.

To post to this group, send email to wa...@googlegroups.com.
Visit this group at https://groups.google.com/group/wazuh.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/76f3fbd8-a734-4a49-a64a-abfd957bd4a9%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.

To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.