Monitoring AWS ElastiCache Logs in Wazuh

[Chandra pal singh Chauhan]

Hello Team,

I hope you are doing well.

One of our clients has a requirement to monitor AWS ElastiCache logs using Wazuh. Could you please confirm if this is possible? If so, we would appreciate your guidance on how to configure and integrate these logs with Wazuh.

Looking forward to your support.

Regards 

Chandra

[Md. Nazmur Sakib]

Hi Chandra,

You can forward the Elasticache Logs to Cloudwatch.
Ref: ElastiCache logging destinations

AWS CloudWatch Logs is a service that allows the users to centralize the logs from all their systems, applications, and AWS services in a single place.

And you can monitor Amazon CloudWatch Logs in Wazuh.
Monitoring AWS-based services - CloudWatch Logs

Let me know if you need any further information on this.

[Chandra pal singh Chauhan]

Hello  Nazmur 

Thank you for the response 

can you please confirm for this integration need to be create rules and decoders or already there ?

Regards,

Chandra

[Md. Nazmur Sakib]

As I am aware, there are no rules in the current versions of Wazuh dedicated to ElastiCache.

You can use these documents to create rules:
Custom rules

Rules Syntax

Regular Expression Syntax

You can use the ruleset test tool to test the logs if they match your custom and rules.
Testing decoders and rules

Let me know if you need any further information.

[Chandra pal singh Chauhan]

Thank you  Nazmur for the information and guidance.