How to configure Wazuh Server or Wazuh Agent to get AWS region and account ID data

[fhperuchi]

Hi.

Could you please help me configure Wazuh or Wazuh Agent so that I can get the Wazuh aws.accountId and aws.region populated?

  "aws": {
    "accountId": "",
    "region": ""
  }

Example:

{
  "vulnerability": {
    "severity": "Critical",
    "package": {
      "condition": "Package greater or equal than 5.30.0 and less than 5.38.2",
      "name": "perl-base",
      "source": "perl",
      "version": "5.32.1-4+deb11u2",
      "architecture": "amd64"
    },
    "references": [
      "https://github.com/Perl/perl5/commit/12c313ce49b36160a7ca2e9b07ad5bd92ee4a010",
      "https://github.com/Perl/perl5/commit/7047915eef37fccd93e7cd985c29fe6be54650b6",
      "https://github.com/Perl/perl5/commit/ff1f9f59360afeebd6f75ca1502f5c3ebf077da3",
      "https://nvd.nist.gov/vuln/detail/CVE-2023-47100"
    ],
    "assigner": "cve@mitre.org",
    "published": "2023-12-02",
    "cwe_reference": "CWE-755",
    "title": "CVE-2023-47100 affects perl-base",
    "type": "PACKAGE",
    "rationale": "In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \\p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.",
    "cve": "CVE-2023-47100",
    "cvss": {
      "cvss3": {
        "base_score": "9.800000",
        "vector": {
          "user_interaction": "none",
          "integrity_impact": "high",
          "scope": "unchanged",
          "confidentiality_impact": "high",
          "availability": "high",
          "attack_vector": "network",
          "access_complexity": "low",
          "privileges_required": "none"
        },
        "impact_score": "5.900000",
        "exploitability_score": "3.900000"
      }
    },
    "updated": "2023-12-14",
    "status": "Active"
  },
  "aws": {
    "accountId": "",
    "region": ""
  }
}