Amazon Security lake integration as source

[AlexRuiz7]

Description

Amazon Security Lake is a centralized repository of security data for AWS environments, SaaS providers, on premises, cloud sources, and third-party sources stored in your AWS account.

All the entities listed previously can read or write security lake through subscription or source integrations, respectively. Wazuh already provides an integration as a subscriber, and is listed in the Amazon Security Lake partners program.

We want to create a new integration for Amazon Security Lake, this time as a source, meaning that the designed security data hosted in wazuh-indexer will end up in the security lake for other third-party services to consume and analyze.

Functional requirements

• As a user, I can integrate Wazuh with AWS Security Lake as a source.
• As a user, I can explore Wazuh events from the AWS Security Lake recommended tools (security lake queries, etc.).
• As a user, I can search the AWS marketplace for source integrations and find Wazuh.
• As a user, I have access to a guide on how to integrate Wazuh with Security Lake as a source.

Non-functional requirements

• Our integration complies with all the AWS requirements as stated in their documentation.
• Our integrations will map only essential fields from Wazuh to OCFS.

Implementation restrictions

• We want to implement this integration using Logstash.
• We can use AWS lambda to transform output to parquet, or develop a parquet codec.
• For technical details that may be of use, please refer to this other issue: Integrate Wazuh with Amazon Security Lake as a source wazuh#16362.

Plan

• Study requirements for Wazuh integration as a source.
  • Study good practices and optimization tips.
  • Create an implementation design.
• Create a proof of concept.
• Define OCSF event classes to use.
• Create OCSF decoder for selected Wazuh events.
• Implement integration.
• Test integration.
• Technical documentation and user manual.
• E2E UX test

Tasks

This task list follows from the plan:

• Amazon Security Lake integration - Architecture and requirements #113
• Amazon Security Lake integration - Logstash #135
• Amazon Security Lake integration - Parquet #136
• Amazon Security Lake integration - Data transform and delivery (DTD) #145
• Amazon Security Lake integration - Technical documentation and user manual #211

[AlexRuiz7]

OCSF v1.1.0 was released recently
https://github.com/ocsf/ocsf-schema/releases/tag/v1.1.0