HLDModulesSecOps
v1.2 is unreleased — see v1.1 for the current stable release.
Cloud Resource Scanning
Cloud account security scanning via Wazuh — CloudTrail and cloud resource configuration checks.
Cloud Resource Scanning
Cloud resource scanning integrates with Wazuh to monitor cloud account activity and detect security misconfigurations across AWS resources. It uses CloudTrail to ship audit logs to Wazuh for analysis.
How It Works
API Reference
Account Security Integration
Repo: mcm-module-secops · Table: secops_cloud_accounts
Enable CloudTrail + Wazuh Integration
POST /secops/cloud-accounts
Sets up CloudTrail on the specified AWS account to ship logs to Wazuh:
| Step | Description |
|---|---|
| Creates S3 bucket | Stores CloudTrail logs |
| Enables CloudTrail | Configures trail to log to the S3 bucket |
Status → Active | If configuration succeeds |
Status → Failed | If configuration fails |
Rules:
- If the integration is already
Active, the API returns a message that it is already active (no re-configuration). - If the status is
Failed, the API can be re-called to retry configuration.
Get Account Integration Status
GET /secops/cloud-accounts/:id
Returns: CloudTrail name, S3 bucket, status, and relevant configuration details.
Host Security Integration
Repo: mcm-module-secops · Table: secops_hosts
| Method | Endpoint | Description |
|---|---|---|
POST | /secops/hosts/:id/install-agent | Install Wazuh agent on the host via SSH |
POST | /secops/hosts/:id/uninstall-agent | Uninstall Wazuh agent from the host |
GET | /secops/hosts/:id | Get host status, name, IP, and agent status |