Wazuh Cloud Container

Wazuh Cloud and Container

Cloud and SaaS logs reach Wazuh through integration modules on the manager (or a collector agent), so the agent is usually the manager or collector — the real actor is in data.*. Always pivot on the identity, source IP and resource from data, not on agent.name.

Integrations in the stock ruleset

| Source | Groups | Key rules (level) | Key fields | |---|---|---|---| | AWS CloudTrail | amazon, aws, aws_cloudtrail | rule 80202 (level 3, API call), rule 80203 (level 4, API call with error), rule 80253 (level 3, console login success), rule 80254 (level 5, console login failed), rule 80255 (level 10, possible break-in attempt), rule 80252 (level 10, high number of deleted objects) | data.aws.eventName, eventSource, userIdentity.arn, sourceIPAddress, awsRegion, errorCode | | AWS GuardDuty | aws_guardduty | rules 80301, 80302, 80303 (levels 3, 6, 10 by finding severity); with remote IP: rules 80305, 80306, 80307 | data.aws.title, service.action.actionType, severity, resource | | AWS VPC Flow / WAF / Config / Inspector / Macie / KMS / Security Hub | aws_vpcflow, aws_waf, aws_config, aws_inspector, aws_macie, aws_kms, aws_security_hub | By group | Service-specific under data.aws.* | | Azure | azure | rule 87802 (level 3, "Azure: AD $(activityDisplayName)"), rule 87811 (level 3, Log Analytics operation) | data.activityDisplayName, operation, caller | | Microsoft Graph (Defender/Entra alerts & incidents) | ms-graph | rule 99503 (level 6, alert/incident not resolved and not a false positive) | alert title, severity, entities | | GCP | gcp | rule 65053 (level 3, firewall rule created), rule 65054 (level 3, firewall rule deleted), rule 65056 (level 3, logging bucket deleted), rule 65057 (level 3, logging sink deleted), rule 65070 (level 3, new service account created) | data.gcp.protoPayload.*, principal, resource | | Office 365 | office365 | rule 91556 (level 12, phishing/malware events from Exchange Online Protection / Defender), rule 91700 (level 14, malware detected in file), rule 91724 (level 10, suspicious download activity by user) | data.office365.UserId, Operation, ClientIP, Workload | | GitHub | github | rule 91152 (level 9, environment actions secret removed), rule 91197 (level 7, organization actions secret created); secret-scanning groups git_secret_scanning, git_repository_secret_scanning | data.github.actor, action, repo, org | | Docker (docker-listener) | docker | rule 87907 (level 3, command launched in container), rule 87908 (level 5, shell session started in container), rule 87910 (level 3, file copied from host into container), rule 87902 (level 5, container destroyed) | data.docker.Actor.Attributes.name, image, Action |

Kubernetes audit logs are not covered by the stock ruleset (only EKS controls via Security Hub). Monitoring kube-apiserver audit events needs a custom decoder and custom rules (example to create: custom rule 100500 for pods/exec by a non-admin identity). Say so rather than implying coverage.

Many cloud rules are level 3 by design — the stock ruleset records activity and leaves importance to context. A level-3 DeleteTrail, StopLogging, logging-sink deletion or root-account login matters far more than its level.

What "normal" looks like (baseline before judging)

• Identities: known automation roles and CI users make most API calls at steady rates; humans log in

from known IP ranges and regions.

• Use get_alerts_aggregated and search_security_events with the identity or IP as query over

7d to establish prevalence before calling an action anomalous.

High-signal patterns

| Pattern | Where | ATT&CK | |---|---|---| | Logging disabled/deleted (CloudTrail StopLogging/DeleteTrail, GCP sink/bucket deletion) | CloudTrail, GCP | T1562.008 | | Console login failures then success, new region/IP, no MFA | CloudTrail, Entra/Graph, O365 | T1110, T1078.004 | | New access keys / service accounts / role trust changes | CloudTrail, GCP | T1098.001, T1136.003 | | Mass object deletion (rule 80252) or bucket policy made public | CloudTrail | T1485, T1530 | | Mailbox forwarding rules, suspicious downloads (rule 91724) | Office 365 | T1114.003, T1530 | | Secrets removed/rotated unexpectedly, secret-scanning hits | GitHub | T1552 | | Shell in container (rule 87908), host file copied in (rule 87910), privileged container | Docker | T1609, T1611 |

Containment is outside Wazuh active response

Wazuh AR acts on endpoints with agents; it cannot disable an IAM user, revoke a cloud session or delete a GitHub token. Record cloud containment as manual recommendations in the finding (disable access key, revoke sessions, restore logging, rotate secret) with the exact identity and resource. Only host-level actions for a compromised VM or container host with a Wazuh agent go to response-planner.

Output

• add_entities: cloud identity (type user, value = ARN / UPN / principal), source IP, resource

names (type host or url as appropriate), repository.

• link_mitre for the pattern (cloud sub-techniques where they apply).
• add_finding: source integration, identity, what happened, baseline comparison, verdict, and manual

cloud containment steps.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: gensecaihq
• Source: gensecaihq/Wazuh-Autopilot
• License: MIT
• Homepage: https://wazuh-mcp-openclaw.netlify.app/

Install and usage instructions live in the source repository linked above.