Not receiving all of the events from the AWS integrations

[antonisnyc94]

Wazuh version	Component	Install type	Install method	Platform
4.2.2	Wazuh manager	Manager/Agent	wazuh/wazuh-odfe:4.2.2	Amazon EKS 1.21

Hello,

I've noticed that we do not receive all of the AWS Cloudtrail events created in our ElasticSearch cluster. For example i might intentionally trigger 10 Console login failures, but end up receiving only 3-4 in our Elasticsearch. I confirmed and all of the events are in the s3 bucket. What is the best way to troubleshoot?

all of the s3 plugins run in the master node.

  <wodle name="aws-s3">
  <disabled>no</disabled>
  <interval>5m</interval>
  <run_on_start>yes</run_on_start>
  <skip_on_error>yes</skip_on_error>
  <bucket type="cloudtrail">
    <name>yyyy</name>
  </bucket>
  <bucket type="config">
    <name>zzzzz</name>
  </bucket>
  <bucket type="guardduty">
    <name>yyyy</name>
    <path>guardduty</path>
  </bucket>
  <bucket type="custom">
    <name>yyyy</name>
    <path>kms</path>
  </bucket>
  <bucket type="custom">
    <name>yyyy</name>
    <path>macie</path>
  </bucket>
  <bucket type="cloudtrail">
    <name>xxxx</name>
  </bucket>
  <bucket type="config">
    <name>uuuu</name>
  </bucket>
  <bucket type="guardduty">
    <name>xxxx</name>
    <path>guardduty</path>
  </bucket>
  <bucket type="custom">
    <name>xxxx</name>
    <path>kms</path>
  </bucket>
 </wodle>

Best,
Tony

[davidjiglesias]

Hello @antonisnyc94,

First of all, thank you for your contribution.

The behavior you indicate is very strange and might be exposing a bug. To further troubleshoot, we can first identify if the logs are arriving at the manager. For that, we can enable logall and check archives file to see if all events are there. Remember to restart the manager after changing the configuration.

[an4oh]

Hi, I'm having the same issue related to Cloudtrail integration. Seem that we're receiving events logs only from specific services (eg: no logs from secretsmanager and other services at all). There are updates on this issue?