Skip to main content

Intrusion Detection Architecture

Cloudaware Intrusion Detection (IDS) relies on a combination of agents, Wazuh infrastructure, and Cloudaware services.

Deployment Model​

Cloudaware IDS is a Cloudaware-managed service based on Wazuh. Customers install the Cloudaware Breeze Agent on their servers. Breeze then deploys and configures the Wazuh agents, which connect to the Cloudaware-operated Wazuh Manager and send security telemetry for analysis. Customers focus on coverage, tuning, and responding to alerts.

See Requirements for sizing and connectivity considerations for each model.

Components​

At a high level:

  • Agents – Breeze Agent and/or Wazuh agents on hosts.
  • Wazuh Stack – manager, indexer, and dashboards that process and visualize security events.
  • Cloudaware CMDB – correlates events with CIs, ownership, applications, and environments.
  • Alerting & Tickets – routing of high-priority findings to incident and ticketing systems.

The Wazuh stack is composed of a single universal agent and several central components, which work together in this architecture:

  • Wazuh Server (Manager): The central component that receives, decodes, and analyzes the data sent by the agents. It applies rules and threat intelligence to detect security threats and anomalies, generates alerts, and centrally manages agent configurations. It can be deployed as a single node or in a cluster for scalability and high availability.
  • Wazuh Indexer: This component stores and indexes the alerts and events generated by the Wazuh server, enabling fast searching and data analysis.
  • Wazuh Agents: These are lightweight programs installed on endpoints (servers, cloud instances, etc.) running various operating systems like Windows, Linux, and macOS. The agents collect security data (logs, file integrity changes, configuration information) and securely forward it to the central server.
  • Wazuh Dashboard: A web-based user interface used to visualize the indexed data, monitor system health, manage configurations, and perform threat hunting.

Relationship to CMDB​

Cloudaware IDS integrates with the Cloudaware CMDB to provide stable asset identity across multi-account and multi-cloud environments. Traditional IDS platforms often rely on IP addresses or hostnames, which may be ambiguous or unstable in environments with overlapping subnets or frequently changing infrastructure. Cloudaware IDS instead uses cloud-native identifiers, such as instance IDs, obtained from the CMDB as the primary asset identifiers.

During agent registration, Breeze passes cloud-specific identifiers to the IDS backend and provisions a unique certificate for each agent. This certificate serves as the agent’s cryptographic identity within the IDS platform.

IDS events are enriched with CMDB metadata, including tags, account IDs, account names, and VPC names. As a result, each event can be correlated with a specific managed asset using a combination of the agent certificate, the cloud instance ID, and the CMDB CI, rather than relying solely on IP address or hostname.

Multi-Tenant Isolation and Security​

To protect customer data:

  • Each customer receives logically isolated Wazuh environments, and encryption keys and data are not shared across customers.
  • Registration between Breeze or Wazuh agents and servers uses certificates to establish mutual trust.
  • All communication between agents, Wazuh servers, and Cloudaware services is encrypted in transit, with additional disk encryption for data at rest where applicable.
  • Operational access to Wazuh environments is segmented between engineering (platform configuration and images) and customer support teams (customer-specific troubleshooting), following least-privilege principles.

These controls are described in more detail in Cloudaware’s IDS security documentation and broader security program.

Data Flow​

At a high level:

  1. Breeze Agent discovers the host or node and ensures it is present in CMDB.
  2. Breeze orchestrates Wazuh agent registration to the appropriate Wazuh server and establishes mutual TLS.
  3. Wazuh agents collect host-based telemetry and send events to Wazuh managers and indexers.
  4. Wazuh dashboards and APIs expose alerts and agent status; selected data is ingested into Conflux.
  5. Cloudaware correlates events and findings with CMDB CIs, enriching them with ownership, application, environment, and compliance metadata.