Skip to main content

Sources & Agents

Use this guide to understand how host and node telemetry flows into Cloudaware Intrusion Detection (IDS) and how agents are registered, trusted, and managed.

Agent Types and Coverage​

Cloudaware IDS relies primarily on:

When IDS is enabled for a CI:

  • Breeze ensures that the host is discovered and mapped correctly in Cloudaware CMDB.
  • The Wazuh agent runs HIDS checks and sends events to the Wazuh stack.
  • Cloudaware CMDB links events to owners, applications, environments, and compliance scopes.

Registration and Trust​

Cloudaware uses a certificate-based registration process for Wazuh agents:

  • Breeze Agent orchestrates registration of Wazuh agents with the appropriate Wazuh server using cloud-specific identifiers, such as instance IDs, hostnames, and similar identifiers.
  • During registration, each agent receives a signed certificate from the Wazuh server.
  • Mutual TLS is enforced. Agents trust only servers that present valid certificates, and servers allow only agents with valid certificates and expected identities.

This approach reduces the risk of rogue agents or servers joining the deployment.

Telemetry Sources​

Depending on the configuration, Wazuh agents can collect:

  • Operating system logs (system, security, and application logs).
  • File integrity monitoring (FIM) data for critical paths and registries.
  • Authentication, authorization, and sudo activity.
  • Configuration and policy compliance checks.
  • Kubernetes-related signals when running on nodes that participate in clusters.

Fleet Onboarding​

At scale:

  • Use default CMDB views or reports to identify which CIs should be monitored by IDS.
  • Deploy Breeze Agent on the target hosts.
  • Contact Cloudaware Support at support@cloudaware.com to request IDS enablement for target hosts.
  • Verify that all intended hosts show an IDS: Monitored status in CMDB before treating IDS coverage as complete (use the IDS tile on CIs or relevant CMDB list views).