Connecting to SIEMonster EKS

Install Kubectl and load AWS config.


1.- First get your AWS access key and secret key, then run aws configure, use ap-southeast-1 as region

2.-Install kubectl 
   https://docs.aws.amazon.com/eks/latest/userguide/install-kubectl.html

3.-reate or update the kubeconfig file for your cluster, run the following command:
aws eks --region ap-southeast-1 update-kubeconfig --name siem


References:

https://aws.amazon.com/premiumsupport/knowledge-center/eks-cluster-connection/
https://docs.aws.amazon.com/eks/latest/userguide/install-kubectl.html

Working with kubectl

https://kubernetes.io/docs/reference/kubectl/cheatsheet/

kubectl get services

 kubectl get pods --all-namespaces

kubectl -n siemonster get pods

kubectl -n siemonster exec -it <Pod_Name> sh


Wazuh Example

kubectl -n siemonster exec -it siemonster-wazuh-0 bash
vi /var/ossec/etc/ossec.conf - add Wodle section
then /var/ossec/bin/ossec-control restart