Automated evidence archiving with Wazuh and S3: what teams should check

TL;DR: Secure forensic archiving keeps evidence tamper-resistant by separating preserved alert records from live telemetry, and Wazuh’s Shuffle-based S3 workflow shows how immutable storage, bucket policy restrictions, and logging can support chain of custody in incident response. The governance lesson is that evidence handling is itself a control plane, not a back-office storage task.

NHIMG editorial — based on content published by Wazuh: Secure forensic archiving with Wazuh, Shuffle, and Amazon S3

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities.

Questions worth separating out

Q: How should security teams govern automated evidence archiving in S3?

A: Use separate storage for preserved evidence, restrict the writing principal to upload-only access, and enforce immutable retention for the required period.

Q: Why is chain of custody an identity problem as well as a storage problem?

A: Because the archive depends on which human and non-human identities can write, read, or change evidence objects.

Q: What breaks when Object Lock is used without tight bucket policies?

A: Immutability alone does not stop unauthorised writes, policy changes, or access to the wrong bucket path.

Practitioner guidance

• Separate evidence storage from operational telemetry Store preserved alerts in a dedicated archive bucket with different access rules from live logging and SIEM data.
• Treat the workflow account as a privileged NHI Restrict the automated writer to upload-only permissions plus minimal bucket metadata reads.
• Enforce immutable retention on the evidence bucket Enable Object Lock in compliance mode where your legal and operational requirements demand tamper resistance.

What's in the full article

Wazuh's full blog post covers the operational detail this post intentionally leaves for the source:

• Step-by-step Shuffle workflow configuration for archiving alerts into S3
• Exact bucket settings for block public access, server access logging, versioning, and Object Lock
• Sample IAM policy and bucket policy definitions for controlled write access
• Console validation steps showing how to confirm immutability and upload restrictions

👉 Read Wazuh's full guide to automated forensic archiving with Shuffle and S3 →

Automated evidence archiving with Wazuh and S3: what teams should check?

Explore further

View Full Forum →  |  NHI Foundation Course →