Webinar Description
Key Takeaways
- Demonstrates building a self-healing AWS VPN using Wazuh active response capabilities
- Covers full infrastructure deployment via CloudFormation
- Integrates Wazuh agent with SoftEther VPN and threat intelligence from S3
- Aimed at cloud security practitioners and AWS administrators
About the Webinar
This webinar presents a practical approach to building automated security response capabilities within AWS environments. The session focuses on integrating Wazuh, an open source security monitoring platform, with SoftEther VPN to create infrastructure that can automatically respond to threats without manual intervention.
Daniel Morales, AWS Community Lead at Cloudkeynet LLC, delivers the technical presentation. The webinar takes place on October 14, 2026.
Technical Implementation
The session walks through deploying the complete infrastructure pipeline using AWS CloudFormation, enabling repeatable and version-controlled deployments. A core component involves installing and configuring the Wazuh agent on SoftEther, the open source VPN solution, to monitor VPN traffic and system events for security anomalies.
The architecture incorporates threat intelligence by configuring Wazuh to pull updated threat data from Amazon S3 at five-minute intervals. This regular refresh cycle ensures the system maintains current threat indicators for detection and response decisions.
Active Response and Self-Healing Concepts
Wazuh active response enables automated actions when specific security events are detected. In the context of this architecture, the self-healing capability allows the VPN infrastructure to take protective measures automatically, such as blocking malicious IP addresses or isolating compromised connections, based on threat intelligence correlation and detection rules.
Who Should Attend
This webinar suits cloud security engineers, AWS administrators and DevSecOps practitioners interested in automating security operations. Familiarity with AWS services, particularly CloudFormation and S3, along with basic understanding of Wazuh or similar SIEM platforms, will help attendees follow the technical content. The session includes a Q&A segment for participant questions.